3 ms·
My favorite RCE, FORCEDENTRY[0], also involved PDFs. It was the first time I was truly in awe of an exploit. Through a combination of (1) an integer overflow
by favorited 3y ago
My favorite RCE, FORCEDENTRY[0], also involved PDFs. It was the first time I was truly in awe of an exploit.
Through a combination of (1) an integer overflow in an open-source PDF compression library, (2) a Turing-complete compression codec, and (3) CoreGraphics noticing that the "gif" in your iMessage is actually a PDF and helpfully decoding it for you, NSO was able to bootstrap a purpose-built virtual machine, upon which they ran their sandbox-escape.
I highly recommend reading this post[1] by Project Zero if you haven't already.
[0]https://en.wikipedia.org/wiki/FORCEDENTRY https://en.wikipedia.org/wiki/FORCEDENTRY
[1]https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...