News for hackers. Stuff that matters.

A comment on Blasting Past WebP - An analysis of the NSO BLASTPASS iMessage exploit. Parent comment

Re:Blasting Past WebP - An analysis of the NSO BLASTPASS iMe... by Scramblejams on Thursday March 27, 2025 @01:40PM (#43495955)
Signal has "message requests". iMessage doesn't have "message requests", and receives messages in a unique path which goes through the kernel.

Signal's message request, notably, also shows me the requester's avatar image. I don't know if that hits the kernel but it certainly hits code that as a category has suffered lots of security issues over the years. Which is to say: There's room for improvement all over!

[ Parent | on HN ]
Re:Blasting Past WebP - An analysis of the NSO BLASTPASS iMe... by genewitch on Friday March 28, 2025 @06:43AM (#43503753)
That avatar thing is exploitable on discord, at least. Don't recall the specifics, just keywords.
[ Parent | on HN ]
Re:Blasting Past WebP - An analysis of the NSO BLASTPASS iMe... by immibis on Saturday March 29, 2025 @05:40AM (#43514107)
You might be thinking of the minor Cloudflare exploit where the attacker can send you a message, then see on which Cloudflare PoP their profile image got cached.
[ Parent | on HN ]