3 ms·
... and then people chain it with a sandbox escape. This bug is the initial vector of last week's NSO Group zero-click exploit for iPhones: https://citizenlab.
by rfoo 3y ago
... and then people chain it with a sandbox escape.
This bug is the initial vector of last week's NSO Group zero-click exploit for iPhones: https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...
- londons_explore 3y agoThe sandbox escape is the 'bigger' issue really. Applications parse crazy complex stuff to do everything they do, so obviously have a really big attack surface. Often the complexity is unavoidable - if you are a web browser, you cannot avoid parsing html for example. However the sandbox is designed to have an attack surface as small as possible (and be configurable via permissions to have the bare minimum needed). The sandbox interfaces with the rest of the system are fully controllable by Apple, so there is no need to be passing complex and dangerous legacy datastructures across the boundary either. Therefore, it should be the sandbox that is 'hardest' to break out of.
- rfoo 3y agoYour point on sandboxes reduce attack surface is good. > so there is no need to be passing complex and dangerous legacy datastructures across the boundary either. lol, by same logic there is no need to be passing complex and dangerous legacy stuff to browser to parse, just rewrite the world to be simpler.