A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

Post by octoberfranklin » Thu, Dec 16, 2021, 11:41 AM UTC

drorco wrote: post #142

ivraatiems wrote: post #20

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.

I think you could also say the same about gambling, porn and other questionable industries. The thing is, it's usually much easier making money off these things then making money from solving impactful problems. If you're a regular joe and you could spend your next 5 years with a 100% chance of making millions for finding exploits, or a 0.01% chance of solving P=NP, I think the irrational decision would be picking th…

Post by user-the-name » Thu, Dec 16, 2021, 11:57 AM UTC

dylan604 wrote: post #249

joe_guy wrote: post #237

Earlier quoted context omitted.

To be clear, what this exploits is nothing like what you've mentioned. The article does a very good job of describing the relevant parts of the image format. They built a VM inside of an images single pass decompression route. I'd highly recommend reading the article. This is just one of the exploits in a very large chain. To quote some of the nations top security researchers: > Based on our research and findings, we…

I'm thinking you're missing the larger idea. The whole point is that while these "geniuses" did something really "impressive" and difficult, there are just as really not-impressive and not-difficult things found in the wild that have caused problems as well.

Post by mcculley » Thu, Dec 16, 2021, 12:52 PM UTC

onphonenow wrote: post #242

tmsbrg wrote: post #172

Earlier quoted context omitted.

I think what he means with historically is before ASLR, DEP, and other mitigations, where a buffer overflow meant you can simply overwrite the return pointer at ESP, jump to the stack and run any shellcode. Mitigations have made exploitation much, much more complex nowadays. See for example https://github.com/stong/how-to-exploit-a-double-free

Exactly. This escape is technically quite cool frankly in terms of some creativity. That said, my own view is that messages from untrusted contacts should be straight ascii, parsed in a memory safe language with no further features until you interact (ie, write back etc).

Post by follower » Thu, Dec 16, 2021, 2:30 PM UTC

jeffbee wrote: post #295

_vvhw wrote: post #292

"And just because the source filename has to end in .gif, that doesn't mean it's really a GIF file. The ImageIO library, as detailed in a previous Project Zero blogpost, is used to guess the correct format of the source file and parse it, completely ignoring the file extension. Using this "fake gif" trick, over 20 image codecs are suddenly part of the iMessage zero-click attack surface, including some very obscure an…

The "major email" people are pretty much the only people funding practical technology of the kind you just whined about. https://github.com/google/wuffs

Post by [deleted] » Thu, Dec 16, 2021, 2:43 PM UTC

jeffbee wrote: post #295

_vvhw wrote: post #292

"And just because the source filename has to end in .gif, that doesn't mean it's really a GIF file. The ImageIO library, as detailed in a previous Project Zero blogpost, is used to guess the correct format of the source file and parse it, completely ignoring the file extension. Using this "fake gif" trick, over 20 image codecs are suddenly part of the iMessage zero-click attack surface, including some very obscure an…

The "major email" people are pretty much the only people funding practical technology of the kind you just whined about. https://github.com/google/wuffs