Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iMessage, explained

jjtech.dev

Post reply on HN
Print view View original

91–100 of 163 posts

Re: iMessage, explained

#91

Post by jjtech »

mrpippy wrote: post #68
cynicalsecurity wrote: post #42

> In order to generate the “validation data”, pieces of information about the device such as its serial number, model, and disk UUID are used. Sadly, this is a clear sign the project is going to stop working eventually. At some point, the Apple is simply going to pull the plug. I remember doing similar tricks when I was a kid. Nowadays I simply won't even care trying. The problem clearly isn't supposed to be solved t…

To me, the more concerning paragraph is the next one: > Note: The binary that generates this “validation data” is highly obfuscated. pypush sidesteps this issue by using a custom mach-o loader and the Unicorn Engine to emulate an obfuscated binary. pypush also bundles device properties such as the serial number in a file called data.plist, which it feeds to the emulated binary. The binary being emulated was extracted…

I was thinking of finding a way to extract it directly from old Mac OS X updates downloaded directly from Apple... anyway, Beeper's app doesn't use it, that's purely a hack I came up with to make the proof-of-concept easier to use.

Re: iMessage, explained

#92

Post by 9dev »

cynicalsecurity wrote: post #42

> In order to generate the “validation data”, pieces of information about the device such as its serial number, model, and disk UUID are used. Sadly, this is a clear sign the project is going to stop working eventually. At some point, the Apple is simply going to pull the plug. I remember doing similar tricks when I was a kid. Nowadays I simply won't even care trying. The problem clearly isn't supposed to be solved t…

There is a wonderful song by a German band, which roughly translates to "Pure reason must never prevail."

Sometimes you grow the most when doing things the way you aren’t supposed to.

Re: iMessage, explained

#93

Post by jjtech »

dbuxton wrote: post #5

Genuine question - can a topic really be `opertunistic` or is that author typo? I love these `referer`-type misspellings that become fossilized over generations

Unfortunately, there are many typos in my code :P

On the other hand, I'm not sure if this is a typo on Apple's part, but it certainly is weird: you must use "WindowSerial" here[1], not "WindowsSerial" with the extra s

[1] https://github.com/JJTech0130/pypush/blob/8b33c0ee5d540d8ac7...

Re: iMessage, explained

#94

Post by kazinator »

9dev wrote: post #92
cynicalsecurity wrote: post #42

> In order to generate the “validation data”, pieces of information about the device such as its serial number, model, and disk UUID are used. Sadly, this is a clear sign the project is going to stop working eventually. At some point, the Apple is simply going to pull the plug. I remember doing similar tricks when I was a kid. Nowadays I simply won't even care trying. The problem clearly isn't supposed to be solved t…

There is a wonderful song by a German band, which roughly translates to "Pure reason must never prevail." Sometimes you grow the most when doing things the way you aren’t supposed to.

There is also a wonderful book by a German philosopher, titled The Critique of Pure Reason.

Re: iMessage, explained

#95

Post by maqp »

jjtech wrote: post #89
maqp wrote: post #67

Gonna repeat myself since iMessage hasn't improved one bit after four years. I also added some edits since attacks and Signal have improved. iMessage has several problems: 1. iMessage uses RSA instead of Diffie-Hellman. This means there is no forward secrecy. If the endpoint is compromised at any point, it allows the adversary who has a) been collecting messages in transit from the backbone, or b) in cases where clie…

While I will definitely agree that Signal is more secure: There is a newer version of the iMessage encryption (sometimes called "pair-ec") which uses ECIES. Beeper implements it, I never got around to backporting it to pypush proper. Also, the new Contact Key Verification (I believe it is the same thing as "key transparency" internally) should prevent the man-in-the-middle. A lot of the things you mentioned can actua…

If third party client has optional E2EE, it's not exactly a merit to Apple, aside perhaps them not explicitly blocking such development.

I commented on the key verification in the other reply, it appears to be opt-in feature, so warnings about key changes are similar to WhatsApp, available if you known about them and you know you need them.

>A lot of the things you mentioned can actually be solved on the pypush side:

Yeah a lot of the problems can usually be fixed by fixing them. :) "At least it's not fundamentally borked" can't be the standard for a multi-trillion dollar company.

>a lot has changed since then

That's just the sad part. 1280-bit keys are still there. RSA is still there. Fingerprints were added but they're opt-in.

Apple can afford to hire Moxie or OWS to implement Signal protocol for them. The fact they treat iMessage as a second class SW in their otherwise high security is ridiculous. People deserve better and they should demand better.

>It provides a reasonable level of security

But that's just it. RSA isn't reasonable. Forward secrecy became the reasonable expectation in new protocols in 2004. It was 'This Love' by 'Maroon 5' years ago. TLS1.3 has already killed RSA entirely. 1280-bit keys haven't weren't acceptable even then. OTR from 2004 used 1536-bit RSA.

If people knew it was borderline ancient in terms of it's technology, they probably wouldn't find the unnecessary risks convenient.

My point is: Apple can afford an overhaul, and they damn well should rewrite the protocol.

Re: iMessage, explained

#96

Post by catlover76 »

outlawery wrote: post #47
catlover76 wrote: post #20

Earlier quoted context omitted.

> Maybe you could keep using the app(s) whatever you were. I was using Android Messages, which has a web app. The experience was mediocre because the web app had trouble connecting to my phone all the damn time. I text some people almost exclusively through Facebook Messenger, and I think the rest I will try to move from text to WhatsApp. Both Meta-owned, unfortunately, but those seem to be easy to use cross-device a…

If you're already using Thunderbird as mail client, you can integrate Google Messages add-on [1] into Thunderbird app which I have been using happily for over a year without much trouble (sans the incoming texts notification feature). Seemingly this add-on has all features akin to the Google Messages Android app. [1] https://addons.thunderbird.net/en-us/thunderbird/addon/googl...

I've never comprehended the use of separate email clients, personally lol

Re: iMessage, explained

#97

Post by autoexec »

I was hoping this would explain why iMessage allows invisible messages and attachments. I really can't think of any reason why Apple would want to implement something like that, but they've been predictably used to infect devices.

Re: iMessage, explained

#98

Post by yalogin »

autoexec wrote: post #97

I was hoping this would explain why iMessage allows invisible messages and attachments. I really can't think of any reason why Apple would want to implement something like that, but they've been predictably used to infect devices.

This has nothing to do with the iMessage protocol itself. Invisible messages looks like a bug, as it depends on the current UI and rendering repercussions. May be if you file a bug on them they may respond.

Re: iMessage, explained

#99

Post by astrange »

maqp wrote: post #90
astrange wrote: post #85

Earlier quoted context omitted.

> 7. iMessage allows undetectable key insertion attacks. https://security.apple.com/blog/imessage-contact-key-verific...

Whoa, nice to see there's some progression finally! It's weird the blog appears to discuss key insertion, but not MITM attacks. Is there an official source that explicitly states it protects from those too? Also if it's for MITM too, is there a TOFU warning or is it only for a changing fingerprint, and is the warning soft (BTW the fingerprint just changed) or hard (please accept the new keys/fingerprint)? Can you mar…

Unfortunately I have no idea, or else I would've written a longer comment!

Re: iMessage, explained

#100

Post by [deleted] »

cynicalsecurity wrote: post #42

> In order to generate the “validation data”, pieces of information about the device such as its serial number, model, and disk UUID are used. Sadly, this is a clear sign the project is going to stop working eventually. At some point, the Apple is simply going to pull the plug. I remember doing similar tricks when I was a kid. Nowadays I simply won't even care trying. The problem clearly isn't supposed to be solved t…

[deleted]
Post reply on HN