Phone Numbers not saved in the contact list can be called from a locked iPhone (after first unlock) by using Spotlight Search.

PoC: https://youtube.com/shorts/011jq9SN6MA

Physical access to a locked iPhone with default configuration after first unlock (incl. Lockdown Mode (https://support.apple.com/en-us/105120)).

1. Use Spotlight Search to search for a Phone Number (with proper country codes e.g., +36 for Hungary).
2. Tap on the number label itself (not the phone icon) to call arbitrary phone numbers that are not saved in the contact list.

Tapping the Phone Number text label itself shown in Spotlight Search results calls the Entered Phone Number. It is also possible to call Premium-Rate Phone Numbers (Phone thievery comeback is real lol💀🥀).

Enter any unsaved Phone Number:

And click on the Phone Number text itself to start calling:

Possible Remediation: As used in the Email sending feature, Calling should also require the user to unlock the device except when calling an emergency number.

• Haha it's just intentional behavior if u want securti✨ just disable the function and get fkd retard

It is possible to confirm whether a Phone Number/Email is saved in an locked iPhone (after first unlock) by using Spotlight Search.

PoC: https://youtube.com/shorts/011jq9SN6MA

Physical access to a locked iPhone with default configuration after first unlock (incl. Lockdown Mode (https://support.apple.com/en-us/105120)).

1. Use Spotlight Search to search for a Phone Number (with proper country coding e.g., +36 for Hungary)/Email Address.
2. If the Phone Number/Email Address is in the Contact List, there will be no option to Call/Email them (only search in safari shows up).

Saved Contact Info (Phone Number ending in 37, Email ending in 02@gmail.com):

Only Safari Search shows up when a Saved Contact is hit:

Add Email shows up when an Unsaved Contact is hit:

It's the same with Phone Numbers…

Phone Number is SAVED IN Contact List:

Phone Number is NOT saved in Contact List:

Possible Remediation: Only show Add Number/Email option after unlocking the device to avoid Contact Information Disclosure.

• Haha it's just intentional behavior if u want securti✨ just disable the function and get fkd retard

If a private profile has a collaboration post with a public profile it is possible to access the post and the collaborators without authentication, only by knowing the private profile's username, thus expand the possible connections to the target of the investigation.

By opening https://www.instagram.com/szh4ck3r/ (unauthenticated) the browser will make a request to https://www.instagram.com/api/v1/users/web_profile_info/?username=szh4ck3r (old instagram API) which would list the user's collaboration posts with public profiles.

GQL api get feed:

• Literally nothing lmao

• Obv. listed

• Ohshi w(hy)tf

• no szh4ck"
  • aka Unauth is the new auth

• Haha it's just intentional behavior get fkd retard

Keybase allows \ (backslashes) in uploaded filenames which leads to path traversal in windows and it can be chained to rce.

POC.mp4

The first kick was an issue that my friend found in keybase, which was closed as informative.

The next day I decided to take a closer look at keybase because it was a chat application like discord but it was end2end encrypted. Keybase is free so there was no paywall blocking me neither any paid membership crap. Since I had experience using chat apps like discord, messenger, etc. I didn't have to learn the basics of how to use Keybase.

Firstly I thought little issues, little leaks could also have a great impact because of the nature of end2end encryption.

And that was the time when me and the boys started looking into Keybase's webapp and desktop clients.

My daily driver is debian and that's the reason why I preferred to look into the linux app. In the first days we didn't find anything. We just started using keybase and started feeling how it works and what are the differences compared to other chat applications.

Then I started reading public writeups on keybase bugs published on hackerone's hacktivity. Some of them were privilege escalations with the installer some of them were really weird bugs, and I also found windows path related issues.

Oh boy, my favorite was when the tester gave the file a name with a full windows path and sent it in the chat to its victim. When the victim downloaded it the file got stored on the location where the absolute windows path pointed to. (713006)

In the next couple of days I found a bypass for one of the public issues but the report is not public yet but I'll definitely post it as soon as it gets disclosed.

After getting a bounty for that report I was like damn this was great, it's time to go to parties with frieds and other stuff like that because I had the money for it. :D

After couple of weeks, I started poking keybase again on the weekends because I didn't have anything else to do at the moment. I thought if there was one issue I should be able to find another. I just started thinking about possible issues in the next week or two without even touching the application.

And when the weekend came something popped into my mind. What if I give a file a name with a traversal in it? I mean a windows-only traversal with backslashes like ..\..\..\ because we can name a file like this on linux (backlash \ is allowed, unlike forwardslash /) then keybase syncronizes it to windows and you will have a file with a traversal in its name.

I uploaded this file into a group and I traversed to an other file which was inside of an other user's public directory.

I opened the location in windows explorer and tried to click on the file with the traversal in in the name, but my windows 7 just errored out that the file was inaccessible. Well fuck, it didn't work. Or maybe it did just on another windows OS? That day I created and tried multiple traversal payloads with several apps like cmd and stuff but none of them worked on my windows 7. In the afternoon my friend just joined discord and asked why I posted a cmd icon image in the group. I was like holy moly the traversal worked on his OS which was the most recent windows 10 in this case.

We quickly tried it with the image you can see in my report (doge meme –trav–> h1 wallpaper) and it also worked. Then we recorded the POC with the wordfiles which also worked well.

After that I tried already known windows issues like the disk corruption, and the one where I named the file/directory to an absolute windows path like C:\Users\asdf\Desktop and when the victim tried to delete the file/directory the actual path got deleted. (For instance, the user would've deleted his own desktop folder in this example).

However, this did not work on windows 7 but it did on XP which means microsoft probably developed windows 10 from an XP base and they completely threw the windows vista/7 line away. This could mean you might be able to find some older windows bugs on windows 10 which were patched in vista or 7.

Report SENT to Keybase w/ High Severity:
    April 18, 2021 16:56:07 CEST

- NTFS Disc Corruption (C:\:$i30:$bitmap) + File deletion with absolute paths:
    April 28, 2021 22:20:53 CEST
- Automatic NTFS Disc Corruption with web link icons:
    April 29, 2021 12:22:46 CEST

Report TRIAGED as Path Traversal:
    June 7, 2021 22:31:31 CEST
Bounty: 2000$
    June 7, 2021 22:32:53 CEST

- Retest comment, (little UI issue after patch):
    June 11, 2021 16:01:02 CEST

Report RESOLVED: CVE-2021-34422
    September 17, 2021 18:08:51 CEST

• CVE-2021-34422
• Zoom's Security Bulletin