I wonder if that backdo… ermmm… i mean… undocumented feature… will be useful for ios jailbreaking.
It’s gonna be a “yikes” from me, dawg
Can someone much smarter than I am, explain like I’m a toddler?
Basically they found out that anyone who knows how this work can send you an iMessage with an attachment that won’t show up on your end without the need of your interaction and do whatever they want on your iphone.
P.S. I’m not smart nor I’m an expert.
What the other dude said, but the level of sophistication was miles beyond what you typically see from even nation states. The takeaway is you cannot defend yourself from a nation that wants your information.
Well, it certainly helps when that nation gets to build hardware backdoors into the stuff you buy.
Iirc lockdown mode would prevent this exploit from working
Someone figured out a way that could hijack iMessage through sending a special malicious PDF that took advantage of a flaw in some legacy font rendering code unique to Apple, that even Apple hadn’t used in decades.
Then, that PDF launched a JavaScript debugger that is built into iPhones, and took advantage of a flaw in that to jump into putting some code into the parts of user memory, that the system doesn’t fully trust.
Then, that code takes advantage of another flaw to bypass the system’s protections for not fully trusting that code, to secretly launch a web browser and navigate to a secret webpage that runs a much bigger piece of malware.
That malware can read and modify basically anything on the system, and was used to read all sorts of sensitive data: message history, location information, app data, etc.
Because the whole exploit chain was so advanced and involved so many different previously unknown vulnerabilities, basically the list of possible suspects is very, very short: some kind of nation state with advanced hacking capabilities.
Shorter version: Operating systems set up hardware locks and protections to confine processes, and once set up, they cannot be undone. (the hardware + OS denies modifications to the security policy)
- Attacker broke out from the app sandbox. (attacker can run code in the infected process)
- Broke out of the process. (gained root access; attacker can run anything)
- Broke into the kernel space (gained 100% control over the hardware)
- Corrupted some kernel memory via a damm magic MMIO accesses nobody knows (hardware vulnerable)
- Bypassed protections that kernel set up earlier such that it cannot accidentally modify itself.
- Finally broke the kernel via hardware exploit thus the attacker got rootkit level access.
Getting arbitrary code execution and root access is one thing, but breaking out from the damm kernel configured hardware protections is insane.
They basically managed to flip a “read-only” switch to “modify-as-much-as-you-like”. The infected device at this point is broken beyond repair, as the firmware(s) may have been tampered with. End result is a terrestrial spy brick.
Not only that, but using an initial exploit which could be remotely triggered with NO user interaction or visibility. That’s scary shit
This is a nightmare, but thank you for detailing this. Having only read a little bit of this and not understanding it, it seems like the exploit works even if the recipient does not open or interact with the malicious message? Is that what i’m understanding?
If so, i’m officially stapling my tin-foil hat to my head and never using a cell phone again.
The attack is spread via iMessage. A vulnerable device merely needs to receive a bad message with PDF attachment. --> A Remote code execution. No user interaction.
Yikes. Indeed.
The attack entry point is via bad TrueType font + PDF attachment that only needs to processed once. Once a process touches that, the attack vector begins and exploits are chained until they get kernel mode access. After getting kernel mode access all hope is lost, the attacker owns the device.
Only sliver of hope is that fixing the attack entry point blocks the current attack. And that bug is:
This attachment exploits the remote code execution vulnerability CVE-2023-41990 in the undocumented, Apple-only ADJUST TrueType font instruction. This instruction had existed since the early nineties before a patch removed it.
But unless all the CVEs are patched, it is just matter of time a new attack entry point is found.
Makes me laugh because of how cultishly people claim iphone is secur, yet we keep hearing how susceptible it really is to attacks. There is a real disconnect there.
I would feel foolish making these claims, and paying more for a device that’s only real achievement is a walled garden.
This is kind of a ridiculous take. I hate iPhones, but this is not a “hurr durr iPhones bad and insecure” moment. I implore you to look at the sophistication of this attack. The attack chain is so ridiculously long and complex, and only because of the security of the iPhone. This is not a script kiddie attack, and could only be executed by a very determined party.
No device is secure, and any and all computers could potentially fall victim to an attack like this, but it is absolutely ignorant to say that iPhones don’t offer any more security than other devices.
Yeah absolutely. This line from the article summs it up pretty well… ““What we do know—and what this vulnerability demonstrates—is that advanced hardware-based protections are useless in the face of a sophisticated attacker as long as there are hardware features that can bypass those protections.””
Edit: We also have no idea how many zero days there are in Android, either. 🤷♂️ But at least it’s a bit more open source than iOS 😂
Yeah. The moral is “every and all devices have an unknown number of zero-days inactive or actively being exploited at any given time”, not “iPhone is just as insecure as everything else”. There’s a difference, and credit is deserved where it’s due.
FYI: I don’t think you’re replying to someone acting in good faith.
That’s called projection.
deleted by creator
