5 ms·

Is it a fair assumption that any code written in C / C++ / Objective-C has a high likelihood of allowing zero-click hacks?

tyingq 5y ago
Aren't these making it past BlastDoor, written in Swift?
- Pulcinella 5y ago
  Swift has e.g. UnsafePointer if you want to work more directly with memory. Presumably if BlastDoor uses them to work directly with memory then it could still be vulnerable, though I am not sure because I am not very familiar with them. If I was excited about pointers I wouldn't be using Swift...
  - saagarjha 5y ago
    It is highly unlikely BlastDoor is using much of those, except when interacting with system frameworks.
- vlozko 5y ago
  The exploit targets existing C code that did image decoding and used CoreFoundation to handle data reads. Blast door is Swift-based and likely very memory-safe. What I’m curious about is where the limits of BlastDoor are that it couldn’t contain this particular attack. I’m under the impression that BlastDoor was built exactly for this type of attack.
azinman2 5y ago
Objective-c has bounds checks and lengths built into NSData, NSArray, and NSString… so many of the buffer overflow techniques likely won’t work against it. However, images and video seem to hit C++ code and from all of the past CVEs it seems this is a giant attack surface over and over again. I’m surprised this code isn’t being rewritten in something like Rust, but perhaps there are more things going on at play, like the plist serialization attacks that end up coding for esoteric classes that contained various bugs.
- thenewwazoo 5y ago
  As a certified member of the Rewrite It In Rust (RIIR) Reaction Force, let me answer this by saying that it’s very, very hard to get the software right, even the second time, and RIIR trades one set of unknowns for another. There are also a huge number of people who are convinced that Rust is a fad, or that C is good enough, or whatever. The same people who swore they could outbrake ABS decades ago. They do not want to learn a new, hard thing, and Rust can be hard at first.
  - raspasov 5y ago
    Haha, love the ABS analogy!
  - deleted 5y ago
    [deleted]
- saagarjha 5y ago
  Objective-C can run into other issues, though: NSSecureCoding exists for a reason ;)
  - azinman2 5y ago
    Which is why I mention plists
- mitemte 5y ago
  Depends where the vulnerability lies. Plenty of iMessage DoS attacks [1-4] have targeted CoreText, which, I believe is written in C and CoreFoundation. I think all of these DoS attacks could be mitigated by not viewing the message and disabling message previews in notifications. [1] https://habr.com/ru/post/191654/ https://habr.com/ru/post/191654/ [2] https://appleinsider.com/articles/15/05/27/bug-in-ios-notifications-handling-crashes-iphones-with-a-simple-text https://appleinsider.com/articles/15/05/27/bug-in-ios-notifi... [3] https://blog.zecops.com/research/analyzing-the-ios-telugu-crash-part-i/ https://blog.zecops.com/research/analyzing-the-ios-telugu-cr... [4] https://www.macrumors.com/2018/05/09/how-to-fix-black-dot-imessage-crashing-bug/ https://www.macrumors.com/2018/05/09/how-to-fix-black-dot-im...
FounderBurr 5y ago
No

tyingq 5y ago

Aren't these making it past BlastDoor, written in Swift?

Pulcinella 5y ago
Swift has e.g. UnsafePointer if you want to work more directly with memory. Presumably if BlastDoor uses them to work directly with memory then it could still be vulnerable, though I am not sure because I am not very familiar with them. If I was excited about pointers I wouldn't be using Swift...
- saagarjha 5y ago
  It is highly unlikely BlastDoor is using much of those, except when interacting with system frameworks.
vlozko 5y ago
The exploit targets existing C code that did image decoding and used CoreFoundation to handle data reads. Blast door is Swift-based and likely very memory-safe. What I’m curious about is where the limits of BlastDoor are that it couldn’t contain this particular attack. I’m under the impression that BlastDoor was built exactly for this type of attack.

azinman2 5y ago

Objective-c has bounds checks and lengths built into NSData, NSArray, and NSString… so many of the buffer overflow techniques likely won’t work against it. However, images and video seem to hit C++ code and from all of the past CVEs it seems this is a giant attack surface over and over again. I’m surprised this code isn’t being rewritten in something like Rust, but perhaps there are more things going on at play, like the plist serialization attacks that end up coding for esoteric classes that contained various bugs.

thenewwazoo 5y ago
As a certified member of the Rewrite It In Rust (RIIR) Reaction Force, let me answer this by saying that it’s very, very hard to get the software right, even the second time, and RIIR trades one set of unknowns for another. There are also a huge number of people who are convinced that Rust is a fad, or that C is good enough, or whatever. The same people who swore they could outbrake ABS decades ago. They do not want to learn a new, hard thing, and Rust can be hard at first.
- raspasov 5y ago
  Haha, love the ABS analogy!
- deleted 5y ago
  [deleted]
saagarjha 5y ago
Objective-C can run into other issues, though: NSSecureCoding exists for a reason ;)
- azinman2 5y ago
  Which is why I mention plists
mitemte 5y ago
Depends where the vulnerability lies. Plenty of iMessage DoS attacks [1-4] have targeted CoreText, which, I believe is written in C and CoreFoundation. I think all of these DoS attacks could be mitigated by not viewing the message and disabling message previews in notifications. [1] https://habr.com/ru/post/191654/ https://habr.com/ru/post/191654/ [2] https://appleinsider.com/articles/15/05/27/bug-in-ios-notifications-handling-crashes-iphones-with-a-simple-text https://appleinsider.com/articles/15/05/27/bug-in-ios-notifi... [3] https://blog.zecops.com/research/analyzing-the-ios-telugu-crash-part-i/ https://blog.zecops.com/research/analyzing-the-ios-telugu-cr... [4] https://www.macrumors.com/2018/05/09/how-to-fix-black-dot-imessage-crashing-bug/ https://www.macrumors.com/2018/05/09/how-to-fix-black-dot-im...

FounderBurr 5y ago