3 ms·

How do Zero click hacks work? Does iMessage accept arbitrary code that it can execute?

kevingadd 5y ago
Similarly to Android there have been attacks that involve exploiting bugs in the code that parses incoming messages, and then via the exploit you can get remote code execution For example (IIRC this was a real bug), if you exploit a bug in the text layout code, you could attack a device by getting a notification to appear on the lock screen - and SMS messages usually trigger a notification
- gjsman-1000 5y ago
  There was a developer who discovered a bug with the XML parser, and wrote a whole blog post about how he was able to cause iOS's security system to malfunction using a specially-crafted XML permissions file and allow his app to do anything he wanted, even escape the sandbox. He kept it secret for years for his private experimentation until Apple patched it by accident, by adding a 5th XML parser to the other 4 for some reason and using that one instead for the permissions.
  - saagarjha 5y ago
    https://siguza.github.io/psychicpaper/ https://siguza.github.io/psychicpaper/
  - deleted 5y ago
    [deleted]
  - hypothesis 5y ago
    Are there seriously 5 XML parsers available in iOS? Are they all written in C? Do they validate all of them whenever a bug is found in one? I can’t tell if this is some sort of defense in depth or just swiss cheese copy-paste…
    - saagarjha 5y ago
      Yes, no (some are C++), lol no, no to both: it’s more that people just kept adding more for each domain
andreasley 5y ago
Usually by exploiting holes in some code that does parsing, e.g. for images. Here [1] is a nice write-up. [1] https://googleprojectzero.blogspot.com/2020/04/fuzzing-imageio.html https://googleprojectzero.blogspot.com/2020/04/fuzzing-image...
- heavyset_go 5y ago
  Similarly, homebrew on the PSP exploited libjpeg or libtiff, so this is one of those vectors that we're still dealing with 16 years later.
dagmx 5y ago
Depends on the hack but the majority seem to be from parsers for various formats, from images, to unicode and text data etc... A message has to be able to display so many different types of content. A flaw in any one of those could be exploited. Combine a bunch of flaws together and you suddenly can do quite a bit.
rasz 5y ago
this header field is always 4 bytes, no need to parse length

Similarly to Android there have been attacks that involve exploiting bugs in the code that parses incoming messages, and then via the exploit you can get remote code execution For example (IIRC this was a real bug), if you exploit a bug in the text layout code, you could attack a device by getting a notification to appear on the lock screen - and SMS messages usually trigger a notification

gjsman-1000 5y ago
There was a developer who discovered a bug with the XML parser, and wrote a whole blog post about how he was able to cause iOS's security system to malfunction using a specially-crafted XML permissions file and allow his app to do anything he wanted, even escape the sandbox. He kept it secret for years for his private experimentation until Apple patched it by accident, by adding a 5th XML parser to the other 4 for some reason and using that one instead for the permissions.
- saagarjha 5y ago
  https://siguza.github.io/psychicpaper/ https://siguza.github.io/psychicpaper/
- deleted 5y ago
  [deleted]
- hypothesis 5y ago
  Are there seriously 5 XML parsers available in iOS? Are they all written in C? Do they validate all of them whenever a bug is found in one? I can’t tell if this is some sort of defense in depth or just swiss cheese copy-paste…
  - saagarjha 5y ago
    Yes, no (some are C++), lol no, no to both: it’s more that people just kept adding more for each domain

andreasley 5y ago

Usually by exploiting holes in some code that does parsing, e.g. for images. Here [1] is a nice write-up. [1] https://googleprojectzero.blogspot.com/2020/04/fuzzing-imageio.html https://googleprojectzero.blogspot.com/2020/04/fuzzing-image...

heavyset_go 5y ago
Similarly, homebrew on the PSP exploited libjpeg or libtiff, so this is one of those vectors that we're still dealing with 16 years later.

dagmx 5y ago

Depends on the hack but the majority seem to be from parsers for various formats, from images, to unicode and text data etc... A message has to be able to display so many different types of content. A flaw in any one of those could be exploited. Combine a bunch of flaws together and you suddenly can do quite a bit.

rasz 5y ago

this header field is always 4 bytes, no need to parse length