News for hackers. Stuff that matters.

A comment on Disclosure of three 0-day iOS vulnerabilities. Parent comment

Re:Disclosure of three 0-day iOS vulnerabilities by tyrfing on Friday September 24, 2021 @02:20AM (#28639174)
> the zero click iMessages one floored me.

In case there is any confusion, there has been at least one of those a year for the past 3 years.

[ Parent | on HN ]
Re:Disclosure of three 0-day iOS vulnerabilities by easton on Friday September 24, 2021 @07:18AM (#28640924)
What is dumb about it to me is that the solution in my mind is simple: don’t give Messages.app private API access. They get access other messaging apps from the App Store can’t have and that’s what’s causing these vulnerabilities, but all they need is APNS and access to the SMS service (which is private but shouldn’t be dangerous… right?).
[ Parent | on HN ]
Re:Disclosure of three 0-day iOS vulnerabilities by kenferry on Friday September 24, 2021 @09:59AM (#28642437)
This last one was an issue in an image decoding.. it was public API.

It’s extremely common for an attacker to find a way to exploit a maliciously crafted image. Take a look at libpng, https://www.cvedetails.com/vulnerability-list/vendor_id-7294...

[ Parent | on HN ]