Apple iMessage Zero-Click Hacks
wired.com
Apple iMessage Zero-Click Hacks
1–10 of 156 posts
Re: Apple iMessage Zero-Click Hacks
#2I turned off imessage.
I seem to be under attack lately.
3-4 times a day random links sent from gmail addresses or unknown phone numbers to imsg with sketchy looking links in them.
Re: Apple iMessage Zero-Click Hacks
#3How do Zero click hacks work?
Does iMessage accept arbitrary code that it can execute?
Re: Apple iMessage Zero-Click Hacks
#4A small way to reduce attack surface - have iMessage just setup for your iCloud email address instead of phone number. Phone numbers are becoming increasingly useless.
> In fact, Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely.
There's a checkbox in Settings > Messages that does exactly this? It seems strange they published this.
Re: Apple iMessage Zero-Click Hacks
#5I wonder if Apple's devs are just going to say, screw it, we'll rewrite the whole thing in Rust with audits and formal analysis the whole way...
Re: Apple iMessage Zero-Click Hacks
#6A small way to reduce attack surface - have iMessage just setup for your iCloud email address instead of phone number. Phone numbers are becoming increasingly useless. > In fact, Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely. There's a checkbox in Settings > Messages that does exactly this? It seems strange they published this.
Maybe what they mean is that some or all of the iMessage code is still running on the device even if you disable it?
Re: Apple iMessage Zero-Click Hacks
#7How do Zero click hacks work? Does iMessage accept arbitrary code that it can execute?
Similarly to Android there have been attacks that involve exploiting bugs in the code that parses incoming messages, and then via the exploit you can get remote code execution
For example (IIRC this was a real bug), if you exploit a bug in the text layout code, you could attack a device by getting a notification to appear on the lock screen - and SMS messages usually trigger a notification
Re: Apple iMessage Zero-Click Hacks
#8How do Zero click hacks work? Does iMessage accept arbitrary code that it can execute?
Similarly to Android there have been attacks that involve exploiting bugs in the code that parses incoming messages, and then via the exploit you can get remote code execution For example (IIRC this was a real bug), if you exploit a bug in the text layout code, you could attack a device by getting a notification to appear on the lock screen - and SMS messages usually trigger a notification
There was a developer who discovered a bug with the XML parser, and wrote a whole blog post about how he was able to cause iOS's security system to malfunction using a specially-crafted XML permissions file and allow his app to do anything he wanted, even escape the sandbox. He kept it secret for years for his private experimentation until Apple patched it by accident, by adding a 5th XML parser to the other 4 for some reason and using that one instead for the permissions.
Re: Apple iMessage Zero-Click Hacks
#9A small way to reduce attack surface - have iMessage just setup for your iCloud email address instead of phone number. Phone numbers are becoming increasingly useless. > In fact, Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely. There's a checkbox in Settings > Messages that does exactly this? It seems strange they published this.
SMS is also exploitable though, right (Both types of messages go through Messages.app)? And you can't disable SMS entirely I don't think.
Re: Apple iMessage Zero-Click Hacks
#10How do Zero click hacks work? Does iMessage accept arbitrary code that it can execute?
Usually by exploiting holes in some code that does parsing, e.g. for images. Here [1] is a nice write-up.
[1] https://googleprojectzero.blogspot.com/2020/04/fuzzing-image...