News for hackers. Stuff that matters.

A comment on iOS 14.6 device hacked with a zero-click iMessage exploit to install Pegasus. Parent comment

Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by simonw on Sunday July 18, 2021 @10:12PM (#27878565)
From later in that Twitter thread:

"It also indicates that Apple has a MAJOR blinking red five-alarm-fire problem with iMessage security that their BlastDoor Framework (introduced in iOS 14 to make zero-click exploitation more difficult) ain't solving."

And:

"BlastDoor is a great step, to be sure, but it's pretty lame to just slap sandboxing on iMessage and hope for the best. How about: "don't automatically run extremely complex and buggy parsing on data that strangers push to your phone?!"

[ Parent | on HN ]
Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by saagarjha on Monday July 19, 2021 @05:59AM (#27880791)
That tweet doesn't make a lot of sense, because it's essentially saying "don't let people send you images".
[ Parent | on HN ]
Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by quenix on Monday July 19, 2021 @09:50AM (#27882632)
To the my inner armchair security enthusiast, a good solution looks like this:

  On incoming message, check one thing and one thing only: is the sender in the contact list? If YES...
     + Run the message through BlastDoor and continue as normal.
  If NOT…
     - Stop all non-essential parsing immediately.
     - Continue with a flow similar to modern e-mail clients (To increase your privacy, we have blocked some elements of this message).
     - Only continue normal message parsing if the user explicitly consents.
[ Parent | on HN ]
Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by KaiserPro on Monday July 19, 2021 @06:53AM (#27881102)
to me it says:

Only run the known dodgy parsing code on stuff coming from people in your contact list, not just on any random image that comes in.

[ Parent | on HN ]
Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by badkitty99 on Sunday July 18, 2021 @10:19PM (#27878608)
All part of the ad model
[ Parent | on HN ]
Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by sjfidsfkds on Monday July 19, 2021 @01:51AM (#27879648)
This sounds interesting, but there’s not enough detail for me to understand what you mean. Care to elaborate?
[ Parent | on HN ]