Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS 18.6.1 0-click RCE POC

github.com

Post reply on HN
Print view View original

51–60 of 61 posts

Re: iOS 18.6.1 0-click RCE POC

#51

Post by mschuster91 »

GoblinSlayer wrote: post #47
user214412412 wrote: post #25

is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?

Also image formats are fairly stable, so they are a good candidate for a verified F* parser. Not sure how easy it is for pdf, maybe start with a reasonable subset of it.

Good luck doing that for stuff like PDF which can include JavaScript in the PDF file itself, or SVG+PDF which both can include raw font files, another reliable source of exploits.

Re: iOS 18.6.1 0-click RCE POC

#52

Post by Wowfunhappy »

mschuster91 wrote: post #51
GoblinSlayer wrote: post #47

Earlier quoted context omitted.

Also image formats are fairly stable, so they are a good candidate for a verified F* parser. Not sure how easy it is for pdf, maybe start with a reasonable subset of it.

Good luck doing that for stuff like PDF which can include JavaScript in the PDF file itself, or SVG+PDF which both can include raw font files, another reliable source of exploits.

Do any PDF readers other than Adobe's support JS? Apple's certainly does not, unless something has changed recently.

Re: iOS 18.6.1 0-click RCE POC

#53

Post by kingforaday »

Alifatisk wrote: post #4

I wonder how much this would be worth for Zerodium

I know the thread is saying $0 because Zerodium doesn't exist anymore, but there are others. This [0] one for a full chain mobile iOS is at $15M. I agree with tptacek though, the airdrop would reduce the value but you may still be in the low 7 figure range for 0 click RCE.

0. https://advance-sec.com/#bounty

Re: iOS 18.6.1 0-click RCE POC

#54

Post by ThePowerOfFuet »

transpute wrote: post #18

For iOS defense, enable Lockdown Mode and reboot daily to evict non-persistent malware, https://www.youtube.com/watch?v=fAhTPMmvrB0 > For me, there is only lockdown mode. That is the Apple Experience. iOS backups can be scanned for the presence of this CVE-2025-43300 DNG processing vulnerability, via OSS tool for iOS forensics, https://github.com/msuiche/elegant-bouncer | https://www.msuiche.com/posts/elegantbouncer-…

>For iOS defense, enable Lockdown Mode and reboot daily to evict non-persistent malware

For non-iOS defense, run GrapheneOS with all the default safeguards enabled.

Re: iOS 18.6.1 0-click RCE POC

#55

Post by notepad0x90 »

transpute wrote: post #40
notepad0x90 wrote: post #38

Earlier quoted context omitted.

I would think mvt and related ioc repos would support these newer indicators,but sadly I'm not seeing that: https://docs.mvt.re/en/latest/iocs/

It's a different approach: Traditional detection approaches like YARA rules, IOC matching, and signature-based systems fall apart when: • You don’t have the actual malicious samples to create signatures from • The attackers use polymorphic techniques that change file hashes • The exploit leverages legitimate file format features in unexpected ways • You need to detect future variants of the same technique The Philoso…

I'm just thinking, I'd always prefer to run one tool to verify if a phone has been compromised. If mvt used ELEGANTBOUNCER as a plugin/extension/backend that'd be superb. But, not a big deal, I'm glad I found about this tool, thank you.

I am interested in finding out more on why Yara can't be used to find structural patterns? it is supposed to do a lot more than simple string and byte-pattern matching. Maybe ELEGANTBOUNCER requires keeping/maintaining a complex state machine to evaluate/analyze content?

Re: iOS 18.6.1 0-click RCE POC

#56

Post by MajesticHobo2 »

byearthithatius wrote: post #41
MajesticHobo2 wrote: post #36

Earlier quoted context omitted.

Yes: dd status=none if=IMGP0847.DNG bs=1 skip=0x3e40b count=1 | xxd 00000000: 02

Thanks! You are correct, when I did a dump with `xxd IMGP0847.DNG > output.hex` it wasn't showing up for some reason.... But your command worked (though my dd doesn't like hex values so I needed to get decimal via printf "%d\n" 0x3E40B). Curious if you (clearly smarter than me) know why it didn't show correctly in the xxd or hexdump for the file. Would love to learn.

  xxd IMGP0847.DNG | grep 03e400:
  0003e400: ffd8 ffc3 000e 0e10 800c 5002 0011 0001  ..........P.....
Look at the byte at offset 11 (0xb), it's there.

Re: iOS 18.6.1 0-click RCE POC

#58

Post by [deleted] »

Hilift wrote: post #48
user214412412 wrote: post #25

is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?

Apple should formalize the iMessage de facto DeviceAndAccountTakeover() API call. I lost count how many zero-click it has. Tim Apple can take the privacy high road all day but it doesn't matter if the code is rotten. https://citizenlab.ca/2025/06/first-forensic-confirmation-of... https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer... https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage... https://cit…

[deleted]

Re: iOS 18.6.1 0-click RCE POC

#59

Post by byearthithatius »

MajesticHobo2 wrote: post #56
byearthithatius wrote: post #41

Earlier quoted context omitted.

Thanks! You are correct, when I did a dump with `xxd IMGP0847.DNG > output.hex` it wasn't showing up for some reason.... But your command worked (though my dd doesn't like hex values so I needed to get decimal via printf "%d\n" 0x3E40B). Curious if you (clearly smarter than me) know why it didn't show correctly in the xxd or hexdump for the file. Would love to learn.

xxd IMGP0847.DNG | grep 03e400: 0003e400: ffd8 ffc3 000e 0e10 800c 5002 0011 0001 ..........P..... Look at the byte at offset 11 (0xb), it's there.

Ohhh the b offset (11) is an offset _on that line_ (0003e400)! I got it now:D This thread taught me a great deal. Thank you, MajesticHobo2!

Re: iOS 18.6.1 0-click RCE POC

#60

Post by tptacek »

kingforaday wrote: post #53
Alifatisk wrote: post #4

I wonder how much this would be worth for Zerodium

I know the thread is saying $0 because Zerodium doesn't exist anymore, but there are others. This [0] one for a full chain mobile iOS is at $15M. I agree with tptacek though, the airdrop would reduce the value but you may still be in the low 7 figure range for 0 click RCE. 0. https://advance-sec.com/#bounty

I don't think this is real. "Full chain Linux desktop" for $10MM? Uh huh.

We recorded a podcast with Mark Dowd a year ago where he said nobody actually gets "list prices" for iOS full chain at $2.5MM (you can make considerably more than that by selling to multiple parties and by selling maintenance) --- and that's iOS, the highest-valued vulnerabilities.

Post reply on HN