This is not true. With the right setup, you can send a push notification to your app to wake it up and execute code. See this delegate method for example: https://developer.apple.com/documentation/uikit/uiapplicatio....
So, in theory other messaging apps have the same vulnerabilities, but I’d have to open the message to get burnt?
No. This attack is specific to iMessage, since iMessage can access the springboard (the singleton class, not Springboad.app), while apps downloaded from the App Store cannot.
Yes. These apps also have happened to WhatsApp.
Still hard to understand. If it’s just image preview code, why isn’t Safari vulnerable?
It's not exactly specific to the image preview code, but rather the code that handles the notification when receiving an iMessage.
The attack mentioned in the Wired article[1] relies on iMessage asking the sandboxless Springboard[2][3] to deserialize a maliciously crafted field, included in the incoming iMessage, to escape the sandbox. This specific vulnerability doesn't appear to apply to other apps.
[1] https://googleprojectzero.blogspot.com/2019/08/the-fully-rem... [2] https://en.wikipedia.org/wiki/SpringBoard [3] https://iphonedev.wiki/index.php/SpringBoard
It might be, it’s just that using Safari would turn a zero-click attack into a one-click one (click on my shady link). (Also, WebKit runs with a different sandbox that may require special effort to escape out of.)
Re:Apple iMessage Zero-Click Hacks
by simondotau on Tuesday September 07, 2021 @08:52AM
(#28444093)
A bit off topic, but when did we ever expect integrated apps to be restricted to App Store rules? They're literally sold as part of the device, not as an app through the App Store.
For other apps like Telegram; the server can send a predefined notification message.
For iMessage, when you get something even from someone outside your contacts, its daemon invokes specific code to handle the message, and its attachments.
Whilst this doesn't help if someone opens the app, it does at least change this from a zero click attack, to a one click attack.
(This is also another example of Apple not following its own app store rules. It has privileged access to frameworks.)