Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS 18.6.1 0-click RCE POC

github.com

Post reply on HN
Print view View original

41–50 of 61 posts

Re: iOS 18.6.1 0-click RCE POC

#41

Post by byearthithatius »

MajesticHobo2 wrote: post #36
byearthithatius wrote: post #35

Earlier quoted context omitted.

Thanks immensely. Very important detail, Did you find a 02 at 3E40B? I found 01 at 2FD00, but there was no 3E40B byte position entry. I did find something similar at 00003e40: 00003e40 02 00 04 00 0a 00 00 00 30 01 00 00 00 00 00 00 |........0.......|

Yes: dd status=none if=IMGP0847.DNG bs=1 skip=0x3e40b count=1 | xxd 00000000: 02

Thanks! You are correct, when I did a dump with `xxd IMGP0847.DNG > output.hex` it wasn't showing up for some reason.... But your command worked (though my dd doesn't like hex values so I needed to get decimal via printf "%d\n" 0x3E40B).

Curious if you (clearly smarter than me) know why it didn't show correctly in the xxd or hexdump for the file. Would love to learn.

Re: iOS 18.6.1 0-click RCE POC

#42

Post by pjmlp »

tptacek wrote: post #24
fmajid wrote: post #21

It's 2025, and Apple clearly still hasn't incorporated fuzzers in their CI and QA. Perhaps I am giving them too much credit in assuming they have any QA in the first place.

I have no idea what you're talking about; Apple has one of the largest and most sophisticated software security practices on the planet.

They do, but unfortunately it is built on top of a shacky foundation.

Re: iOS 18.6.1 0-click RCE POC

#44

Post by kaladin-jasnah »

muricula wrote: post #26
user214412412 wrote: post #25

is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?

Look up iMessage's "blastdoor" sandbox: https://support.apple.com/guide/security/blastdoor-for-messa...

FORCEDENTRY bypassed this sandbox IIRC. That was a bug in the JBIG2 decoder.

Re: iOS 18.6.1 0-click RCE POC

#45

Post by steve1977 »

ladyanita22 wrote: post #43
user214412412 wrote: post #25

is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?

For some reason, Apple seems reluctant about using Rust on their operating systems.

That reason is probably called Swift. But they obviously still have many many system libraries written in Objective-C, plain C or C++.

I don't see them using Rust when they have their own language under their full control, especially since both are targeting LLVM anyway.

Re: iOS 18.6.1 0-click RCE POC

#47

Post by GoblinSlayer »

user214412412 wrote: post #25

is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?

Also image formats are fairly stable, so they are a good candidate for a verified F* parser. Not sure how easy it is for pdf, maybe start with a reasonable subset of it.

Re: iOS 18.6.1 0-click RCE POC

#48

Post by Hilift »

user214412412 wrote: post #25

is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?

Apple should formalize the iMessage de facto DeviceAndAccountTakeover() API call. I lost count how many zero-click it has. Tim Apple can take the privacy high road all day but it doesn't matter if the code is rotten.

https://citizenlab.ca/2025/06/first-forensic-confirmation-of...

https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...

https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage...

https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hac...

Re: iOS 18.6.1 0-click RCE POC

#49

Post by saagarjha »

transpute wrote: post #18

For iOS defense, enable Lockdown Mode and reboot daily to evict non-persistent malware, https://www.youtube.com/watch?v=fAhTPMmvrB0 > For me, there is only lockdown mode. That is the Apple Experience. iOS backups can be scanned for the presence of this CVE-2025-43300 DNG processing vulnerability, via OSS tool for iOS forensics, https://github.com/msuiche/elegant-bouncer | https://www.msuiche.com/posts/elegantbouncer-…

Assuming someone hasn't removed it from the filesystem
Post reply on HN