4 ms·
biggest issue here isn't memory safety but the dumpster fire of imessage format that calls out to privileged parts of the system
by DyslexicAtheist 5y ago
biggest issue here isn't memory safety but the dumpster fire of imessage format that calls out to privileged parts of the system
- vlovich123 5y agoWhich is exploitable primarily it by memory safety exploits. Will it make attacks impossible? Probably not totally. But it might raise the cost of the attack by an order of magnitude or more and certain classes of vulnerabilities might disappear completely.
- walrus01 5y agoI'm suspicious of any messaging system that has ties into rich media / embedded-in-chat content. I even wish I could disable URL previews, gifs, and inline images in Signal.
- elliekelly 5y agoI didn't know it was possible to disable URL previews in iMessage[1] until I read this comment. Does toggling this setting only prevent the preview from displaying or does it prevent the fetch altogether? I wish there were a way to white list the URL previews for certain contacts rather than turning it off all or nothing. [1]https://discussions.apple.com/thread/7677834 https://discussions.apple.com/thread/7677834
- kingcharles 5y agoIt can be your "trusted" contacts that infect you though. "Jeff Bezos was hacked by a file sent from the WhatsApp account of the crown prince of Saudi Arabia, Mohammed bin Salman" https://en.wikipedia.org/wiki/Jeff_Bezos_phone_hacking https://en.wikipedia.org/wiki/Jeff_Bezos_phone_hacking
- spear 5y agoI didn't see a way to disable URL previews in that thread. The given "solution" is wrong -- it just disables message previews in the lock screen.
- 2OEH8eoCRo0 5y agoIt's an extremely common attack vector. PDFs, media message, etc. Would it be viable to create a dedicated processor specifically for parsing these things?
- fmajid 5y agoAnd Apple's terrible software and QA processes, like lack of CI or fuzzing, which is why Google Project Zero is discovering flaws for them.