Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple iMessage Zero-Click Hacks

wired.com

Post reply on HN
Print view View original

41–50 of 156 posts

Re: Apple iMessage Zero-Click Hacks

#41

Post by vxNsr »

codetrotter wrote: post #36
easton wrote: post #9

Earlier quoted context omitted.

SMS is also exploitable though, right (Both types of messages go through Messages.app)? And you can't disable SMS entirely I don't think.

> you can't disable SMS entirely I don't think Buy a data-only subscription, and use Google Voice or some sort of PBX powered app to still be able to receive regular phone calls. Preferably I’d want a really basic voice only, open source PBX powered app for iOS that I could use. Then I could get me a data-only plan and SIM. Caveat: I still need Norwegian BankID to work with my SIM though. I dunno if any of the data-o…

I know both TMobile and ATT frown upon this and have been known to shut down accounts that do this. Data only is for non-phone accounts in their eyes and anyone trying to circumvent that is committing some sorta fraud (in their eyes).

Re: Apple iMessage Zero-Click Hacks

#42

Post by saagarjha »

CyberRage wrote: post #23
gjsman-1000 wrote: post #5

I wonder if Apple's devs are just going to say, screw it, we'll rewrite the whole thing in Rust with audits and formal analysis the whole way...

Well I would dare to say iMessage isn't the biggest target to convert to Rust. At the end of the day, it is still an app with app level permissions, sandbox etc. Kernel\Kernel modules are far more likely to be written as they allow for vastly more access than an app.

It's a great target considering that a lot of other exploits go through the kernel just to get access to your iMessages.

Re: Apple iMessage Zero-Click Hacks

#43

Post by saagarjha »

gjsman-1000 wrote: post #8
kevingadd wrote: post #7

Earlier quoted context omitted.

Similarly to Android there have been attacks that involve exploiting bugs in the code that parses incoming messages, and then via the exploit you can get remote code execution For example (IIRC this was a real bug), if you exploit a bug in the text layout code, you could attack a device by getting a notification to appear on the lock screen - and SMS messages usually trigger a notification

There was a developer who discovered a bug with the XML parser, and wrote a whole blog post about how he was able to cause iOS's security system to malfunction using a specially-crafted XML permissions file and allow his app to do anything he wanted, even escape the sandbox. He kept it secret for years for his private experimentation until Apple patched it by accident, by adding a 5th XML parser to the other 4 for so…

https://siguza.github.io/psychicpaper/

Re: Apple iMessage Zero-Click Hacks

#44

Post by [deleted] »

gjsman-1000 wrote: post #8
kevingadd wrote: post #7

Earlier quoted context omitted.

Similarly to Android there have been attacks that involve exploiting bugs in the code that parses incoming messages, and then via the exploit you can get remote code execution For example (IIRC this was a real bug), if you exploit a bug in the text layout code, you could attack a device by getting a notification to appear on the lock screen - and SMS messages usually trigger a notification

There was a developer who discovered a bug with the XML parser, and wrote a whole blog post about how he was able to cause iOS's security system to malfunction using a specially-crafted XML permissions file and allow his app to do anything he wanted, even escape the sandbox. He kept it secret for years for his private experimentation until Apple patched it by accident, by adding a 5th XML parser to the other 4 for so…

[deleted]

Re: Apple iMessage Zero-Click Hacks

#45

Post by zsmi »

dylan604 wrote: post #34
eyeball wrote: post #2

I turned off imessage. I seem to be under attack lately. 3-4 times a day random links sent from gmail addresses or unknown phone numbers to imsg with sketchy looking links in them.

Can you war-dial attack with these? Seems like it would be super easy for a script kiddie to just start at 111-111-1111, send message, increment by 1, repeat. Maybe narrow it down to valid area codes and what not, but seems like a super low budget thing to do.

Sure.

https://calleridreputation.com/blog/robotexts-are-replacing-...

"Robotech spammers are also targeting group messages by using automated programs to send thousands, even millions of group texts to random phone numbers with the hopes that somebody will take the prey and respond."

Also, some users give random apps access to their address book for whatever reason then there is a whole list of known good emails and numbers to spam.

Re: Apple iMessage Zero-Click Hacks

#46

Post by rmorey »

dylan604 wrote: post #34
eyeball wrote: post #2

I turned off imessage. I seem to be under attack lately. 3-4 times a day random links sent from gmail addresses or unknown phone numbers to imsg with sketchy looking links in them.

Can you war-dial attack with these? Seems like it would be super easy for a script kiddie to just start at 111-111-1111, send message, increment by 1, repeat. Maybe narrow it down to valid area codes and what not, but seems like a super low budget thing to do.

Well, send from what? Every iMessage comes from an account with an Apple ID, so I presume stolen credentials would be the only way to really do this, adding to the cost.

Re: Apple iMessage Zero-Click Hacks

#47

Post by setpatchaddress »

raspasov wrote: post #35
coldcode wrote: post #31

Earlier quoted context omitted.

Some Apple devs still seem to love C and Obj-C (at least the ones my former employer worked with directly) and hate on Swift. Both Swift and Rust can be written to a much higher standard where the language protects you from stupidity, but only if you give up the past and use them. While you can write pretty good C-ish code (i.e. Linux), its far too easy to slip up once and the language does nothing to save your ass.…

I agree. Swift is a nice language, compared to the alternatives. I have a few months experience in it, and I can definitely agree that if you're writing Swift-only, it's very nice. The emphasis on values, and value semantics is definitely a differentiator from most other languages. However, anytime you have to use/interop with an older API designed for Obj-C (for example, AVFoundation), it's much more of a pain. Effe…

Yes, there are some people who simply prefer Objective-C, but you need to also realize that Swift is still not ready for system-level programming. Analysis tools aren’t ready; debugging basically means you go to printing variables to stderr and praying. The standard library defaults to crashing at runtime for simple float integer conversion bounds errors which you’d think would be caught statically with more thoughtful design. Still a lot of rough edges.

SwiftUI in particular is excellent and if you can use it you should. But you can’t say Swift in general is ready to replace Objective-C. It’s not.

Re: Apple iMessage Zero-Click Hacks

#48

Post by p49k »

codetrotter wrote: post #36
easton wrote: post #9

Earlier quoted context omitted.

SMS is also exploitable though, right (Both types of messages go through Messages.app)? And you can't disable SMS entirely I don't think.

> you can't disable SMS entirely I don't think Buy a data-only subscription, and use Google Voice or some sort of PBX powered app to still be able to receive regular phone calls. Preferably I’d want a really basic voice only, open source PBX powered app for iOS that I could use. Then I could get me a data-only plan and SIM. Caveat: I still need Norwegian BankID to work with my SIM though. I dunno if any of the data-o…

Data-only subscriptions can still receive SMS messages in my experience, you just can't send them.

Re: Apple iMessage Zero-Click Hacks

#49

Post by hexa22 »

p49k wrote: post #48
codetrotter wrote: post #36

Earlier quoted context omitted.

> you can't disable SMS entirely I don't think Buy a data-only subscription, and use Google Voice or some sort of PBX powered app to still be able to receive regular phone calls. Preferably I’d want a really basic voice only, open source PBX powered app for iOS that I could use. Then I could get me a data-only plan and SIM. Caveat: I still need Norwegian BankID to work with my SIM though. I dunno if any of the data-o…

Data-only subscriptions can still receive SMS messages in my experience, you just can't send them.

And you still need them because some services only provide sms verification.

Re: Apple iMessage Zero-Click Hacks

#50

Post by saagarjha »

setpatchaddress wrote: post #47
raspasov wrote: post #35

Earlier quoted context omitted.

I agree. Swift is a nice language, compared to the alternatives. I have a few months experience in it, and I can definitely agree that if you're writing Swift-only, it's very nice. The emphasis on values, and value semantics is definitely a differentiator from most other languages. However, anytime you have to use/interop with an older API designed for Obj-C (for example, AVFoundation), it's much more of a pain. Effe…

Yes, there are some people who simply prefer Objective-C, but you need to also realize that Swift is still not ready for system-level programming. Analysis tools aren’t ready; debugging basically means you go to printing variables to stderr and praying. The standard library defaults to crashing at runtime for simple float integer conversion bounds errors which you’d think would be caught statically with more thoughtf…

Swift is not ready, but it's not for those reasons. The real problem is that Swift needs a hefty runtime and is fairly slow due to excessive ARC traffic, plus it has no way of recovering from memory exhaustion. So you can't really use it in the kernel, but it's perfectly fine for writing system frameworks and daemons.
Post reply on HN