It's 2025, and Apple clearly still hasn't incorporated fuzzers in their CI and QA. Perhaps I am giving them too much credit in assuming they have any QA in the first place.
iOS 18.6.1 0-click RCE POC
21–30 of 61 posts
Re: iOS 18.6.1 0-click RCE POC
#22How do people even find these types of bugs? Is it just years and years experience allowing you to know where to look?
Experience /n
Fuzzing (when you try a bunch of stuff automatically) /n
Reverse engineering the code (using tools like ghidra or hopper)
Re: iOS 18.6.1 0-click RCE POC
#23Does this affect any of the iOS, iPadOS macOS, tvOS, watchOS 26 Beta?
Apple patched it on August 20, so presumably any release from after this date is not vulnerable.
Re: iOS 18.6.1 0-click RCE POC
#24It's 2025, and Apple clearly still hasn't incorporated fuzzers in their CI and QA. Perhaps I am giving them too much credit in assuming they have any QA in the first place.
I have no idea what you're talking about; Apple has one of the largest and most sophisticated software security practices on the planet.
Re: iOS 18.6.1 0-click RCE POC
#25is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?
Re: iOS 18.6.1 0-click RCE POC
#26is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?
Look up iMessage's "blastdoor" sandbox:
https://support.apple.com/guide/security/blastdoor-for-messa...
Re: iOS 18.6.1 0-click RCE POC
#27is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?
unfortunately sandboxes also have bugs which allows for RCE. this is typically called a "full chain" because it chains together a series of bugs (initial decoder exploit + sandbox escape exploit) to gain full RCE
Re: iOS 18.6.1 0-click RCE POC
#28I AirDropped the PoC to my vulnerable iPhone. It didn't cause a crash until I tried to edit it in the Photos app.
Maybe you need to iMessage it to someone else? Just guessing.
Re: iOS 18.6.1 0-click RCE POC
#29How do people even find these types of bugs? Is it just years and years experience allowing you to know where to look?
Lots of experience in what are common exploit tactics are and where to look and test if things will break.
Identifying an exploit in iOS requires a significant amount of knowledge in how the OS works, what existing exploits are and how you could chain them together to create a larger exploit.
I've have very limited experience, but reading about how some people identify and exploit these things is extremely impressive.
Re: iOS 18.6.1 0-click RCE POC
#30How do people even find these types of bugs? Is it just years and years experience allowing you to know where to look?
Fuzzing is one approach.
"Fuzzing ImageIO" (2020), https://googleprojectzero.blogspot.com/2020/04/fuzzing-image...
> This blog post discusses an old type of issue, vulnerabilities in image format parsers, in a new(er) context: on interactionless code paths in popular messenger apps. This research was focused on the Apple ecosystem and the image parsing API provided by it: the ImageIO framework. Multiple vulnerabilities in image parsing code were found, reported to Apple or the respective open source image library maintainers, and subsequently fixed. During this research, a lightweight and low-overhead guided fuzzing approach for closed source binaries was implemented and is released alongside this blogpost.
"ImageIO, the infamous iOS Zero Click Attack Vector" (2024), https://r00tkitsmm.github.io/fuzzing/2024/03/29/iOSImageIO.h...
> I used LLDB to examine the testHeader functions, it turned out there are three new testHeader functions for different file formats, such as KTX2 and WebP and ETC, so because they were fairly new I thought maybe they have not been fuzzed by Project Zero... I ported Project Zero’s harness to Jackalope fuzzer.. My fuzzing effort found several vulnerabilities [fixed by Apple]..