Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple iMessage Zero-Click Hacks

wired.com

Post reply on HN
Print view View original

121–130 of 156 posts

Re: Apple iMessage Zero-Click Hacks

#121

Post by KaiserPro »

CyberRage wrote: post #21
SalimoS wrote: post #16

Wouldn’t be not parsing incoming media unless it’s for someone from contact is a first step that can reduce largely the thread ? So it will stay the same for people in your contact list but a new touch to load for message from unknown person

That might sound good in theory by in practice it's unlikely to go well(by default). Many services from banks to healthcare utilize SMS as a main way of communicating with end-users. many rely on dynamic numbers. Moreover, spoofing SMS messages is not that hard. Messaging apps whether it is SMS or alternatives like whatsapp, telegram etc. will always offer a powerful vector to infect devices.

you have made an argument against _never_ parsing media from untrusted _SMSs_

This is iMessage, and instead of _never_ parsing, requiring user action to parse. It will cut out the majority of the noclick exploits, and make iphones safer for most people.

This of course doesn't protect against spear phishing. But it should give apple time to fix their shit.

Re: Apple iMessage Zero-Click Hacks

#122

Post by KaiserPro »

dannyw wrote: post #112
yokoprime wrote: post #105

Earlier quoted context omitted.

On device? The vast majority of people don't give a flying fuck about privacy, for them the decrease in battery life would not be worth it

so we should get rid of all security features then? No memory management, no code signing, no HTTPS, no certificate pinning? Vierualisation has a negligible impact on power consumption.

> Vierualisation has a negligible impact on power consumption.

[citation needed] Virtualization on embedded devices with constrained power is a big ask. They are not asking to get rid of all security protections, just pointing out that loosing 10-20% of battery life for marginal security improvement isn't a product winner.

Re: Apple iMessage Zero-Click Hacks

#123

Post by eloisius »

dannyw wrote: post #116
eloisius wrote: post #114

Earlier quoted context omitted.

So, in theory other messaging apps have the same vulnerabilities, but I’d have to open the message to get burnt?

Yes. These apps also have happened to WhatsApp.

Still hard to understand. If it’s just image preview code, why isn’t Safari vulnerable?

Re: Apple iMessage Zero-Click Hacks

#125

Post by harg »

est31 wrote: post #27
SalimoS wrote: post #16

Wouldn’t be not parsing incoming media unless it’s for someone from contact is a first step that can reduce largely the thread ? So it will stay the same for people in your contact list but a new touch to load for message from unknown person

https://en.wikipedia.org/wiki/Dancing_pigs

For the general population this probably applies, but in the case of this exploit it looks like it's targeted at specific individuals. If you were someone being targeted by an oppressive government, for example, you might be a bit more cautious when clicking on suspicious-looking incoming media so I think the suggestion has value.

Re: Apple iMessage Zero-Click Hacks

#126

Post by mrweasel »

tofukid wrote: post #107
mrweasel wrote: post #90

Earlier quoted context omitted.

> Phone numbers are becoming increasingly useless. Not really, there's a ton of government services that require you to have a phone number (depending on where you live). I don't see any real suggestion for an alternative to having a phone number. If nothing else, to receiving notification. You can't really rely on iMessage, WhatsApp, Signal and similar services, you need one system that you're sure will cover 98% fo…

I use voip.ms and have SMS forwarded to my email. I can also reply via email. I only use a phone number for services that require one. Family and friends I will use email, iMessage, or Signal.

So you do still have a phone number, just not a SIM.

Re: Apple iMessage Zero-Click Hacks

#127

Post by mavhc »

BiteCode_dev wrote: post #99
kylehotchkiss wrote: post #4

A small way to reduce attack surface - have iMessage just setup for your iCloud email address instead of phone number. Phone numbers are becoming increasingly useless. > In fact, Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely. There's a checkbox in Settings > Messages that does exactly this? It seems strange they published this.

Nope, when I'm on the go, I certainly have a way better communication using phone calls than whatever VOIP du jour. Phone numbers, like emails, are very robust and reliable, interoperable, not centralized to one entity, and the quality of service vs cost ratio is excellent. Not to mention text messages: - they work no matter if the person is using whatsapp, telegram, signal or the new hype stuff - no GAFAM is collect…

Email and SMS aren't reliable, you've no way to know if they've been read.

SMS is unencrypted so someone's harvesting your data.

They require a cell tower connection, that's only 1 step away from an internet connection, probably 0 in many cases.

Cash and Phone numbers are trivial to steal.

Re: Apple iMessage Zero-Click Hacks

#128

Post by saagarjha »

eloisius wrote: post #123
dannyw wrote: post #116

Earlier quoted context omitted.

Yes. These apps also have happened to WhatsApp.

Still hard to understand. If it’s just image preview code, why isn’t Safari vulnerable?

It might be, it’s just that using Safari would turn a zero-click attack into a one-click one (click on my shady link). (Also, WebKit runs with a different sandbox that may require special effort to escape out of.)

Re: Apple iMessage Zero-Click Hacks

#129

Post by saagarjha »

dannyw wrote: post #110
eloisius wrote: post #88

I got corrected last time this topic came up. I originally thought Messages was part of the OS and not a pre-installed userspace app. However, if it's in userspace, why is it such a vulnerable vector for compromising the phone? Is there some privilege-escalation component to this that I haven't read about?

iMessage is one of few apps that have broad permissions to execute code in response to notifications. For other apps like Telegram; the server can send a predefined notification message. For iMessage, when you get something even from someone outside your contacts, its daemon invokes specific code to handle the message, and its attachments. Whilst this doesn't help if someone opens the app, it does at least change thi…

This is not true. With the right setup, you can send a push notification to your app to wake it up and execute code. See this delegate method for example: https://developer.apple.com/documentation/uikit/uiapplicatio....

Re: Apple iMessage Zero-Click Hacks

#130

Post by saagarjha »

hypothesis wrote: post #54
gjsman-1000 wrote: post #8

Earlier quoted context omitted.

There was a developer who discovered a bug with the XML parser, and wrote a whole blog post about how he was able to cause iOS's security system to malfunction using a specially-crafted XML permissions file and allow his app to do anything he wanted, even escape the sandbox. He kept it secret for years for his private experimentation until Apple patched it by accident, by adding a 5th XML parser to the other 4 for so…

Are there seriously 5 XML parsers available in iOS? Are they all written in C? Do they validate all of them whenever a bug is found in one? I can’t tell if this is some sort of defense in depth or just swiss cheese copy-paste…

Yes, no (some are C++), lol no, no to both: it’s more that people just kept adding more for each domain
Post reply on HN