# How I Found A Vulnerability To Hack iCloud Accounts and How Apple Reacted To It

Race-condition bypass of Apple ID forgot-password rate limits allowed concurrent OTP brute force, enabling iCloud account takeover with trusted phone number and email.

- Payout: $18,000
- Severity: critical
- Program: Apple
- Credited: Laxman Muthiyah
- Disclosed: 2021-06-19
- Write-up quality: 8/10
- Original: https://thezerohack.com/apple-vulnerability-bug-bounty
- Library page: https://bugbountylibrary.com/r/blog%3Athezerohack-com-apple-vulnerability-bug-bounty
- Tags: domain:web impact:ato kind:bounty platform:blog sev:critical tech:rest technique:race-window technique:recon vuln:account-takeover vuln:auth-bypass vuln:mfa-bypass vuln:race-condition

**Target:** iforgot.apple.com password/verify/smscode and escrowproxy SRP recover endpoints
**Root cause:** Per-endpoint and per-server rate limits were enforced non-atomically, so concurrent requests from many IPs slipped past the 5-attempt lockout and 6-concurrent-POST cap, permitting brute force of 6-digit OTPs.
**Steps:**
1. Resolve iforgot.apple.com to its 6 global IPs (17.141.5.112, 17.32.194.36, 17.151.240.33, 17.151.240.1, 17.32.194.5, 17.111.105.243).
2. Bind hostname to each IP and send up to 6 concurrent POSTs per IP (36 total per client IP) to `/password/verify/smscode`.
3. Rotate across ~28K non-blacklisted IPs (avoid AWS/GCP ASNs, which return 502) to cover 10^6 OTP combinations.
4. Submit concurrent OTP guesses; correct code returns success, bypassing the 5-attempt lockout.
5. Repeat same race technique on email code, 2FA, and password validation endpoints.
6. After SMS bypass, obtain user salt via SRP init, then race the `/escrowproxy/api/recover` key-verification endpoint to brute force device passcode.
**How found:** After observing strong sequential rate limits (5 attempts locks account, 6 concurrent POSTs per IP blacklists), author hypothesized limits were per-server-IP not global, tested concurrency across the 6 resolved IPs, and found cloud ASNs blocked but other providers worked.
**Exploitation:** Attacker needs target's email and trusted phone number. Using distributed IPs and concurrent POSTs to the 6 Apple front-end IPs, they brute force the 6-digit SMS OTP, then the email OTP, then 2FA, then password/passcode, achieving full iCloud account takeover and remote device wipe.
**Escalation:** Chained SMS OTP bypass → email OTP bypass → 2FA bypass → password validation bypass → SRP passcode brute force, escalating from account takeover to locked-device passcode recovery.
**Insight:** When a hostname resolves to multiple backend IPs, rate limits scoped per-IP multiply your attempt budget; test concurrency pinned to each IP and probe which ASNs are blocklisted to find usable egress.