News for hackers. Stuff that matters.

A comment on iOS 14.6 device hacked with a zero-click iMessage exploit to install Pegasus. Parent comment

Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by saagarjha on Monday July 19, 2021 @05:59AM (#27880791)
That tweet doesn't make a lot of sense, because it's essentially saying "don't let people send you images".
[ Parent | on HN ]
Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by quenix on Monday July 19, 2021 @09:50AM (#27882632)
To the my inner armchair security enthusiast, a good solution looks like this:

  On incoming message, check one thing and one thing only: is the sender in the contact list? If YES...
     + Run the message through BlastDoor and continue as normal.
  If NOT…
     - Stop all non-essential parsing immediately.
     - Continue with a flow similar to modern e-mail clients (To increase your privacy, we have blocked some elements of this message).
     - Only continue normal message parsing if the user explicitly consents.
[ Parent | on HN ]
Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by KaiserPro on Monday July 19, 2021 @06:53AM (#27881102)
to me it says:

Only run the known dodgy parsing code on stuff coming from people in your contact list, not just on any random image that comes in.

[ Parent | on HN ]