11 ms·
A new CSS-based web attack will crash and restart your iPhone
- sebazzz 8y agoI have always wondered why Safari crashes can reboot the entire telephone. Doesn't iOS have multiple protection rings or is Safari running at ring 0? Or is it a precaution that inhibits jailbreak research?
- valleyer 8y agoSafari does not run at ring zero. However, it can make system calls into the ring-zero kernel and drivers. If there's a bug in the kernel or drivers, that can cause the kernel to crash. There are other scenarios that don't involve a ring-zero vulnerability but still result in a "reboot". Safari coordinates with other system processes, like the one that shows the home screen. If a web site can cause Safari to cause that process to crash, it would feel like a "reboot", even though no ring-zero code was attacked.
- exikyut 8y agoThis is a kernel panic, as per the twitter thread.
- fulafel 8y agoIt's prudent to reboot when a privileged component crashes, since the integrity of the code execution has been compromised. A lot of the time a DoS bug in native code is synonymous with "nobody bothered to craft a RCE". It's unintuitive to many people how many scenarios eventually allow a RCE exploit to be crafted. Check out some null pointer deref RCE's to convince yourself.
- jstanley 8y agoBut why is Safari a privileged component?
- wlesieutre 8y agoBecause web browsers are trying to sandbox executable code from untrusted (and frequently malicious) sources, I would guess. WebKit/Nitro are trusted to keep that executable memory under very tight control, and if they're crashing they may have failed to. IIRC it has special privileges that allow it to run a JIT javascript engine.
- anderskaseorg 8y agoIt remains disturbing to read that something needs to be privileged just so it can sandbox unprivileged code. Why should I have to choose between trusting the sandbox and trusting the code that runs inside it? Why do we keep collectively forgetting the lesson that the more useful a sandboxing technology becomes, the more likely it becomes that someone will need to run that sandbox inside another sandbox (or inside another instance of the same sandbox)?
- speedplane 8y agoThe reason is because security in the real world will never be pure or without defect. The goal is not to create perfectly secure software, it’s to minimize risk to an acceptable level.
- tinus_hn 8y agoIt doesn’t need privileges to sandbox unprivileged code. It needs special permission to run a JIT because that implies running binary code that was compiled ‘Just In Time’ on the device, so it isn’t signed. Normal processes can only run binary code that was verified to be signed. They can’t write to memory and then mark it as executable.
- JimDabell 8y ago> It remains disturbing to read that something needs to be privileged just so it can sandbox unprivileged code. That's not what is happening. All modern JavaScript implementations use JIT for performance reasons. It's one of the main reasons behind the massive performance increases JavaScript has made in recent years. JIT requires that the process be able to generate data then execute it as code. This is, historically, something that has been used in many security attacks. So modern CPUs provide the ability to stop this from happening (the NX bit). iOS sensibly switches this off by default. Which is fine in most cases, but in some situations – like JavaScript JIT – it's necessary, so Apple grant special privileges to the WebKit process (not Safari) in order for it to perform well. This is part of the reason why the WebKit rendering happens in an external process – partly because it reduces the amount of code that needs this special privilege, and partly so that other applications apart from Safari can also get the JIT performance improvements without having to trust them with the special privileges. There's no indication that this crasher has anything to do with Safari having special privileges, and I think it's likely that other applications can do this too.
- exikyut 8y agoThe author said in the twitter thread that this a kernel panic.
- panic 8y agoThat may be true, but it's unrelated to what's happening here. If you've ever seen a "there was a problem with this page" bar appear, that was a Safari process crashing without bringing down the system (or even the browser UI process). The crash here is happening at a lower level.
- avip 8y agoIt also crashes chrome on iphone.
- ben-schaaf 8y agoThe underlying browser for chrome on iOS is still safari. The same is true for every other browser.
- sneak 8y ago...however Chrome does not have the same privileges to run accelerated js on iOS that Safari does. Interestingly though this attack has nothing to do with javascript.
- aaaaaaaaaab 8y agoThat’s not how it works...
- pilif 8y agoIf they finally switched from the deprecated UIWebView to WKWebView, then chrome too gets to run JS at safari's speed. WKWebView runs out of process and thus can have the JIT entitlements.
- sebazzz 8y agoWhich is weird though, I had a few sites not render properly on Edge on iOS but did on Safari. Some kind of compatibility mode?
- iamgopal 8y agoIs not chrome just wrapper on iPhone ?
- howdydoo 8y agoSafari on iOS reminds me of Windows 95 and Active Desktop. Whenever IE crashed, it took the entire shell (explorer.exe) down with it.
- bitexploder 8y agoOne of the older iOS jailbreaks, written by comex, was launched via Safari. It generally takes a few vulnerabilities to get to arbitrary code execution in the kernel. You have to (1) break out of the browser sandbox and (2) defeat exploit mitigation technology, such as non-executable stack and finally (3) escalate privileges. There can be some potential shortcuts to this, but that is the basic sketch. Why multiple vulns? To defeat ASLR, for example, you need something that leaks information about how the memory is layed out. This also helps defeat NX (non-executable stack) as you use existing code to do the initial bootstrapping of your exploit.
- qrbLPHiKpiux 8y agoSame here, I thought it was completely sandb0xed
- saagarjha 8y agoA completely sandboxes process can do nothing, since doing anything from a network request to drawing to the screen requires cooperation from the OS. Safari is partially sandboxed, just like any other app.
- matthberg 8y agoThe tweet announcing it: https://twitter.com/pwnsdx/status/1040944750973595649 https://twitter.com/pwnsdx/status/1040944750973595649 The code that causes the crash (safe to open): https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33aea https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33... The demo itself (causes crash): https://cdn.rawgit.com/pwnsdx/ce64de2760996a6c432f06d612e33aea/raw/23f2faa0aadb4babbfd228c8bb32a26a8c51c741/safari-ripper.html https://cdn.rawgit.com/pwnsdx/ce64de2760996a6c432f06d612e33a...
- avip 8y agoIt works!
- matthberg 8y agoMore details from the Twitter thread: it's iOS 7 and up, and it also works on watchOS 5. In some apps like chrome or opera it isn't a full crash, just a "springboard crash".
- wruza 8y agoI always said iOS 7 was a disaster. iOS 6- opened 8 tabs at most (deleting old tabs) and no one complained. These new youngster oses can not even manage memory in a right way — now with all these GCs no one knows how to do it.
- joering2 8y agoDO NOT CLICK THE LINK! Hour later I am still unable to restart my phone. It hangs on logo!! This may be a permanent fuck ;( unsure exact version but I have iOS 7 that hasnt been updated in about six months.
- josefresco 8y agoDO NOT CLICK THE LINK! Never imagined I'd read those words at HN. How times have changed. Be sensible people.
- 8y ago
- floatingatoll 8y agoIt’s cruel of them to make this discovery public without a fix. Thousands upon thousands of normal, non-tech, non-fanatic people are going to be sent a link to this page by someone mean who wants to crash their phone and laugh at their pain as they’re locked out of their life by a crash bug. This is irresponsible disclosure.
- codedokode 8y agoRebooting phone doesn't look like a tragedy.
- floatingatoll 8y agohttps://news.ycombinator.com/item?id=17997958 https://news.ycombinator.com/item?id=17997958 > DO NOT CLICK THE LINK! Hour later I am still unable to restart my phone. It hangs on logo!! This may be a permanent fuck ;(
- novaRom 8y agoI've stopped accepting iOS/OSX seriously after those iCloud celebs leaks and especially after 'empty string' root prompt bug. How anyone can still trust this black box concept.
- askmike 8y agoSo what do you trust? Google?
- Avamander 8y agoLinux and its maintainers. LineageOS and its maintainers.
- Froyoh 8y agoAh you're one of those guys.
- dang 8y agoWe've banned this account for repeatedly breaking the site guidelines. If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- qrbLPHiKpiux 8y agoWeren't those phishing compromises?
- watermans 8y agoThey were. OP seems to have bought into the fake story that someone legitimately hacked iCloud and only made it out with photographs.
- mcintyre1994 8y ago
- exikyut 8y agoThis is basically 3,485 nested <div>s (balanced; same number of </div>s) with width and height both set to 10,000px. I have no idea is this is an internal DOM overflow or it's because of the tiled background-image. (I don't have an iPhone to test against.) EDIT: I actually read the article properly :) all 3,485 the <divs> have a 10px backdrop-filter set on them. > He explained that nesting a ton of elements — such as <div> tags — inside a backdrop filter property in CSS, you can use up all of the device’s resources and cause a kernel panic Fun trivia: ^F for <div> on the GitHub gist page, and Chrome will inch... forward... so... very... slowly... finding... matches. You have to search the raw file if you want it to complete this century.
- endless1234 8y agoIt's because of the nested backdrop-filters being applied. I would've thought the css parser / rendering engine stops this from happening, but apparently not.
- rangibaby 8y agoI guess it is because backdrop-filter is a new property. AFAIK backdrop-filter affects everything everything below it, so maybe a sanity check for the number of times the effect applies is missing.
- burlesona 8y agoYeah it looks like its trying to compute thousands of filters stacked on top of each other. Photoshop would take a while to do that too. But safari shouldn’t be able to out of memory so hard it takes down the device.
- exikyut 8y agoFrom the twitter thread - This is a full kernel panic; I wonder if it's exploitable (...probably not) - Someone's iPhone didn't ask for their PIN on reboot? - It apparently crashes watchOS 5 too
- saagarjha 8y ago> Someone's iPhone didn't ask for their PIN on reboot? That's because the iPhone didn't reboot fully. This doesn't deterministically cause a panic, sometimes it just takes down parts of the system.
- unilynx 8y agoSome reboots on iPhone (including if you force it yourself by holding HOME + Power on iPhone 6) don't relock the SIM card, so that might be the "PIN" that was missing.
- sneak 8y agoIt didn’t ask for their sim PIN, which is expected if the sim does not lose power, like in a full reboot without power off (eg kernel panic auto restart). This is not to be confused with iOS unlock. SIM PINs are not commonly used in the USA.
- Ducki 8y agoIt also gets my Macbook Pro in an unresponsive state (using Safari).
- seddin 8y agoI have tried it on a iPad Mini with iOS 8.4 (jailbroken) and it does nothing.
- MrKristopher 8y agoIt doesn't crash for me either on iPhone 5 / iOS 8.4.1. It just renders a long webpage.
- KenanSulayman 8y agoI tried it on my iPhone X and it triggers a kernel panic (agxk_mmu.cpp) when trying to allocate memory for WebKit. It seems it exhausts the memory so fast that it triggers an assertion error somewhere? Screenshot: https://i.imgur.com/6tDr44q.png https://i.imgur.com/6tDr44q.png Full serial console log of the device: https://gist.githubusercontent.com/KenanSulayman/867cc399e9762189b3a52b2cf91781ca/raw/ded0b82a24464e969d2f84cd8edd25ac000f2a87/kern.log https://gist.githubusercontent.com/KenanSulayman/867cc399e97...
- jhabdas 8y agoHave you tried the backdoor yet? https://www.gnu.org/proprietary/malware-apple.html#back-doors https://www.gnu.org/proprietary/malware-apple.html#back-door...
- barbegal 8y agoThe log suggests the device is doing everything correctly. The exploit webpage requires huge amounts of memory to render correctly. It is consuming all the available memory causing allocations for backboardd to fail. The kernel then starts killing off idle processes to free up memory. I don't see a kernel panic there.
- amaccuish 8y agoDoes iOS not enforce reasonable memory limits on apps to prevent a panic?
- MBCook 8y agoIt does. Your app will get killed. The OS will be fine. My understanding is this bug uses up GPU memory/contexts, not normal system RAM, and that’s why it becomes an issue.
- amaccuish 8y agoAhh thank you :)
- swingline-747 8y ago
- kyrra 8y agoDon't most security researchers wait until it is patched before posting the details of something like this?
- kyrra 8y agoWhy the downvotes? The guy is a security research, and published a bug that can crash the app or OS (reports in this thread have reported mixed results, and others are saying it may impact OSX as well). The guy goes to Twitter the announce the bug. Most people that call themselves security researchers will notify the vendor and give them some amount of time before publishing it. He waited 1 day. My best guess is that since it's just a OS crash, he felt he could release it. But for something that is easy for any website to do, seems like he should have given them some more time.
- ilumanty 8y agoIt also stalled my iMac on Safari 11.1.2, macOS 10.13.6. Had to force reboot.
- myfonj 8y agoDug through WebKit Bugzilla and Trac and the only recent visible "crash backdrop" issue seems to be "Fix crash when reflections and backdrop filter are combined" [1], which references bug that requires authorization [2]. [1] https://trac.webkit.org/changeset/235475/webkit https://trac.webkit.org/changeset/235475/webkit [2] https://bugs.webkit.org/show_bug.cgi?id=188504 https://bugs.webkit.org/show_bug.cgi?id=188504
- runeks 8y agoCan anyone confirm if this is a denial-of-service attack (through memory exhaustion)? I’m no security researcher but, as I understand, it shouldn’t be exploitable if this is the case.
- nothrabannosir 8y agoDoS of safari or the kernel? It's a kernel panic, which is not a safari dos; no user space app should be allowed to crash the kernel. Memory exhaustion should just trigger an OOM kill at worst.
- amaccuish 8y agoIs this due to memory exhaustion? If so, does Safari not have limits applied that cause it to be killed for running into OOM?
- gsnedders 8y ago> If so, does Safari not have limits applied that cause it to be killed for running into OOM? It does. The memory allocation that causes the crash doesn't come from Safari, though: it's a memory allocation in the kernel (likely somewhere graphics related), and that counts towards XNU's memory consumption and not Safari's.
- amaccuish 8y agoAhh thank you!
- feketegy 8y agoTested in on my Macbook in Safari, it crashed spectacularly
- systoll 8y agoChrome performs similarly, if the flag enabling 'backdrop-filter' support is set.
- ccnafr 8y agoMore details about the attack in this interview with the researcher: https://www.zdnet.com/article/nasty-piece-of-css-code-crashes-and-restarts-iphones/ https://www.zdnet.com/article/nasty-piece-of-css-code-crashe... Safari on MacOS is also affected, and you can make it persist with a little bit of JS.
- Froyoh 8y agoHere's a JS-based attack that will freeze Chrome/ChromeOS, by the same person: https://twitter.com/pwnsdx/status/1038821975089664001 https://twitter.com/pwnsdx/status/1038821975089664001
- bluesign 8y agoI am guessing from the log posted [0] this can be some kernel memory leak. can be related to AppleJPEGDriver-memleak [1] [0] https://news.ycombinator.com/item?id=17998178 https://news.ycombinator.com/item?id=17998178 [1] https://github.com/bazad/AppleJPEGDriver-memleak https://github.com/bazad/AppleJPEGDriver-memleak
- zitterbewegung 8y agoCan't wait for the supplemental update for this (I doubt they have time to revise the GM releases for watchOS and iOS but maybe they can fix Mojave.).
- Eric_WVGG 8y agoThis reminds me of how I was unemployed for a good chunk of the year 2001. I was making a fresh start in a new city, and shopping my resumé to various graphics design firms. There was a prominent link to my portfolio site up top. After months of looking I didn’t get a single call-back. Eventually I got a job in another industry, and noticed a bunch of Macs in the corner that they used for testing. One day I decided to load my portfolio site for fun... turned out there was a glitch in CSS support in Internet Explorer that would crash the browser, and since this was Mac OS “Classic”, that took down the entire machine. Graphic design firms were all still on Macs with the old OS back in those days; I had been walking around crashing computers and destroying people’s work for months.
- chrisper 8y agoIs the new industry you are working in penetration testing?
- tomxor 8y agoIn my first commercial attempt at web development I utilised a png transparency fix for IE6 (written in that IE6 specific filter thing). A few months later the client passed on a complaint from one of his customers whom's machine crashed whenever he visited the website... I removed the IE6 fix and all was well in the world - You can have nice things or MS, you can't have both.
- brennebeck 8y agoI think MS is doing a pretty decent job of trying to repair that. Especially with developers.
- sizzle 8y agoOn the bright side, you are probably making 2-4x the salary of a graphic designer in today's market if you learned to code...
- Eric_WVGG 8y agoI knew how to code in the first place. At the time, I was dismayed by the inability for most software developers to take UX/UI seriously, and decided that "the way forward" was to work with design professionals instead of being inside a party that was ostensibly on the same team but usually fought against designers. Since then, the world has changed… some design firms have transitioned to be purely marketers, others just hire development firms that are happy to defer all UX to their partners, and others still have transitioned to be UX/UI design firms.
- jorblumesea 8y agoHow is it that browserland always seems to impact the OS? Is it the browser's need for graphics drivers? Or are these browsers embedded at a different level compared to a traditional OS?
- hn_throwaway_99 8y agoWhat other apps do you have on your phone that are executing what is essentially an enormous amount of untrusted code? There is nothing different about browsers than other apps, but given how they work people are far more likely to discover these kinds of bugs in browsers.
- marcellus777 8y agoWorks on Safari either on the iPhone or iMac/Macbook.
- jeroenhd 8y agoThis isn't just an iOS bug. The affected CSS property is just not available on most platforms. Sinfe I do not have access to any apple hardware, I tried turning on the experimental web features in Chrome Canary on my phone and it managed to freeze Android as well. The Chrome browser crashed on Windows with this setting on. Microsoft Edge, the only browser other than Safari to have support this property without messing with config, just showed a generic "this page can not be displayed" message. I think this problem affects the entire WebKit/Blink code base, the only reason the crashes are not being detected on other platforms is that most browsers just don't support this feature yet.
- XCSme 8y agoReminds me of a Safari memory leak issue I stumbled upon two years ago: https://stackoverflow.com/questions/35782231/why-is-a-safari-page-breaking-ios-rendering https://stackoverflow.com/questions/35782231/why-is-a-safari... I guess that restarting is less important than modifying memory it shouldn't.
- swingline-747 8y agoI take it some Apple engineers were/will be called in on a Sunday in order to push a WebKit / Mobile Safari "11.4.2" security update. Thoughts, prayers and coffee.
- nereid666 8y agoI sent to a colleague, and the iPhone didn't reboot.... It got crashed, and she had to use itunes to recover. Be careful....