Re:Apple iMessage Zero-Click Hacks
by eloisius on Tuesday September 07, 2021 @05:55AM
(#28442882)
So, in theory other messaging apps have the same vulnerabilities, but I’d have to open the message to get burnt?
[ Parent
| on HN ]
No. This attack is specific to iMessage, since iMessage can access the springboard (the singleton class, not Springboad.app), while apps downloaded from the App Store cannot.
Yes. These apps also have happened to WhatsApp.
Still hard to understand. If it’s just image preview code, why isn’t Safari vulnerable?
It's not exactly specific to the image preview code, but rather the code that handles the notification when receiving an iMessage.
The attack mentioned in the Wired article[1] relies on iMessage asking the sandboxless Springboard[2][3] to deserialize a maliciously crafted field, included in the incoming iMessage, to escape the sandbox. This specific vulnerability doesn't appear to apply to other apps.
[1] https://googleprojectzero.blogspot.com/2019/08/the-fully-rem... [2] https://en.wikipedia.org/wiki/SpringBoard [3] https://iphonedev.wiki/index.php/SpringBoard
It might be, it’s just that using Safari would turn a zero-click attack into a one-click one (click on my shady link). (Also, WebKit runs with a different sandbox that may require special effort to escape out of.)