Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple iMessage Zero-Click Hacks

wired.com

Post reply on HN
Print view View original

101–110 of 156 posts

Re: Apple iMessage Zero-Click Hacks

#101

Post by p49k »

hirako2000 wrote: post #79
lpghatguy wrote: post #73

Earlier quoted context omitted.

Okay then, let me just go close my bank account then. It's just a convenience. :P

It is a convenience difficult to live without I can give you that. But so many other services we can't imagine living without require a cellular number. Accepting a flawed authentication mechanism and legal but abusive privacy breaches is what have kept them up and running. This threat demonstrates how difficult it is to keep us safe from hacks. We can keep our bank account and one day have to deal with fraud recover…

Banks can and do rollback fraud and theft in most cases; that’s the advantage of working in a system supported by law and regulation. The alternative is trusting that every component in your crypto tech stack has perfect security (which is impossible) or else risk losing all your money in a manner that can’t be reversed. I’ll choose banks, thanks.

Re: Apple iMessage Zero-Click Hacks

#102

Post by fuj »

kylehotchkiss wrote: post #4

A small way to reduce attack surface - have iMessage just setup for your iCloud email address instead of phone number. Phone numbers are becoming increasingly useless. > In fact, Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely. There's a checkbox in Settings > Messages that does exactly this? It seems strange they published this.

> Phone numbers are becoming increasingly useless.

What living in a bubble looks like...

Re: Apple iMessage Zero-Click Hacks

#103

Post by CyberRage »

saagarjha wrote: post #100
CyberRage wrote: post #97

Earlier quoted context omitted.

I think you misunderstand how things work on modern mobile OS. You don't need to access the messages app in order to get access to the messages. it's the opposite actually, the messaging app needs permissions for the system level messaging component.

I assure you that I know enough to at least hold an intelligent conversation on mobile security. On iOS there is no "system level messaging component". (i)Messages are stored in a SQLite database that is protected via entitlements and sandboxing; the Messages app is given the ability to access it legitimately. Attackers can either exploit the Messages itself and (via code execution in that process) grab a user's mess…

Again, if you get a kernel exploit, you don't need access to the messaging app or to escalate privileges.

you're already root.

you can access any component without much restriction.

How the data is stored has nothing to do with this

Re: Apple iMessage Zero-Click Hacks

#104

Post by saagarjha »

CyberRage wrote: post #103
saagarjha wrote: post #100

Earlier quoted context omitted.

I assure you that I know enough to at least hold an intelligent conversation on mobile security. On iOS there is no "system level messaging component". (i)Messages are stored in a SQLite database that is protected via entitlements and sandboxing; the Messages app is given the ability to access it legitimately. Attackers can either exploit the Messages itself and (via code execution in that process) grab a user's mess…

Again, if you get a kernel exploit, you don't need access to the messaging app or to escalate privileges. you're already root. you can access any component without much restriction. How the data is stored has nothing to do with this

This is correct. My point is that you would want to access messages data after doing that.

Re: Apple iMessage Zero-Click Hacks

#105

Post by yokoprime »

ec109685 wrote: post #86

Why aren’t lightweight hypervisors used more outside the public cloud? It seems that would go a long way in protecting the rest of the device from poorly written c code parsing user input.

On device? The vast majority of people don't give a flying fuck about privacy, for them the decrease in battery life would not be worth it

Re: Apple iMessage Zero-Click Hacks

#106

Post by bb123 »

johnthuss wrote: post #83

Contrary to the article, blocking ALL media besides plain text from random senders who aren't in your contacts is exactly what most people would want and should be the default. I don't see any downsides to that approach.

I wouldn't want this at all. Just off the top of my head I can think of a ton of use cases this makes hard:

* I ask a seller on FB marketplace to send me some pictures of an item

* I need to send pictures of some documents to my solicitor

* A new friend I've just met in a bar tries to send me her contact card

* My mechanic tries to send me a PDF of the invoice for his work

Sure, there are ways around all of these, but it makes iMessage (or any messaging service) a lot less useful.

Re: Apple iMessage Zero-Click Hacks

#107

Post by tofukid »

mrweasel wrote: post #90
kylehotchkiss wrote: post #4

A small way to reduce attack surface - have iMessage just setup for your iCloud email address instead of phone number. Phone numbers are becoming increasingly useless. > In fact, Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely. There's a checkbox in Settings > Messages that does exactly this? It seems strange they published this.

> Phone numbers are becoming increasingly useless. Not really, there's a ton of government services that require you to have a phone number (depending on where you live). I don't see any real suggestion for an alternative to having a phone number. If nothing else, to receiving notification. You can't really rely on iMessage, WhatsApp, Signal and similar services, you need one system that you're sure will cover 98% fo…

I use voip.ms and have SMS forwarded to my email. I can also reply via email. I only use a phone number for services that require one. Family and friends I will use email, iMessage, or Signal.

Re: Apple iMessage Zero-Click Hacks

#108

Post by CyberRage »

saagarjha wrote: post #104
CyberRage wrote: post #103

Earlier quoted context omitted.

Again, if you get a kernel exploit, you don't need access to the messaging app or to escalate privileges. you're already root. you can access any component without much restriction. How the data is stored has nothing to do with this

This is correct. My point is that you would want to access messages data after doing that.

So let's circle back to the original question.

Pwning the app will only provide access to whatever permission it has and we are still sandboxed.

Pwning a kernel module\driver will provide access to everything whether its messaging, call logs, pictures etc. we are not sandboxed, we don't need an LPE exploit.

I think the priority is clear.

Re: Apple iMessage Zero-Click Hacks

#109

Post by dannyw »

bb123 wrote: post #106
johnthuss wrote: post #83

Contrary to the article, blocking ALL media besides plain text from random senders who aren't in your contacts is exactly what most people would want and should be the default. I don't see any downsides to that approach.

I wouldn't want this at all. Just off the top of my head I can think of a ton of use cases this makes hard: * I ask a seller on FB marketplace to send me some pictures of an item * I need to send pictures of some documents to my solicitor * A new friend I've just met in a bar tries to send me her contact card * My mechanic tries to send me a PDF of the invoice for his work Sure, there are ways around all of these, bu…

All of this can be on a "Tap to view" basis for the first media received.

Right now, iMessage processes everything in the background upon receiving.

That enables zero click, instantly delete message attacks. The only trace you have is a random imessage sound, or vibrate, with no corresponding notification.

Can be tuned to send at 4am when most people have do not disturb on.

Re: Apple iMessage Zero-Click Hacks

#110

Post by dannyw »

eloisius wrote: post #88

I got corrected last time this topic came up. I originally thought Messages was part of the OS and not a pre-installed userspace app. However, if it's in userspace, why is it such a vulnerable vector for compromising the phone? Is there some privilege-escalation component to this that I haven't read about?

iMessage is one of few apps that have broad permissions to execute code in response to notifications.

For other apps like Telegram; the server can send a predefined notification message.

For iMessage, when you get something even from someone outside your contacts, its daemon invokes specific code to handle the message, and its attachments.

Whilst this doesn't help if someone opens the app, it does at least change this from a zero click attack, to a one click attack.

(This is also another example of Apple not following its own app store rules. It has privileged access to frameworks.)

Post reply on HN