Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A new CSS-based web attack will crash and restart your iPhone

techcrunch.com

Post reply on HN
Print view View original

111–120 of 140 posts

Re: A new CSS-based web attack will crash and restart your iPhone

#111

Post by burlesona »

rangibaby wrote: post #68
endless1234 wrote: post #18

Earlier quoted context omitted.

It's because of the nested backdrop-filters being applied. I would've thought the css parser / rendering engine stops this from happening, but apparently not.

I guess it is because backdrop-filter is a new property. AFAIK backdrop-filter affects everything everything below it, so maybe a sanity check for the number of times the effect applies is missing.

Yeah it looks like its trying to compute thousands of filters stacked on top of each other. Photoshop would take a while to do that too. But safari shouldn’t be able to out of memory so hard it takes down the device.

Re: A new CSS-based web attack will crash and restart your iPhone

#112

Post by squaredpants »

matthberg wrote: post #3

The tweet announcing it: https://twitter.com/pwnsdx/status/1040944750973595649 The code that causes the crash (safe to open): https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33... The demo itself (causes crash): https://cdn.rawgit.com/pwnsdx/ce64de2760996a6c432f06d612e33a...

Works on iPhone SE w/ iOS 12 latest public beta.

Re: A new CSS-based web attack will crash and restart your iPhone

#113

Post by wepple »

novaRom wrote: post #51

I've stopped accepting iOS/OSX seriously after those iCloud celebs leaks and especially after 'empty string' root prompt bug. How anyone can still trust this black box concept.

> How anyone can still trust this black box concept

Its truly awesome that you audited the whole Linux kernel and everything on top of it you run, mind sharing your notes?

Re: A new CSS-based web attack will crash and restart your iPhone

#114

Post by mcintyre1994 »

qrbLPHiKpiux wrote: post #59
novaRom wrote: post #51

I've stopped accepting iOS/OSX seriously after those iCloud celebs leaks and especially after 'empty string' root prompt bug. How anyone can still trust this black box concept.

Weren't those phishing compromises?

Root and empty password was a macOS issue: https://twitter.com/lemiorhan/status/935578694541770752

Re: A new CSS-based web attack will crash and restart your iPhone

#115

Post by [deleted] »

tannhaeuser wrote: post #25
joering2 wrote: post #22

Earlier quoted context omitted.

DO NOT CLICK THE LINK! Hour later I am still unable to restart my phone. It hangs on logo!! This may be a permanent fuck ;( unsure exact version but I have iOS 7 that hasnt been updated in about six months.

Seems like on restart Safari wants to revisit previously opened pages and crashes again ad infinitum. Isn't there a way to cold-restart iOS devices or some such (like the magic "Zap NVRAM and repair permissions" procedure back in PowerMac times)?

[deleted]

Re: A new CSS-based web attack will crash and restart your iPhone

#117

Post by wlesieutre »

anderskaseorg wrote: post #35
wlesieutre wrote: post #9

Earlier quoted context omitted.

Because web browsers are trying to sandbox executable code from untrusted (and frequently malicious) sources, I would guess. WebKit/Nitro are trusted to keep that executable memory under very tight control, and if they're crashing they may have failed to. IIRC it has special privileges that allow it to run a JIT javascript engine.

It remains disturbing to read that something needs to be privileged just so it can sandbox unprivileged code. Why should I have to choose between trusting the sandbox and trusting the code that runs inside it? Why do we keep collectively forgetting the lesson that the more useful a sandboxing technology becomes, the more likely it becomes that someone will need to run that sandbox inside another sandbox (or inside an…

It's not privileged in that it can sandbox unprivileged code, it's privileged in that it can run that code at all. Other processes are not allowed to execute writeable memory.

MobileSafari has a special "dynamic-codesigning" sandbox entitlement that allows the JIT to function.

Re: A new CSS-based web attack will crash and restart your iPhone

#118

Post by Reedx »

matthberg wrote: post #3

The tweet announcing it: https://twitter.com/pwnsdx/status/1040944750973595649 The code that causes the crash (safe to open): https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33... The demo itself (causes crash): https://cdn.rawgit.com/pwnsdx/ce64de2760996a6c432f06d612e33a...

Interesting, it's simply a few thousand nested divs with a huge blur on them. Is it something specific about blur? Or could you do the same thing with box-shadows, etc, if there are enough of them?

Re: A new CSS-based web attack will crash and restart your iPhone

#119

Post by pcwalton »

Reedx wrote: post #118
matthberg wrote: post #3

The tweet announcing it: https://twitter.com/pwnsdx/status/1040944750973595649 The code that causes the crash (safe to open): https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33... The demo itself (causes crash): https://cdn.rawgit.com/pwnsdx/ce64de2760996a6c432f06d612e33a...

Interesting, it's simply a few thousand nested divs with a huge blur on them. Is it something specific about blur? Or could you do the same thing with box-shadows, etc, if there are enough of them?

-webkit-backdrop-filter forces layerization (i.e. it promotes whatever box it's in to a Core Animation layer), while box shadows don't. This resource exhaustion bug is specific to CA layers, so you wouldn't see this with box shadows.
Post reply on HN