iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by ekidd on Monday July 19, 2021 @03:42PM (#27886534)

> But parsing and memory safety are hard. Like, really hard.

This doesn't have to be the case. Start by avoiding C and C++. Use Java (on Android) to write parsers. It is very hard to take a buggy parser written in Java, and to escalate to a memory corruption attack.

If you really can't use a language like Java, write your parser in safe Rust using slices over Vec<u8>. Then run a fuzzer over it. You'll find a few runtime panics, but you're vanishingly unlikely to encounter memory corruption.

Buffer overflows and memory corruption can be almost entirely avoided these days, at a price.

[ Parent | on HN ]

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by andrewzah on Tuesday July 20, 2021 @12:41PM (#27896027)

Yes, I imagine that in the future we'll be writing these sorts of tools in memory-safe languages like Rust.

In fact I believe that it's hubris to think that we can write massive, complex systems in unsafe languages and -not- overlook some bugs here and there. We had no choice but to use these languages before, but Rust, etc, give us alternate choices now.

[ Parent | on HN ]