5 ms·

That's where I think Rust could be a game changer, if all those deserialization libraries used in phone would be written in safe Rust it woudn't be an issue.

• invokestatic 5y ago
  As explained in the introduction, this escape used only logic bugs. So rust would still be affected
  • ghayes 5y ago
    From the first paragraph: > By sending a .gif iMessage attachment (which was really a PDF) NSO were able to remotely trigger a heap buffer overflow in the ImageIO JBIG2 decoder.
    • greiskul 5y ago
      Yes, this attack had multiple stages. First stage is to get something running, and to do that they do use a memory bug that Rust would prevent. The second stage is the sandbox escape that the post describes which is done with only logic bugs, so that would still be vunerable if written in Rust. While rewritting the world is not possible, all these attacks show that definitely new systems should probably not be written in memory unsafe languages.
    • O5vYtytb 5y ago
      They're referring to a previously mentioned exploit: > Late last year we published a writeup of the initial remote code execution stage of FORCEDENTRY, the zero-click iMessage exploit attributed by Citizen Lab to NSO. The sandbox escape only uses logic bugs: > In this post we'll take a look at that sandbox escape. It's notable for using only logic bugs.
• ForgotIdAgain 5y ago
  In the introduction "In this post we'll take a look at that sandbox escape. It's notable for using only logic bugs". My understanding was that Rust only cover memory corruption type of bug.
  • xxpor 5y ago
    Notably, no language will ever be able to catch pure logic errors by itself. The computer can't and shouldn't try to divine what you meant. It'll only do what it's told. Now, there are certainly advantages different languages have in ease of writing tests and things like that. There's also formal verification. But unlike memory errors, it's impossible to know if you told the computer to do something you didn't intend.
    • jandrese 5y ago
      Indeed this is the Halting Problem.
      • sassy_quat 5y ago
        I guess that's the true Turing Test, can an artificial general intelligence determine the complexity level and relative risk level of infinite loops for an algorithm written for a Turing machine.
      • not2b 5y ago
        The halting problem doesn't prevent correctness proofs, it only means that you get a three-valued answer: proof, counterexample, or too complex to determine. "Too complex to determine" usually means that the code needs to be rewritten to have simpler structure. And of course the proof is only for those properties that you write down, and you could also have a bug in the spec for those properties.
    • roca 5y ago
      > Notably, no language will ever be able to catch pure logic errors by itself. It's true you'll never be able to catch all logic errors automatically, partly because you need full correctness specifications for that. But languages like Rust with powerful static type systems can catch lots more important logic errors than C, or C++ --- e.g. using typestate (catches bugs with operations on values in incorrect states), affine types (catches bugs with operations on "dead" values), newtypes (e.g. lets you distinguish sanitized vs unsanitized strings), sum types (avoids bugs where "magic values" (e.g. errors) are treated as "normal values"). Also modern languages like Swift, and Rust to a lesser extent, are treating integer overflow as an error instead of just allowing it (or worse, treating it as UB).
• throwra620 5y ago
• jedisct1 5y ago
  You didn't even read the blog post, did you?
  • Thaxll 5y ago
    I did not indeed.
• tialaramex 5y ago
  Rather than Rust, the correct choice here was WUFFS because Apple's explicit purpose here was to Wrangle Untrusted File Formats Safely which is literally why WUFFS is called that. Unlike Rust, WUFFS isn't a general purpose language it can only express a subset of possible programs. For example, WUFFS can't express the program NSO wanted here ("Provide a way to escape from this sandbox") whereas of course in a general purpose language that would feel annoyingly restrictive. What if you want to escape from the sandbox? WUFFS is exactly the right tool for, say, parsing a file you received to turn it into an image for display on the iPhone's screen. Except, of course, if your focus is on features at all costs. If you don't care about security then it sucks that WUFFS can't take a file and maybe overwrite the operating system or whatever.