4 ms·

isn't iMessage the common source of exploiting noclick attacks on apple? Check for vulnerability reports in the last year and it seems the best way to pwn an i

• jandrewrogers 3y ago
  For sure, content sent over iMessage has been used for remote exploitation repeatedly historically, though the attack surface becomes smaller every year. Android’s attack surface is at least as large, but the ecosystem is so fragmented that it is more difficult to attack. Content codecs are an issue everywhere. Aspects of iOS “lockdown mode” severely reduce this attack surface, at the cost of reducing the kinds of random media that can be trivially consumed. I’m not an expert. My impressions from people that are in a position to know is that a modern and properly locked down iOS device is extremely difficult and/or expensive to penetrate. Most people are pretty careless about security regardless. Many orgs that are willing to spend money for security do end up with iOS devices. It is hard to say what that means. I’ve never heard anyone say that Android is more secure than iOS, and the Android versions used in security sensitive contexts are quite unlike anything that would be tolerated on a normal person’s phone.
  • guappa 3y ago
    I'm specifically talking about attacks that happen with no user interaction, just receiving a message gives root access on the phone. They have happened at least 4 different times in 2023, and all were similar in that imessage wasn't (and i guess still isn't) properly sandboxed. So while the actual bug got fixed, the issue of imessage not being sandboxed didn't get fixed. This has nothing to do with how careless or careful one might be, since there is no user interaction required.