Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple iMessage Zero-Click Hacks

wired.com

Post reply on HN
Print view View original

91–100 of 156 posts

Re: Apple iMessage Zero-Click Hacks

#91

Post by Abishek_Muthian »

codetrotter wrote: post #36
easton wrote: post #9

Earlier quoted context omitted.

SMS is also exploitable though, right (Both types of messages go through Messages.app)? And you can't disable SMS entirely I don't think.

> you can't disable SMS entirely I don't think Buy a data-only subscription, and use Google Voice or some sort of PBX powered app to still be able to receive regular phone calls. Preferably I’d want a really basic voice only, open source PBX powered app for iOS that I could use. Then I could get me a data-only plan and SIM. Caveat: I still need Norwegian BankID to work with my SIM though. I dunno if any of the data-o…

> Caveat: I still need Norwegian BankID to work with my SIM though.

Same in India, Banking & Payment apps need to verify that the SIM i.e. Phone number is indeed the one associated with the bank account and so they send SMS in the background at random intervals.

I don't do real-time communication and so I had the lowest tier prepaid carrier plan just for this purpose, But the oligopolies decided to remove SMS from the low tier plans suddenly and all my payment apps are now deactivated!

Meanwhile scammers continue to use phone numbers (SIM) bought dime a dozen with fake identity cards[1].

WhatsApp should never be forgiven for making phone number as a flawed identity of a living person, It's disappointing that Signal continued with it.

[1] https://twitter.com/Abishek_Muthian/status/14069649600815718...

Re: Apple iMessage Zero-Click Hacks

#92

Post by CyberRage »

passerby1 wrote: post #51
CyberRage wrote: post #22

Earlier quoted context omitted.

whatsapp doesn't rely on SMS protocols nor does it rely solely on phone numbers but is still being exploited quite often. Instant-Messaging = Worthy target for exploits. Just like web-browsers get exploited after years of patching.

>whatsapp doesn't rely on SMS protocols Wrong. Whatsapp relies on SMS as 2FA OTP.

Well that has nothing to do with the subject. the subject is zero-click exploits, this is not regarding authentication.

The point of these apps is that I can get content(picture, message, video etc) to your local device and it get processed.

Re: Apple iMessage Zero-Click Hacks

#93

Post by CyberRage »

lostmsu wrote: post #24
CyberRage wrote: post #21

Earlier quoted context omitted.

That might sound good in theory by in practice it's unlikely to go well(by default). Many services from banks to healthcare utilize SMS as a main way of communicating with end-users. many rely on dynamic numbers. Moreover, spoofing SMS messages is not that hard. Messaging apps whether it is SMS or alternatives like whatsapp, telegram etc. will always offer a powerful vector to infect devices.

I think banks don't use inline media in their messages too often.

It is part of my job. many banks do. often embarrassingly so.

Re: Apple iMessage Zero-Click Hacks

#94

Post by CyberRage »

saagarjha wrote: post #42
CyberRage wrote: post #23

Earlier quoted context omitted.

Well I would dare to say iMessage isn't the biggest target to convert to Rust. At the end of the day, it is still an app with app level permissions, sandbox etc. Kernel\Kernel modules are far more likely to be written as they allow for vastly more access than an app.

It's a great target considering that a lot of other exploits go through the kernel just to get access to your iMessages.

If you successfully exploit a kernel vulnerability, you don't need an iMessage bug....

you can pretty much access whatever you want.

Re: Apple iMessage Zero-Click Hacks

#95

Post by saagarjha »

CyberRage wrote: post #94
saagarjha wrote: post #42

Earlier quoted context omitted.

It's a great target considering that a lot of other exploits go through the kernel just to get access to your iMessages.

If you successfully exploit a kernel vulnerability, you don't need an iMessage bug.... you can pretty much access whatever you want.

My point is that the thing you would often do after that is go after people's iMessages anyways.

Re: Apple iMessage Zero-Click Hacks

#96

Post by saagarjha »

ec109685 wrote: post #86

Why aren’t lightweight hypervisors used more outside the public cloud? It seems that would go a long way in protecting the rest of the device from poorly written c code parsing user input.

For one, Apple's chips lacked hardware support for virtualization until last year.

Re: Apple iMessage Zero-Click Hacks

#97

Post by CyberRage »

saagarjha wrote: post #95
CyberRage wrote: post #94

Earlier quoted context omitted.

If you successfully exploit a kernel vulnerability, you don't need an iMessage bug.... you can pretty much access whatever you want.

My point is that the thing you would often do after that is go after people's iMessages anyways.

I think you misunderstand how things work on modern mobile OS.

You don't need to access the messages app in order to get access to the messages.

it's the opposite actually, the messaging app needs permissions for the system level messaging component.

Re: Apple iMessage Zero-Click Hacks

#98

Post by saagarjha »

eloisius wrote: post #88

I got corrected last time this topic came up. I originally thought Messages was part of the OS and not a pre-installed userspace app. However, if it's in userspace, why is it such a vulnerable vector for compromising the phone? Is there some privilege-escalation component to this that I haven't read about?

iMessage is a pre-installed userspace app that uses frameworks that ship with the OS.

Re: Apple iMessage Zero-Click Hacks

#99

Post by BiteCode_dev »

kylehotchkiss wrote: post #4

A small way to reduce attack surface - have iMessage just setup for your iCloud email address instead of phone number. Phone numbers are becoming increasingly useless. > In fact, Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely. There's a checkbox in Settings > Messages that does exactly this? It seems strange they published this.

Nope, when I'm on the go, I certainly have a way better communication using phone calls than whatever VOIP du jour.

Phone numbers, like emails, are very robust and reliable, interoperable, not centralized to one entity, and the quality of service vs cost ratio is excellent.

Not to mention text messages:

- they work no matter if the person is using whatsapp, telegram, signal or the new hype stuff

- no GAFAM is collecting my text history to sell me ads

- they require no internet connection

There are 3 things that we must absolutely cherish and preserve in this race for tech: cash, emails and phone numbers.

They are a beacon of stability in this sea of ever moving innovation greed.

And I say that while I'm thinking about setting up an IFPS website, compiling python 3.10 beta to test it and buy a secondary e-ink screen for my laptop. I'm not technophobic.

Re: Apple iMessage Zero-Click Hacks

#100

Post by saagarjha »

CyberRage wrote: post #97
saagarjha wrote: post #95

Earlier quoted context omitted.

My point is that the thing you would often do after that is go after people's iMessages anyways.

I think you misunderstand how things work on modern mobile OS. You don't need to access the messages app in order to get access to the messages. it's the opposite actually, the messaging app needs permissions for the system level messaging component.

I assure you that I know enough to at least hold an intelligent conversation on mobile security. On iOS there is no "system level messaging component". (i)Messages are stored in a SQLite database that is protected via entitlements and sandboxing; the Messages app is given the ability to access it legitimately. Attackers can either exploit the Messages itself and (via code execution in that process) grab a user's messages, or they can exploit something else (such as the web content process) and then escalate privileges from there to bypass the sandbox.
Post reply on HN