iOS 14.6 device hacked with a zero-click iMessage exploit to install Pegasus

Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by GeekyBear on Sunday July 18, 2021 @09:51PM (#27878453)

>One of the major changes in iOS 14 is the introduction of a new, tightly sandboxed “BlastDoor” service which is now responsible for almost all parsing of untrusted data in iMessages (for example, NSKeyedArchiver payloads). Furthermore, this service is written in Swift, a (mostly) memory safe language which makes it significantly harder to introduce classic memory corruption vulnerabilities into the code base.

...This blog post discussed three improvements in iOS 14 affecting iMessage security: the BlastDoor service, resliding of the shared cache, and exponential throttling. Overall, these changes are probably very close to the best that could’ve been done given the need for backwards compatibility, and they should have a significant impact on the security of iMessage and the platform as a whole.

https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...

[ Parent | on HN ]

Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by simonw on Sunday July 18, 2021 @10:12PM (#27878565)

From later in that Twitter thread:

"It also indicates that Apple has a MAJOR blinking red five-alarm-fire problem with iMessage security that their BlastDoor Framework (introduced in iOS 14 to make zero-click exploitation more difficult) ain't solving."

And:

"BlastDoor is a great step, to be sure, but it's pretty lame to just slap sandboxing on iMessage and hope for the best. How about: "don't automatically run extremely complex and buggy parsing on data that strangers push to your phone?!"

[ Parent | on HN ]

Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by saagarjha on Monday July 19, 2021 @05:59AM (#27880791)

That tweet doesn't make a lot of sense, because it's essentially saying "don't let people send you images".

[ Parent | on HN ]

Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by quenix on Monday July 19, 2021 @09:50AM (#27882632)

To the my inner armchair security enthusiast, a good solution looks like this:

  On incoming message, check one thing and one thing only: is the sender in the contact list? If YES...
     + Run the message through BlastDoor and continue as normal.
  If NOT…
     - Stop all non-essential parsing immediately.
     - Continue with a flow similar to modern e-mail clients (To increase your privacy, we have blocked some elements of this message).
     - Only continue normal message parsing if the user explicitly consents.

[ Parent | on HN ]

Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by KaiserPro on Monday July 19, 2021 @06:53AM (#27881102)

to me it says:

Only run the known dodgy parsing code on stuff coming from people in your contact list, not just on any random image that comes in.

[ Parent | on HN ]

Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by badkitty99 on Sunday July 18, 2021 @10:19PM (#27878608)

All part of the ad model

[ Parent | on HN ]

Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by sjfidsfkds on Monday July 19, 2021 @01:51AM (#27879648)

This sounds interesting, but there’s not enough detail for me to understand what you mean. Care to elaborate?

[ Parent | on HN ]

Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by Gaelan on Sunday July 18, 2021 @10:03PM (#27878517)

I'd expect so, but the exploits we're talking about are post-BlastDoor, so something clearly isn't working.

[ Parent | on HN ]