2 ms·

I'm sure that in 2023, no mainstream software runs image decoders outside a sandbox right??

rfoo 3y ago
... and then people chain it with a sandbox escape. This bug is the initial vector of last week's NSO Group zero-click exploit for iPhones: https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...
- londons_explore 3y ago
  The sandbox escape is the 'bigger' issue really. Applications parse crazy complex stuff to do everything they do, so obviously have a really big attack surface. Often the complexity is unavoidable - if you are a web browser, you cannot avoid parsing html for example. However the sandbox is designed to have an attack surface as small as possible (and be configurable via permissions to have the bare minimum needed). The sandbox interfaces with the rest of the system are fully controllable by Apple, so there is no need to be passing complex and dangerous legacy datastructures across the boundary either. Therefore, it should be the sandbox that is 'hardest' to break out of.
  - rfoo 3y ago
    Your point on sandboxes reduce attack surface is good. > so there is no need to be passing complex and dangerous legacy datastructures across the boundary either. lol, by same logic there is no need to be passing complex and dangerous legacy stuff to browser to parse, just rewrite the world to be simpler.
intelVISA 3y ago
Yep, not following best practices was banned late 2022 so thankfully your fave outsourced shop is only shipping High Quality and Secure Code (tm) Oh wait, that whole LLM thing...
olliej 3y ago
Right, so all attacks now go: 1. Send payload to a process (image in a browser say) 2. Use payload to get code execution 3. If your current process has all the access you need then go forth and conquer; else 4. Send a payload to another process, go to step 2 Sandboxes are mitigations and roadblocks that increase the complexity of an attack they don’t make them go away.

rfoo 3y ago

... and then people chain it with a sandbox escape. This bug is the initial vector of last week's NSO Group zero-click exploit for iPhones: https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...

londons_explore 3y ago
The sandbox escape is the 'bigger' issue really. Applications parse crazy complex stuff to do everything they do, so obviously have a really big attack surface. Often the complexity is unavoidable - if you are a web browser, you cannot avoid parsing html for example. However the sandbox is designed to have an attack surface as small as possible (and be configurable via permissions to have the bare minimum needed). The sandbox interfaces with the rest of the system are fully controllable by Apple, so there is no need to be passing complex and dangerous legacy datastructures across the boundary either. Therefore, it should be the sandbox that is 'hardest' to break out of.
- rfoo 3y ago
  Your point on sandboxes reduce attack surface is good. > so there is no need to be passing complex and dangerous legacy datastructures across the boundary either. lol, by same logic there is no need to be passing complex and dangerous legacy stuff to browser to parse, just rewrite the world to be simpler.

intelVISA 3y ago

Yep, not following best practices was banned late 2022 so thankfully your fave outsourced shop is only shipping High Quality and Secure Code (tm) Oh wait, that whole LLM thing...

olliej 3y ago

Right, so all attacks now go: 1. Send payload to a process (image in a browser say) 2. Use payload to get code execution 3. If your current process has all the access you need then go forth and conquer; else 4. Send a payload to another process, go to step 2 Sandboxes are mitigations and roadblocks that increase the complexity of an attack they don’t make them go away.