I have always wondered why Safari crashes can reboot the entire telephone. Doesn't iOS have multiple protection rings or is Safari running at ring 0? Or is it a precaution that inhibits jailbreak research?
It also crashes chrome on iphone.
A new CSS-based web attack will crash and restart your iPhone
11–20 of 140 posts
Re: A new CSS-based web attack will crash and restart your iPhone
#12I have always wondered why Safari crashes can reboot the entire telephone. Doesn't iOS have multiple protection rings or is Safari running at ring 0? Or is it a precaution that inhibits jailbreak research?
It also crashes chrome on iphone.
The underlying browser for chrome on iOS is still safari. The same is true for every other browser.
Re: A new CSS-based web attack will crash and restart your iPhone
#13From the twitter thread
- This is a full kernel panic; I wonder if it's exploitable (...probably not)
- Someone's iPhone didn't ask for their PIN on reboot?
- It apparently crashes watchOS 5 too
Re: A new CSS-based web attack will crash and restart your iPhone
#14Re: A new CSS-based web attack will crash and restart your iPhone
#15I have always wondered why Safari crashes can reboot the entire telephone. Doesn't iOS have multiple protection rings or is Safari running at ring 0? Or is it a precaution that inhibits jailbreak research?
It's prudent to reboot when a privileged component crashes, since the integrity of the code execution has been compromised. A lot of the time a DoS bug in native code is synonymous with "nobody bothered to craft a RCE". It's unintuitive to many people how many scenarios eventually allow a RCE exploit to be crafted. Check out some null pointer deref RCE's to convince yourself.
The author said in the twitter thread that this a kernel panic.
Re: A new CSS-based web attack will crash and restart your iPhone
#16Earlier quoted context omitted.
It's prudent to reboot when a privileged component crashes, since the integrity of the code execution has been compromised. A lot of the time a DoS bug in native code is synonymous with "nobody bothered to craft a RCE". It's unintuitive to many people how many scenarios eventually allow a RCE exploit to be crafted. Check out some null pointer deref RCE's to convince yourself.
But why is Safari a privileged component?
Because it JITs Javascript code. That code comes in as data. So it has the power to override W^X.
Re: A new CSS-based web attack will crash and restart your iPhone
#17The tweet announcing it: https://twitter.com/pwnsdx/status/1040944750973595649 The code that causes the crash (safe to open): https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33... The demo itself (causes crash): https://cdn.rawgit.com/pwnsdx/ce64de2760996a6c432f06d612e33a...
It works!
More details from the Twitter thread: it's iOS 7 and up, and it also works on watchOS 5. In some apps like chrome or opera it isn't a full crash, just a "springboard crash".
Re: A new CSS-based web attack will crash and restart your iPhone
#18This is basically 3,485 nested s (balanced; same number of s) with width and height both set to 10,000px. I have no idea is this is an internal DOM overflow or it's because of the tiled background-image. (I don't have an iPhone to test against.) EDIT: I actually read the article properly :) all 3,485 the have a 10px backdrop-filter set on them. > He explained that nesting a ton of elements — such as tags — inside a b…
It's because of the nested backdrop-filters being applied. I would've thought the css parser / rendering engine stops this from happening, but apparently not.
Re: A new CSS-based web attack will crash and restart your iPhone
#19It also gets my Macbook Pro in an unresponsive state (using Safari).
Re: A new CSS-based web attack will crash and restart your iPhone
#20From the twitter thread - This is a full kernel panic; I wonder if it's exploitable (...probably not) - Someone's iPhone didn't ask for their PIN on reboot? - It apparently crashes watchOS 5 too
> Someone's iPhone didn't ask for their PIN on reboot?
That's because the iPhone didn't reboot fully. This doesn't deterministically cause a panic, sometimes it just takes down parts of the system.