7 ms·
How are image parsing exploits still a thing in 2021? Can Apple not use Rust? I struggle to understand why Apple is still relying on C/C++ in such a well known
by zarzavat 5y ago
How are image parsing exploits still a thing in 2021? Can Apple not use Rust? I struggle to understand why Apple is still relying on C/C++ in such a well known security hotspot.
- fmajid 5y agoOr fuzzing? Why is it that Google's Project Zero has to point out their mistakes for them? Apple's complacency on security is infuriating.
- deregulateMed 5y agoApple doesn't admit wrong doing. Take their multi year long denial of butterfly keyboard issues. The key to user satisfaction isn't security, it's consistent marketing reminders of "security". Apple users here are often forced into the ecosystem due to iOS or safari dev, but the majority of Apple users care more about the name of the iPhone than performance. This is the nature of Veblen goods.
- judge2020 5y ago> Apple doesn't admit wrong doing. On the business end, sure. But https://support.apple.com/en-us/HT201222#:~:text=the%20previous%20version.-,Apple%20security%20updates,-Name%20and%20information https://support.apple.com/en-us/HT201222#:~:text=the%20previ...
- robin_reala 5y agoThat’s a bit of a weird framing. Project Zero point out mistakes in Google’s products too. It’s just that they’re visible. The assumption has to be that Apple quietly fixes minimum a hundred times more security bugs in their products, than the ones the occasional Project Zero blog post highlights.
- fmajid 5y agoGiven their lackadaisical approach to bug reports filed by external researchers, and their grudging payments on their own bug bounty program, I think you are giving them far more credit than they deserve.
- steveklabnik 5y agoApple is using Rust, but not for this. Or at least, I haven’t heard of it.
- saagarjha 5y agoI don't think any Rust ships on iOS (but would be very interested in hearing corrections!)
- deleted 5y ago[deleted]
- steveklabnik 5y agoIf by “on iOS” you mean apps, it’s not super popular but it does. Cloudflare’s 1.1.1.1 app is probably the biggest. If you mean “as part of” then I don’t believe so, yes.
- nick_ 5y agoWhat makes Rust especially good at protecting against parser vulnerabilities?
- roca 5y agoIt's memory-safe (assuming you avoid the use of the 'unsafe' keyword) and it's performant. In particular, for fast parsing of large objects you want to avoid copying data as much as possible, and Rust's lifetime machinery lets you do that without introducing memory safety issues. For example, Java is also memory-safe, but Java doesn't have first-class array slices.
- nick_ 5y agoSwift has all of these things. It also has the exact same performance ceiling as Rust.
- roca 5y agoNope. Swift manages memory via reference counting, which turns read-only workloads into read-write workloads, which is inherently problematic.
- nick_ 5y agoYep. It's the same performance ceiling. Borrow checking is not the panacea its made out to be. It's just enforcing single ownership. What part of scanning through some immutable array of bytes to-be-parsed would be so definitively better in Rust? Any sensibly written parser code would result in the compiler optimizing away all reference count operations. Only the most naive ARC implementations mutate the count for every reference pass implied by the source. So again... why would it be a sensible choice to use Rust at Apple, where they created and use Swift heavily? Where the problem is that they're using some old unsafe parsing library instead of one written in a safer language?
- steveklabnik 5y ago
- olliej 5y ago"Rewrite everything in rust" is not useful advice, and many of the decoders in ImageIO are open source libraries, that presumably have the same flaws (so you get "why isn't project X using rust" as well)
- roca 5y ago"Rewrite everything in Rust" is not that useful, but "write new code in Rust so you're not digging deeper holes" and "rewrite your most sensitive code in Rust" is pretty good advice.
- nyberg 5y agoAnd you run the risk or introducing new bugs as memory bugs aren't the only bugs there are plus rust doesn't catch all of them.
- rapsey 5y agoWhen your entire platform is plagued by security issues in one component for years. Issues that at the end of the day are causing huge personal harm to your customers. Perhaps it is time to suck it up and rewrite the damn thing in a memory safe language.
- roca 5y agoThere is a bit of a risk of new bugs that Rust doesn't catch, but if your development process is at least modestly competent you'll have a large suite of automated tests for the bugs you found in the previous iteration of the software, which you can reapply to the new Rust code.
- GeekyBear 5y ago>One of the major changes in iOS 14 is the introduction of a new, tightly sandboxed “BlastDoor” service which is now responsible for almost all parsing of untrusted data in iMessages (for example, NSKeyedArchiver payloads). Furthermore, this service is written in Swift, a (mostly) memory safe language which makes it significantly harder to introduce classic memory corruption vulnerabilities into the code base. ...This blog post discussed three improvements in iOS 14 affecting iMessage security: the BlastDoor service, resliding of the shared cache, and exponential throttling. Overall, these changes are probably very close to the best that could’ve been done given the need for backwards compatibility, and they should have a significant impact on the security of iMessage and the platform as a whole. https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...
- Gaelan 5y agoI'd expect so, but the exploits we're talking about are post-BlastDoor, so something clearly isn't working.
- simonw 5y agoFrom later in that Twitter thread: "It also indicates that Apple has a MAJOR blinking red five-alarm-fire problem with iMessage security that their BlastDoor Framework (introduced in iOS 14 to make zero-click exploitation more difficult) ain't solving." And: "BlastDoor is a great step, to be sure, but it's pretty lame to just slap sandboxing on iMessage and hope for the best. How about: "don't automatically run extremely complex and buggy parsing on data that strangers push to your phone?!"
- badkitty99 5y agoAll part of the ad model
- sjfidsfkds 5y agoThis sounds interesting, but there’s not enough detail for me to understand what you mean. Care to elaborate?
- deleted 5y ago[deleted]
- walrus01 5y agoAnyone remember about 20 years ago, there was a remote code execution possible by simply getting outlook express (internet explorer) to load a custom crafted jpeg? Things haven't changed much. I remain highly skeptical of any messaging app or communication chat program, email client that lets people "embed" arbitrary content in it.
- hulitu 5y agoThings haven't change because there is a god like mindset in SW development. "I want my program to do everything". And the web browsers and messaging apps are the worst. They use a miriad of libraries to parse untrusted code and they have components which sometimes run with elevated privileges. What can go wrong ?
- eloisius 5y agoEven harder to understand why it's so important for Messages to have special functionality so that has to be integrated with the OS instead of run in user space.
- saagarjha 5y agoMessages code does run in userspace.
- eloisius 5y agoOh, then I stand corrected. The last time a vulnerability in Messages was making the rounds, I thought that I learned it was possible because Messages is part of the OS and not just a pre-installed app, though I can't remember where I read it. I'd be glad to hear that I'm wrong about that though.
- Jyaif 5y agoThis is a case where using Wuffs would be a better idea than Rust: You get more safety than Rust and you can incrementally convert the codebase.