4 ms·
Two questions (which aren't really explained in this report): 1. Did he have to actually play the video, or was simply receiving the message enough to compromi
by nodamage 7y ago
Two questions (which aren't really explained in this report):
1. Did he have to actually play the video, or was simply receiving the message enough to compromise his phone?
2. It says after his phone was compromised, a large amount of data was extracted from his phone. Was this only WhatsApp specific data (cached pics and videos from messages sent within the app) or did the malware actually have full access to all of the files on his phone?
Because of iOS's sandboxing and permission system I would not have expected that a vulnerability in WhatsApp itself would be able to grant access to the entire phone. That seems like it would be much bigger news if it were the case.
- hedgehog 7y agoWhatsApp uses system address book for a few things, has photo sharing, and has video calling so it's reasonably likely it had been granted access to contacts, photos, camera, and microphone.
- nodamage 7y agoYeah I suppose we should not be surprised by that, I'm just curious whether the exploit 1) only gave access to data that WhatsApp would normally have permission to access, or 2) gave access to the entire phone regardless of permissions.
- sneak 7y agoThese apps ask for camera roll and camera access permissions and usually get them, which would render sandboxing (for photos and videos) irrelevant.
- Twisell 7y agoPro-tip only give access to camera for social apps. If you want to share fast use camera from within app. If you want to share something from your photo library copy/paste between apps. It more tedious, but exploit on social don't automagically leak personal data from your OS library.
- sneak 7y agoPhoto access is also location history access from reading the gps tags and time stamps from my photo history, so I grant photo access to approximately zero apps. I will paste photos in if I need to.
- comex 7y agoThey don't know. They weren't able to actually find the exploit code, so they don't know how it worked or what level of access it achieved. Or whether there even was an exploit at all. That said, if there was an exploit, I'd be surprised if it didn't escape the iOS sandbox. As an exploit category, iOS sandbox escapes are medium difficulty. Not as easy as WebKit exploits, or privilege escalation on some other operating systems (...such as macOS), but still plentiful. Or from a buyer's perspective, more expensive, but readily available. MBS doesn't exactly have issues with expense. By the way, image/video parsing vulnerabilities are somewhat rare themselves, at least in stacks that only handle a small number of formats (not something like ffmpeg or VLC with a bazillion file format parsers that nobody's looked at in decades).
- nodamage 7y ago> As an exploit category, iOS sandbox escapes are medium difficulty. Are there any published explanations of exploits that achieve this? Just curious what it would look like.
- comex 7y agoProject Zero has some excellent writeups. Here is one from last year where the author exploited a kernel vulnerability that’s directly accessible from within the sandbox: “voucher_swap: Exploiting MIG reference counting in iOS 12” https://googleprojectzero.blogspot.com/2019/01/voucherswap-exploiting-mig-reference.html https://googleprojectzero.blogspot.com/2019/01/voucherswap-e... And here is a massive writeup, also from last year, analyzing the privilege escalation parts of no fewer than five different exploit chains, which were found bundled together in a real attack, each targeting a different range of iOS versions. Not five exploits, five chains. It’s a great read: “A very deep dive into iOS Exploit chains found in the wild” https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...