181–190 of 330 posts
Do these types of iMessage attachment exploits require the victim to do anything on their end? Downloading the attachment? Opening the message ? That part is unclear to me
No, most are zero-click silent exploits. They own your phone persistently then delete the incoming message that pwned you.
I really hope the blur on the picture ( https://citizenlab.ca/wp-content/uploads/2021/10/Hubbard-Ima... ) isn't hiding anything actually important because that can almost certainly be de-blurred with the right tooling.
Earlier quoted context omitted.
I have never eaten in such a restaurant and I eat out a lot. Is this really true where you are? No menus?
Not all, but many restaurants in multiple cities. They use QR codes, no doubt to identify you better (tie you to a specific place and time, maybe to a specific table). Usually I just load the restaurant's website on my phone and read the menu that way. I was also at a play where a QR code was the only way to get the program.
I really hope the blur on the picture ( https://citizenlab.ca/wp-content/uploads/2021/10/Hubbard-Ima... ) isn't hiding anything actually important because that can almost certainly be de-blurred with the right tooling.
Really? Seems blurred enough to me that even some sort of ML would spit out wrong characters.
Earlier quoted context omitted.
How can you possibly not escape the use of a smartphone?
I recently had to file an insurance claim with my car insurer. The entire process happened through their app. They require you to send them pictures that you took using their app. One of my banks has been closing branches left and right, and if I want to use my accounts for anything other than debit purchases, I need to use the app. Some banks even charge you when you go to a branch location in person and use a telle…
Nonsense, just tell them you can't do that and will email them. Have a back bone.
> I want to use my accounts for anything other than debit purchases, I need to use the app.
No, you don't. Use a bank that has a normal web site.
> Some jobs require you to install and use apps on your phone.
Yikes ... never install work apps on a personal phone. Just don't.
> Even just applying for a job requires an internet browser, and many people's only access to the internet is through their phone.
So people need phones because people use phones? What nonsense.
Do these types of iMessage attachment exploits require the victim to do anything on their end? Downloading the attachment? Opening the message ? That part is unclear to me
No, most are zero-click silent exploits. They own your phone persistently then delete the incoming message that pwned you.
Literally worth millions of dollars on the wholesome greymarkets these days, possibly the most prized, just in case anyone was wondering.
Earlier quoted context omitted.
No, most are zero-click silent exploits. They own your phone persistently then delete the incoming message that pwned you.
Are other messaging apps on iOS ever getting RCE exploits like this? Can’t they sandbox iMessage so this isn’t possible no matter how many bugs the app has?
Considering how tightly integrated iMessage is with iOS, it doesn't seem likely that it will really be fixed in an easy manner.
I really hope the blur on the picture ( https://citizenlab.ca/wp-content/uploads/2021/10/Hubbard-Ima... ) isn't hiding anything actually important because that can almost certainly be de-blurred with the right tooling.
man why do people even take the gamble of using a blur just use a opaque box
Earlier quoted context omitted.
Really? Seems blurred enough to me that even some sort of ML would spit out wrong characters.
Most of the time, blurring is down with a Gaussian blur and this is, in theory, reversible. In practice what is actually done is round_to_fraction_over_256(gaussian_blur(point, image, …)) so there is an error in the unblurring process. But this error is often not insurmountable, especially with extra information.
If you assume the photo was made with one of the consumer applications, there are only so many popular bluring algorithms. You can brute force it quite easily by testing each character and each type of blur until you get exact match (and in many cases even inexact will suffice).
Earlier quoted context omitted.
Really? Seems blurred enough to me that even some sort of ML would spit out wrong characters.
Known font, known range of possible characters (almost certainly ascii), and probably several blurred characters in there that we know (like the t in attachment). If the blur is differentiable per-character, it's probably reversible.