8 ms·
Blasting Past WebP - An analysis of the NSO BLASTPASS iMessage exploit
- cedws 2y agoIt’s always codecs. I don’t always buy into the $safelanguage cargo cult but come on, it’s apparent that memory unsafe languages are not appropriate for this purpose and desperately need replacing.
- oguz-ismail 2y ago[flagged]
- adzm 2y agoAlpha channels in a lossy image? Animated lossy image? Regardless, things like this really help explain the hesitation behind adopting jpegxl. I'm a big fan of AVIF files though.
- oguz-ismail 2y ago>Alpha channels in a lossy image? Why? >Animated lossy image? It's called a video
- londons_explore 2y agoThere are loads of uses for alpha channels. Anything you want layered with other graphics without being surrounded by an ugly black square... There are loads of uses for lossy images. Pretty much any image is probably best transmitted lossy, because the saved ram, CPU, bandwidth, load time is huge compared to the usually unnoticeable quality degregation. So it stands to reason there are lots of uses for lossy alpha images.
- oguz-ismail 2y ago>usually unnoticeable quality degregation Dunno I think it'd be too messy
- IshKebab 2y agoOnly if they implement jpegxl decoders in C/C++. I would really hope that isn't the case. Seems like they agree: https://github.com/mozilla/standards-positions/pull/1064 https://github.com/mozilla/standards-positions/pull/1064
- _mlbt 2y agoNo serious alternative? Apple could easily make a safe image handling library in Swift.
- ChocolateGod 2y agoSwift is underrated, I wish it had more traction outside Apples ecosystem. Easy to learn, fast and memory safe without a GC.
- cosmic_cheese 2y agoIt’s very slowly starting to get a bit of traction outside of Apple now that the language has filled many gaps and Foundation is being re-written to be Swift-first and open source. I expect growth of adoption to continue to be slow for the time being though.
- necubi 2y agoAutomatic reference counting is a form of GC, and optimized versions of it end up very similar to tracing GC: https://web.eecs.umich.edu/~weimerw/2012-4610/reading/bacon-garbage.pdf https://web.eecs.umich.edu/~weimerw/2012-4610/reading/bacon-... (except that ARC can't handle cyclic graphs)
- IshKebab 2y agoAnd it's more deterministic without random pauses.
- pebal 2y agoThe reference counting also causes pauses when freeing large object graphs. Fully concurrent GC does not cause any pauses and it's more efficient. It also has less memory overhead per object.
- Aloisius 2y agoWhat GC doesn't cause any pauses? I know of some who claim to be "pauseless", but it's b.s. marketing. They also tend to be memory hogs that don't play well with other processes in low memory environments with the kind of allocation behavior seen in UI applications. And of course, the issue is not only stop-the-world pauses (though those are especially bad), but any pause in any thread period. A RC system lets you have consistent, predictable performance and often can be completely eliminated through static analysis.
- actionfromafar 2y agohttps://github.com/google/wuffs https://github.com/google/wuffs <-- DSL created explicitly for wrangling fileformats safely
- jonatron 2y agoThank you, I spent a few minutes failing to google this.
- actionfromafar 2y agoI always do that, sometimes I succeed, sometimes I fail! :-D
- internetter 2y agoWritten in C? Unless I'm missing something this isn't better than other unsafe options
- codetrotter 2y agoFrom the Wuffs readme: > Wuffs the Language is safe with respect to buffer overflows, integer arithmetic overflows and null pointer dereferences. A key difference between Wuffs and other memory-safe languages is that all such checks are done at compile time, not at run time. If it compiles, it is safe, with respect to those three bug classes. > […] > Wuffs code is hermetic and can only compute (e.g. convert "compressed bytes" to "decompressed bytes"). It cannot make any syscalls (e.g. it has no ambient authority to read your files), implying that it cannot allocate or free memory (and is therefore trivially safe against things like memory leaks, use-after-frees and double-frees).
- yjftsjthsd-h 2y agoAnd - https://github.com/google/wuffs/blob/main/doc/std/image-decoders.md#implementations https://github.com/google/wuffs/blob/main/doc/std/image-deco... with a webp implementation.
- 2y ago
- greenavocado 2y agoJPEG-XL is the future everything else is forced/shilled to the extreme without considering its merits. Don't even get me started how some website will show a URL to a JPEG and when you try to save it, it tries to save a WebP. WebP suffers from excessive generation loss for a modern codec. https://www.youtube.com/watch?v=qc2DvJpXh-A https://www.youtube.com/watch?v=qc2DvJpXh-A
- dev1ycan 2y agoYeah but Google goes out of their way to kill jpeg-xl, they really deserve to lose chrome
- latexr 2y agoI find it curious how the AVIF deterioration resembles an old physical photograph. I wonder why that is. Do you know of more comparisons like this? I’d like to observe the effect further but don’t have the availability right now to pursue it.
- derf_ 2y agoIt looks like a straight-up bug in chroma quantization. libaom has never had good chroma RDO tuning.
- jeroenhd 2y agoJPEG-XL works in even fewer programs than WebP does, though, which is almost impressive given WebP's reputation.
- voidUpdate 2y agoGood compression for web images. I converted the images on my website to webp and saw a huge reduction in filesizes with virtually no loss in quality, but it still keeps an alpha channel unlike jpg
- oguz-ismail 2y ago[flagged]
- voidUpdate 2y agoDepending on where you are and what mobile data plan you have, bandwidth is not always cheap. And I don't see the problem in trying to reduce the amount of data sent, which is one of the reasons I don't fill my website with megabytes of javascript libraries
- yjftsjthsd-h 2y ago> Storage is cheap, bandwidth is cheap, so who cares? That may be true sometimes, but it isn't true all the time. Even if it's "cheap", smaller files load faster.
- web007 2y ago> Storage is cheap, bandwidth is cheap, so who cares? This is a ridiculous assertion. They're both cheap in the commercial sense, but neither cheap nor infinite in the UX sense. Time and space matter in the real world. Google wouldn't have created WebP if there was no tangible, measurable cost benefit to using it over some alternative. Same goes for H.264 or HEVC or AV1, at scale bandwidth and storage are far from cheap. See the article on the FP today about Google's double-digit EXAbyte storage clusters with 50TB/s read volume each as a real-world example, there's nothing cheap about that.
- 01HNNWZ0MV43FF 2y agoWell the principle reason to use Rust is that it has good tagged unions But I don't even buy into the cargo cult cargo cult https://www.righto.com/2025/01/its-time-to-abandon-cargo-cult-metaphor.html?m=1 https://www.righto.com/2025/01/its-time-to-abandon-cargo-cul...
- deleted 2y ago[deleted]
- unit149 2y ago[dead]
- junto 2y agoThere always been an issue here with files reporting to be one thing but being another. Trusting the file extension is amateur to say the least. ‘Magic strings’ in the header of the file is the usual way, but even then, you can’t really trust it. What we really need is some way to guarantee that the contents are in a valid format as defined by the header, and haven’t been tampered with and signed as such, and embeds that in the file itself. Then I can take the contents of the file after the header, hash it and compare it with the embedded sig. Back porting this to standard formats though would be a nightmare.
- klabb3 2y agoSo an attacker should sign their malicious webp or jpeg files beforehand? That doesn’t help at all. No, I agree very much with parent here. I think compile time safety and rust fanatism has been oversold, but let’s face it this is the perfect use case, a match made in heaven. Decoding in C/C++ has a Dunning Kruger deceitful appeal. People think they can do it, but time and time again, we find critical holes, even when written by 10x wizard Nobel laureate engineers. At the same time, decoding needs to be crazy performant. So, this is the moment to shine for languages like Rust. I am 100% in support of this.
- TheDong 2y agoIt feels so ridiculous to me that a total stranger can send an iMessage message to me, including some attachment, and my phone will process that message in the kernel. How hard would it be for apple to have a setting of "Only receive messages from mutual contacts", and require the stranger to first "request to be added to contacts" (a message which is tightly controlled, and obviously doesn't include a pdf file or webp or whatever), and have the apple imessage server drop all other messages from them until I accept. Signal has "message requests". iMessage doesn't have "message requests", and receives messages in a unique path which goes through the kernel. Like, sure the attacker could hit my Mom with a wrench and iMessage me a PDF exploit that way, but I feel like requiring physical access to one of my contact's phones raises the bar significantly over the current state of affairs.
- yjftsjthsd-h 2y agoI wonder if "Filter messages from unknown senders" ( https://support.apple.com/guide/iphone/block-filter-and-report-messages-iph203ab0be4/ios https://support.apple.com/guide/iphone/block-filter-and-repo... ) skips any processing. Also, I really thought there was an option to somehow restrict media in messages, but I can't seem to find docs for that.
- TheDong 2y agoI'd feel much safer if the message was filtered at the server, not on my device. It's not clear how much or little of the message is processed, but it's clear attacker controlled data lands on my device. > an option to somehow restrict media in messages "LockdownMode", which removes attachments, but also turns off JIT in your browser, and removes the ability to install configuration profiles, among other things. For some reason apple has a security setting that restricts iMessage media, but to opt into that, you also have to make your web browser useless and have GPS stripped from your photos, idk, apparently "enable" toggles are expensive and they could only afford a single one for like 10 unrelated security features.
- larfus 2y agoIf Apple advertised a toggle that protects you completely but let the users decide the mitigations, it would severely damage its standing as a secure phone when it would inevitability get exploited. (Targeted) Apple users are usually not technical.
- botanical 2y agoNSO Group are a terrorist group for hire. This 0-click, 0-day exploit was found targeting civil society. Any one can pay to target journalists, NGOs, politicians. This is why open-source is paramount to security, and having code out in the open.
- jsheard 2y agoSupposedly NSOs products are classed as restricted weapons exports by the Israeli government, and all sales have to be approved by the Ministry of Defense, so they have their own share of the blame when it falls into the wrong hands.
- adhamsalama 2y ago[flagged]
- fartfeatures 2y ago[flagged]
- dragonwriter 2y agoHaving a policy directed at genocide does not mean not exercising restraints for various reasons, including the reason of having a certain level of deniability around the goal. Your argument is grounded in conflating two unrelated propositions.
- adhamsalama 2y ago[flagged]
- actionfromafar 2y agoDoes it matter much (except in a technical, judicial way) what exactly they are pursuing? The facts on the ground are horrible.
- klabb3 2y ago
- ipython 2y agoI'm sure nobody would think of targeting the national security apparatus of the USG with such an exploit to gain access to... I dunno, their Signal messages?
- mrguyorama 2y agoOne of the members of that group was accessing it from Moscow to meet with Putin. Our adversaries don't have to hack anything at all, they don't even seem to have to ask nicely. There's zero chance that Putin doesn't let China know anything they want about the Trump admin, and Putin himself seems to get to dictate our country's policy now. This has been the case among republicans for decades, and Mitch McConnell himself (and 6 others) spent the 4th of July 2018 in Moscow for christ's sake.
- nxobject 2y agoEssentially relying on COTS software with likely exploit bounties targeting dozens of high-value targets other than the USG – what could go wrong?
- michaelt 2y agoDo you think special custom software, developed under government contract, would be any more secure? My experience with software procured by the government is that it's not winning any awards for best software.
- EasyMark 2y agoI think it's more so that those aren't as readily available as signal to get at the exploits, and it would be on gov provided devices not on everyday phones that people install just whatever on and then decide to set up a chat group and talk about blowing up brown people whimsically.
- cosmicgadget 2y agoSimply rebuilding software for limited distribution makes it more secure.
- nxobject 2y agoAt this point, I think Apple's platform security teams have to seriously [edit: by default] start mitigating attachment exploits in ways that affect UX – _not_ rendering message previews, or blacklisting formats by defaults. Given Apple's pro-privacy messaging – and acceptance of things like Signal auto delete – think Apple's user base might now be comfortable with taking hits to UX in the name of security.
- snailmailman 2y agoLockdown mode does this. Preventing weird attachment types entirely. Preventing most of the “edge case” things. Like you also can’t be added to an icloud album, or install new configuration profiles. Although it’s a bit extreme. It disables almost all web-fonts which breaks a lot of websites. (It’s easy to toggle this, but you have to do so per-site) It’s really not designed for the average user.
- jeroenhd 2y agoI think lockdown mode is fine for most people. Yes, some websites are broken because they assume their font always loads, but I've never really felt bothered by issues like that. Then again, I've never really used iCloud, so maybe I'm missing out on something there. Many edge cases covered, like not being able to add configuration profile, are fixes to insecure defaults IMO.
- nneonneo 2y agoThis exploit is just wild. There are just so many little tricks connected together - using multiple image files with unexpected formats, aligning heap chunks to sit on easily-predicted and manipulable addresses, deserializing a huge object graph from image metadata, the usual NSExpression insanity, PAC bypass via unsigned pointers to function-pointer-containing structures, etc. etc. I thought the last exploit (where they built an entire virtual CPU out of image decompression commands: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...) was crazy, but that involved a lot fewer "tricks" than this exploit. Many of these tricks are non-public, meaning that NSO would have had to spend a huge amount of time and effort researching every single one of these. They probably have many more tricks they know about and haven't used. And, Apple could patch every one of them in a future update and roll back all of that work. There's a good reason why these exploits are expensive and only sent to a limited number of high-value targets. NSO this time around also worked to "protect their IP" using encryption to hide part of their exploit chain, presumably in a bid to avoid losing yet more of their precious zero-days to researchers. What they're doing is pretty gross (particularly the whole spying-on-journalists bit), but you have to admit the level of technological sophistication and persistence here is pretty impressive.
- ogurechny 2y agoA strange choice of words. It's like saying “cannibalism is pretty gross, but the chef outdid himself on those slices”. Moreover, even if it's complex from the technical point of view, morally it's dead simple: hired programmer is the same as dirty grunt with a gun, and the leader delivering speeches, and the rocket engine scientist, and the data processing clerk, and everyone in between. They all serve the Order they believe in, the king of this world.
- heavensteeth 2y ago> It's like saying [...] "Proof by analogy is fraud" - Bjarne Stroustrup
- areyourllySorry 2y ago
- danilonc 2y agoWould Lockdown Mode mitigate any part of this exploit chain? If so, which aspects would it block? The Apple support page mentions that most message attachment types are blocked, *except* for certain images, videos, and audio. Given this, would Lockdown Mode have prevented this exploit? https://support.apple.com/en-us/105120 https://support.apple.com/en-us/105120
- processunknown 2y agoDo they even specify which types are blocked?
- bawolff 2y ago> The closest thing to a specification for the PKPass format appears to be the Wallet Developer Guide, and whilst it doesn't explicitly state that the .png files should actually be Portable Network Graphics images, that's presumably the intention. Lol, that got a chuckle out of me. Amazing write up by google project zero as always.
- lukeh 2y agoJust FYI to the article, more recent versions of CF are available as part of swift-corelibs-foundation.
- favorited 2y agoThey're newer, but they aren't at all similar to what ships on Apple's OSes anymore. These days, the layers have flipped, and CoreFoundation is becoming a wrapper around swift-foundation. CF functions toll-free bridge the CF types to their Foundation counterparts and invoke the corresponding Objective-C API, which is either implemented directly in Swift, or is a wrapper around the Swift function. An Apple employee on the Foundation team posted an example of how calling `CFCalendarCreateWithIdentifier` works here: https://forums.swift.org/t/swift-foundation-now-available/73530/27 https://forums.swift.org/t/swift-foundation-now-available/73... I'm sure it's still a work-in-progress, but their definitive goal is for the OSS swift-foundation codebase to be the same as what ships in their OSes, which was never the case with swift-corelibs-foundation. Edit: I found a conference talk by some Apple folks that goes into more detail https://www.youtube.com/watch?v=wn6C_XEv1Mo https://www.youtube.com/watch?v=wn6C_XEv1Mo
- saagarjha 2y agoswift-foundation will never be the code that ships on the OS, mostly because they always have some private bits they won't expose. Come back when URL bookmarks are part of the open source dump.
- favorited 2y agoOf course the entire binary will never be the same, but the implementation of (for example) DateComponents.swift in OSS swift-foundation will be the same implementation that is used to build the OS library. Going forward, the bedrock of both the OSS package and the platform [Core]Foundation.framework will be swift-foundation. This is distinct from SCF, which was a novel Swift wrapper around CoreFoundation.
- 2y ago
- qingcharles 2y agoOne of the tricks mentioned in here -- changing the extension to bypass a check -- works great on a ton of sites. Many sites won't let you upload a .gif file, but don't actually check the contents of the file, so just rename your .gif to a .jpg and voilà! (you can sometimes get this to allow you to upload and execute server-side scripting pages too)
- raquelledger330 2y ago[dead]