4 ms·
A resolution for the iPhone remote access vulnerabilities
The main vulnerabilities exist because of a clickless load that happens largely when a user is sent a text message and either views it or the message contents are parsed to cache the link. Resolving this vulnerability is critical, and yet should not be the main focus for the developers at Apple.
Mainly the "True" vulnerability lies in that the messaging app "iMessage" and the contacts app "Contacts" are not unified and do not handle permissions well. Let me explain. When the user is sent a message from the attacker which leads to the exploit phase, this is because the user is not empowered to inherently reject messages that are incoming. A user that is not present in the contact or address list for an iPhone user should not be able to send iMessages to the user. In other words, the users Contacts should act as a default block list. This would not be sufficient normally, as there are use-cases where the user needs to receive messages from an unknown number.
This is one of the core ways to defeat the vulnerability: making it impossible for the user to receive unsolicited messages, and instead to receive a "Message Request(s)" from unknown numbers, which would be stored in the settings or the main section of the message app "iMessage" as an approve/block list. These users would not be able to send ANY information to the user, whatsoever. They can only initiate the approve/deny process, after which, the user may add them to contacts or allow them to remain as a "temporary contact" -- while also using PBX/callerID discovery to add information to the request, i.e. "Maybe: Alice", or "Maybe: Bob". Unknown users or users that have no association to the user would be either subject to further research on the user's part or result in a block action.
The block action should be defined in 3 pieces. Block for 1 day, Block for 1 week, Block permanently. Clicking "block" should allow the user to select the option as a pop-up menu.
The second way to resolve the vulnerability is to have more strict handling with the contacts app "Contacts" -- instead of the standard user process of "text me" or "call me" to get a number, there should be an easy way to transmit contact information either via an electronic process (scan the QR, contact the devices, etc.) but also by means of knowing the users phone number or contact number. "Text me" should be initially handled by the contacts app, NOT messages. A user that is not validated who sends SMS or a similar message to the user should result in the data not being parsed whatsoever, and the number being sent to a validation step. This solves the issue of users needing to add others via phonecall/texting process while also protecting them during that process from an outside attacker who may have gained their number.
Thank you for reading this is for free, no license. Please consider using it.
- runjake 5y agoI know you mean well, but uninformed "why don't they just...?" ideas are a pet peeve of mine. I'll leave it at that. You may want to read up on the particulars of the Messages component known as "BlastDoor". Start here: https://support.apple.com/guide/security/how-imessage-sends-and-receives-messages-sec70e68c949/web https://support.apple.com/guide/security/how-imessage-sends-... And then Google for terms like "messages blastdoor" for more in-depth particulars. Here's one such good result: https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...
- extreme_eagle 5y agoI know perfectly well how BlastDoor works, and I think maybe you are not the audience that this is intended for. This is not a "Why don't they just". It is an exact solution which resolves the issue in a way which is radically alternative to the current structure. They are trying to abstract the parsing, what must be done is prevent it entirely and relegate the flow of messages to the user-side. Assume that the attacker will inherently compromise the messaging structure and make it to where they don't have access to it instead.
- runjake 5y agoYeah, I guess I am misunderstanding what you are trying to say, then, because from my interpretation, this more or less sounds like BlastDoor, but with an added user/contact component. Adding the user component sounds like an interesting idea, but you've still got to parse the/a payload to get to that. And if you're looking to a zero trust style model, you definitely don't want security decisions put to users (aka "Grandpa Bob"), as demonstrated by email spam/phishing/malware.
- rdtwo 5y agoMost users aren’t affected by this level of attack but some people need the extra security and can live with the inconvenience