13 ms·
Apple iMessage Zero-Click Hacks
- eyeball 5y agoI turned off imessage. I seem to be under attack lately. 3-4 times a day random links sent from gmail addresses or unknown phone numbers to imsg with sketchy looking links in them.
- cyckl 5y agoI’m also getting these—no idea what the exploits actually are or how they work. Am I theoretically already exploited?
- gruez 5y agoNot really. 1. There's no reason why a threat actor would have to send you 3-4 messages per day. Of the exploits I've seen, they only need to send one. Sending 3-4 messages per day just unnecessarily increases the risk of getting caught (ie. the target getting suspicious and asking on hacker news whether they're getting hacked) 2. There's no reason why the message has to contain sketchy links. They could very well disguise messages as ads/notifications for well known businesses, political organizations, or from random people who got the wrong phone number. 3. There's no reason why the attacker can't erase any trace of the initial message after your device is infected, so unless you're staring at your phone 24/7 it's very easy to miss the message.
- dannyw 5y agoDisagree with all 3 points. If I am sneaking a payload in, and I have different exploits for different OS versions, I would exactly disguise it as spam. Pretending to be a busines, or a random person with wrong number, and then DELETING IT is a noteable indicator of compromise. I know this isn't how Pegasus works, but I'm sure there are more exploit kits being sold in the world. Some may not be as sophisticated, and may rely on spraying and praying with different exploits.
- gruez 5y ago>If I am sneaking a payload in, and I have different exploits for different OS versions, I would exactly disguise it as spam. Right, but the point is that GP seems to have been tipped off by the "sketchy links", rather than the spam itself, and that there are far better ways to compose your spam texts than ones with sketchy links. >Pretending to be a busines, or a random person with wrong number, and then DELETING IT is a noteable indicator of compromise. It depends on the nature of the exploit. I was operating under the assumption that "0 click" means the exploit gets run as soon as the phone receives it, which would allow for the exploit to clean up after itself without alerting the owner, unless the owner was staring at the phone the exact moment the message came in.
- dylan604 5y agoCan you war-dial attack with these? Seems like it would be super easy for a script kiddie to just start at 111-111-1111, send message, increment by 1, repeat. Maybe narrow it down to valid area codes and what not, but seems like a super low budget thing to do.
- zsmi 5y agoSure. https://calleridreputation.com/blog/robotexts-are-replacing-robocalls-as-sms-spam-increases/ https://calleridreputation.com/blog/robotexts-are-replacing-... "Robotech spammers are also targeting group messages by using automated programs to send thousands, even millions of group texts to random phone numbers with the hopes that somebody will take the prey and respond." Also, some users give random apps access to their address book for whatever reason then there is a whole list of known good emails and numbers to spam.
- dylan604 5y ago>Also, some users give random apps access to their address book for whatever reason "There's a sucker/fool born every minute." --PT Barnum And there are businesses of all types where that is their sole business model.
- rmorey 5y agoWell, send from what? Every iMessage comes from an account with an Apple ID, so I presume stolen credentials would be the only way to really do this, adding to the cost.
- dylan604 5y agoIf you know the email address that is used for the Apple ID, you can send it a message without being in messages. You can also send a text to a phone number via email based on the carrier and knowing how to structure the address. So, it's not impossible to do this at all. No stolen credentials necessary.
- 5y ago
- WelcomeShorty 5y agoSo enlighten us: how did you turn off iMessage?
- neilalexander 5y ago“Settings” -> “Messages” -> Toggle “iMessage” to off. Couldn’t be simpler.
- sonthonax 5y agoHow do Zero click hacks work? Does iMessage accept arbitrary code that it can execute?
- kevingadd 5y agoSimilarly to Android there have been attacks that involve exploiting bugs in the code that parses incoming messages, and then via the exploit you can get remote code execution For example (IIRC this was a real bug), if you exploit a bug in the text layout code, you could attack a device by getting a notification to appear on the lock screen - and SMS messages usually trigger a notification
- gjsman-1000 5y agoThere was a developer who discovered a bug with the XML parser, and wrote a whole blog post about how he was able to cause iOS's security system to malfunction using a specially-crafted XML permissions file and allow his app to do anything he wanted, even escape the sandbox. He kept it secret for years for his private experimentation until Apple patched it by accident, by adding a 5th XML parser to the other 4 for some reason and using that one instead for the permissions.
- saagarjha 5y agohttps://siguza.github.io/psychicpaper/ https://siguza.github.io/psychicpaper/
- deleted 5y ago[deleted]
- hypothesis 5y agoAre there seriously 5 XML parsers available in iOS? Are they all written in C? Do they validate all of them whenever a bug is found in one? I can’t tell if this is some sort of defense in depth or just swiss cheese copy-paste…
- 5y ago
- kylehotchkiss 5y agoA small way to reduce attack surface - have iMessage just setup for your iCloud email address instead of phone number. Phone numbers are becoming increasingly useless. > In fact, Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely. There's a checkbox in Settings > Messages that does exactly this? It seems strange they published this.
- kevingadd 5y agoMaybe what they mean is that some or all of the iMessage code is still running on the device even if you disable it?
- judge2020 5y agoSMS will still enter through Messages.app if you have SMS enabled through your carrier and plan. But no, iMessage is not used when it's disabled.
- easton 5y agoSMS is also exploitable though, right (Both types of messages go through Messages.app)? And you can't disable SMS entirely I don't think.
- gruez 5y ago>SMS is also exploitable though, right it's less feature rich, so presumably there's less attack surface.
- codetrotter 5y ago> you can't disable SMS entirely I don't think Buy a data-only subscription, and use Google Voice or some sort of PBX powered app to still be able to receive regular phone calls. Preferably I’d want a really basic voice only, open source PBX powered app for iOS that I could use. Then I could get me a data-only plan and SIM. Caveat: I still need Norwegian BankID to work with my SIM though. I dunno if any of the data-only plans available in Norway support BankID, or if you need a regular subscription like I have now in order to use that.
- gjsman-1000 5y agoI wonder if Apple's devs are just going to say, screw it, we'll rewrite the whole thing in Rust with audits and formal analysis the whole way...
- brobinson 5y agoApple had job postings last year looking for Rust developers to rewrite a service that was written in C so it's not without precedent. Job posting links are dead now, but there was a reddit thread about it: https://old.reddit.com/r/rust/comments/fkngza/apple_hiring_rust_engineers_for_storage_and/ https://old.reddit.com/r/rust/comments/fkngza/apple_hiring_r...
- est31 5y agoA more fresh job posting from Apple: https://old.reddit.com/r/rust/comments/ou5szr/official_rrust_whos_hiring_thread_for_jobseekers/h8q9449/ https://old.reddit.com/r/rust/comments/ou5szr/official_rrust... Also: https://jobs.apple.com/en-us/search?search=rust&sort=relevance https://jobs.apple.com/en-us/search?search=rust&sort=relevan...
- raspasov 5y agoRust or Swift. I am not a security expert, but I'd bet that re-writing in either would reduce the amount of such embarrassing exploits at least 10x. From what I can tell, the combination of unsafe-by-default languages like C/C++/Obj-C and the way the human brain works is Not-A-Good-Combination© . Too many opportunities for error.
- coldcode 5y agoSome Apple devs still seem to love C and Obj-C (at least the ones my former employer worked with directly) and hate on Swift. Both Swift and Rust can be written to a much higher standard where the language protects you from stupidity, but only if you give up the past and use them. While you can write pretty good C-ish code (i.e. Linux), its far too easy to slip up once and the language does nothing to save your ass. Some of Apple's OS code is pretty ancient. Switching to Swift or Rust is not necessarily a panacea if you call too many OS routines still in C-ish.
- raspasov 5y agoIs it a fair assumption that any code written in C / C++ / Objective-C has a high likelihood of allowing zero-click hacks?
- tyingq 5y agoAren't these making it past BlastDoor, written in Swift?
- Pulcinella 5y agoSwift has e.g. UnsafePointer if you want to work more directly with memory. Presumably if BlastDoor uses them to work directly with memory then it could still be vulnerable, though I am not sure because I am not very familiar with them. If I was excited about pointers I wouldn't be using Swift...
- saagarjha 5y agoIt is highly unlikely BlastDoor is using much of those, except when interacting with system frameworks.
- vlozko 5y agoThe exploit targets existing C code that did image decoding and used CoreFoundation to handle data reads. Blast door is Swift-based and likely very memory-safe. What I’m curious about is where the limits of BlastDoor are that it couldn’t contain this particular attack. I’m under the impression that BlastDoor was built exactly for this type of attack.
- azinman2 5y agoObjective-c has bounds checks and lengths built into NSData, NSArray, and NSString… so many of the buffer overflow techniques likely won’t work against it. However, images and video seem to hit C++ code and from all of the past CVEs it seems this is a giant attack surface over and over again. I’m surprised this code isn’t being rewritten in something like Rust, but perhaps there are more things going on at play, like the plist serialization attacks that end up coding for esoteric classes that contained various bugs.
- SalimoS 5y agoWouldn’t be not parsing incoming media unless it’s for someone from contact is a first step that can reduce largely the thread ? So it will stay the same for people in your contact list but a new touch to load for message from unknown person
- CyberRage 5y agoThat might sound good in theory by in practice it's unlikely to go well(by default). Many services from banks to healthcare utilize SMS as a main way of communicating with end-users. many rely on dynamic numbers. Moreover, spoofing SMS messages is not that hard. Messaging apps whether it is SMS or alternatives like whatsapp, telegram etc. will always offer a powerful vector to infect devices.
- lostmsu 5y agoI think banks don't use inline media in their messages too often.
- CyberRage 5y agoIt is part of my job. many banks do. often embarrassingly so.
- KaiserPro 5y agoyou have made an argument against _never_ parsing media from untrusted _SMSs_ This is iMessage, and instead of _never_ parsing, requiring user action to parse. It will cut out the majority of the noclick exploits, and make iphones safer for most people. This of course doesn't protect against spear phishing. But it should give apple time to fix their shit.
- est31 5y agohttps://en.wikipedia.org/wiki/Dancing_pigs https://en.wikipedia.org/wiki/Dancing_pigs
- 5y ago
- YLYvYkHeB2NRNT 5y agoNMP. Ditched them and shelved all my iShit. I'm done. Edit > sorry for the LQP - But, it's how I feel. And, my therapist said I should tell others how I really feel. And since you iCucks are downvoting me, to hell with HEIC.
- kossTKR 5y ago"Apple hasn't issued a fix for this particular vulnerability"..."new defenses are coming with iOS 15, which will likely come out next month". That's completely insane, isn't it? Have Apple just given up, or am i missing the scope of this vulnerability? Also how can Apple not have better security with such an incredible amount of money in the bank?
- dannyw 5y agoIt can take time to fix things properly. You don't want to half arse a mitigation, only for the attacker to bypass it in a week.
- bumbledraven 5y agohttps://archive.is/eThd5 https://archive.is/eThd5
- iamnotwhoiam 5y agoDoes this mean that iMessage evaluates messages as code for some reason? Why on earth would that be the case? It's a foundational security principle to not do that. And even if they did then why is that so hard to fix?
- moftz 5y agoI imagine that iMessage isn't executing the code but the malware is packed into some part of the metadata that some dumb library needs to parse and some sort of buffer overflow attack is accomplished. The library is probably assuming the data is safe to parse.
- kenferry 5y agoIt’s more like, if you send someone a photo, iMessage will decode the photo and display it. If the imaging library has a bug a maliciously crafted image may be exploitable. iMessage has more integrations than that too. If you send someone a URL, e.g., the recipient will see a preview of the content. iMessage does a lot to mitigate the attack surface, but people still get through.
- dannyw 5y agoiMessage is also the only messaging app that triggers all its decode functions upon notification, because of its special privileged status.
- xvector 5y agoCan Apple not rewrite the parsing components in a memory-safe language?
- hjnilsson 5y agoReplacing libjpeg, libpng, h264 & h265 codecs etc. is a gargantuan task. Even if Apple employs another 200 rust programmers (which don't exist in the market – so not possible) it would take years before that project is close to finishing. So intermediate solutions are necessary until then. It is also likely a rewrite would introduce other security issues (not memory safety issues) which would take time to fix. Rewriting these libraries is probably also a common good, that would be better done through open source initiatives.
- johnthuss 5y agoContrary to the article, blocking ALL media besides plain text from random senders who aren't in your contacts is exactly what most people would want and should be the default. I don't see any downsides to that approach.
- bb123 5y agoI wouldn't want this at all. Just off the top of my head I can think of a ton of use cases this makes hard: * I ask a seller on FB marketplace to send me some pictures of an item * I need to send pictures of some documents to my solicitor * A new friend I've just met in a bar tries to send me her contact card * My mechanic tries to send me a PDF of the invoice for his work Sure, there are ways around all of these, but it makes iMessage (or any messaging service) a lot less useful.
- dannyw 5y agoAll of this can be on a "Tap to view" basis for the first media received. Right now, iMessage processes everything in the background upon receiving. That enables zero click, instantly delete message attacks. The only trace you have is a random imessage sound, or vibrate, with no corresponding notification. Can be tuned to send at 4am when most people have do not disturb on.
- KaiserPro 5y agoThis a million times. Whatsapp of all things has this. (mostly to save on bandwidth, because whatsapp as all about efficiency at one point) There is no real reason to auto process untrusted data. I would have thought we'd learnt from the years of exploits outlook dealt with in the late 90s/early 2000s.
- ricktdotorg 5y agoSometimes my dad sends me photos over Whatsapp, and I have noticed that they appear in my Photos app before I have opened/viewed the actual Whatsapp message. I assume that this is happening because i have given Whatsapp access to my Photos. But, it does appear that attachment/image processing is happening via Whatsapp without my control/without my viewing the message + its attachments.
- fencepost 5y agoIf you're not familiar with NSO Group and Pegasus, I highly recommend episodes 99 and 100 (just released) of the Darknet Diaries podcast.
- ec109685 5y agoWhy aren’t lightweight hypervisors used more outside the public cloud? It seems that would go a long way in protecting the rest of the device from poorly written c code parsing user input.
- saagarjha 5y agoFor one, Apple's chips lacked hardware support for virtualization until last year.
- yokoprime 5y agoOn device? The vast majority of people don't give a flying fuck about privacy, for them the decrease in battery life would not be worth it
- dannyw 5y agoso we should get rid of all security features then? No memory management, no code signing, no HTTPS, no certificate pinning? Vierualisation has a negligible impact on power consumption.
- KaiserPro 5y ago> Vierualisation has a negligible impact on power consumption. [citation needed] Virtualization on embedded devices with constrained power is a big ask. They are not asking to get rid of all security protections, just pointing out that loosing 10-20% of battery life for marginal security improvement isn't a product winner.
- yokoprime 5y agoWhat? How did you derive "we should get rid of all security features" from my reply? I'm saying your idea of using virtualization on-device is not feasible due to the power envelope available vs customer demands.
- thehappypm 5y agoThe answer is probably plain old complexity. Getting an application that's running in a hypervisor to seamlessly, for example, accept deep-link clicks is more complicated for the same reason that they're more secure. That extra boundary is another wall, another interface. And of course that means more complexity for app developers, and more compute cost/battery utilization.
- eloisius 5y agoI got corrected last time this topic came up. I originally thought Messages was part of the OS and not a pre-installed userspace app. However, if it's in userspace, why is it such a vulnerable vector for compromising the phone? Is there some privilege-escalation component to this that I haven't read about?
- saagarjha 5y agoiMessage is a pre-installed userspace app that uses frameworks that ship with the OS.
- dannyw 5y agoiMessage is one of few apps that have broad permissions to execute code in response to notifications. For other apps like Telegram; the server can send a predefined notification message. For iMessage, when you get something even from someone outside your contacts, its daemon invokes specific code to handle the message, and its attachments. Whilst this doesn't help if someone opens the app, it does at least change this from a zero click attack, to a one click attack. (This is also another example of Apple not following its own app store rules. It has privileged access to frameworks.)
- iamnotwhoiam 5y agoAm I safer if I disable iMessage or can the zero-click hacks exploit the Messages app through SMS?