PIN 📌 BYPASS 🥷

Summary

Summary

A PIN bypass vulnerability is discovered in the iOS application where the rate limiting mechanism for PIN attempts can be circumvented by manipulating the device's local date/time settings. The application implements a 5-minute lockout period after 5-6 failed PIN attempts, however, this security control is found to rely on the device's local time settings rather than server-side validation. By altering the device's date/time settings, an attacker can bypass this rate limit restriction and continue attempting to brute force the PIN without waiting for the lockout period to expire.

Steps to Reproduce

1. Install the iOS application from the App Store
2. Create a PIN within the application
3. Close and reopen the application
4. When prompted for PIN entry, attempt multiple incorrect PINs
5. After 5-6 failed attempts, observe the 5-minute lockout message
6. Change the device's date/time settings
7. Return to the application and verify that additional PIN attempts can be made without waiting for the lockout period

Impact

The vulnerability allows an attacker to perform unlimited PIN attempts by bypassing the rate limiting mechanism, potentially leading to unauthorized access to user accounts through PIN brute-forcing. This represents a significant authentication bypass that could compromise user account security.

The CWE-287 (Improper Authentication) category typically results in:

• Unauthorized access to user accounts
• Bypass of authentication mechanisms
• Compromise of user data and privacy
• Potential full account takeover
• Circumvention of security controls meant to protect user accounts