Apple iMessage Zero-Click Hacks

[johnthuss]

Contrary to the article, blocking ALL media besides plain text from random senders who aren't in your contacts is exactly what most people would want and should be the default. I don't see any downsides to that approach.

[bb123]

I wouldn't want this at all. Just off the top of my head I can think of a ton of use cases this makes hard:

* I ask a seller on FB marketplace to send me some pictures of an item

* I need to send pictures of some documents to my solicitor

* A new friend I've just met in a bar tries to send me her contact card

* My mechanic tries to send me a PDF of the invoice for his work

Sure, there are ways around all of these, but it makes iMessage (or any messaging service) a lot less useful.

[upofadown]

Perhaps this idea could be extended to treating content differently for all messages from unverified identities. Getting people to verify identities in an end to end encryption system is a huge problem. This could provide a conceptual hook that would mean that unverified contacts were untrustworthy contacts. This would be a state, rather than something that you get nagged about from time to time.

Otherwise an attacker will usually be able to figure out a way to fake a message from someone already in your contact list.

Of course iMessage doesn't do identity verification which is why it does not have effective end to end encryption in the first place. So they would have to solve that, perhaps larger problem, first.

[webinvest]

Or anyone that you haven’t replied to yet. I text many people who aren’t in my contacts.

[kylehotchkiss]

A small way to reduce attack surface - have iMessage just setup for your iCloud email address instead of phone number. Phone numbers are becoming increasingly useless.

> In fact, Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely.

There's a checkbox in Settings > Messages that does exactly this? It seems strange they published this.

[mrweasel]

> Phone numbers are becoming increasingly useless.

Not really, there's a ton of government services that require you to have a phone number (depending on where you live). I don't see any real suggestion for an alternative to having a phone number. If nothing else, to receiving notification. You can't really rely on iMessage, WhatsApp, Signal and similar services, you need one system that you're sure will cover 98% for all people. 3. parties can't even integrate into many of these services.

You could use email, but I don't really see how that's any better and many seniors will use SMS, but not email to any great extend.

SMS is still the only unified messaging service you can be sure that all your friends and family will have.

[BiteCode_dev]

Nope, when I'm on the go, I certainly have a way better communication using phone calls than whatever VOIP du jour.

Phone numbers, like emails, are very robust and reliable, interoperable, not centralized to one entity, and the quality of service vs cost ratio is excellent.

Not to mention text messages:

- they work no matter if the person is using whatsapp, telegram, signal or the new hype stuff

- no GAFAM is collecting my text history to sell me ads

- they require no internet connection

There are 3 things that we must absolutely cherish and preserve in this race for tech: cash, emails and phone numbers.

They are a beacon of stability in this sea of ever moving innovation greed.

And I say that while I'm thinking about setting up an IFPS website, compiling python 3.10 beta to test it and buy a secondary e-ink screen for my laptop. I'm not technophobic.

[easton]

SMS is also exploitable though, right (Both types of messages go through Messages.app)? And you can't disable SMS entirely I don't think.

[SV_BubbleTime]

> email address instead of phone number. Phone numbers are becoming increasingly useless.

Fantastic way to not have people send you messages anymore.

Phone numbers are technically becoming useless. They are practically still the by far dominant choice when someone goes to send you a new message.

We’ve had decades of texting phone numbers to reinforce this.

[CyberRage]

whatsapp doesn't rely on SMS protocols nor does it rely solely on phone numbers but is still being exploited quite often.

Instant-Messaging = Worthy target for exploits.

Just like web-browsers get exploited after years of patching.

[rsync]

"... Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely."

You can do this already. If you "manage" your iphone with Apple Configurator you have fine-grained control over every little thing it does. You can disable imessage (and many other things like the app store, etc.)

[kevingadd]

Maybe what they mean is that some or all of the iMessage code is still running on the device even if you disable it?

[sneak]

iCloud isn't end to end encrypted for the most part - anyone security conscious should be avoiding iCloud in the first place.

[SalimoS]

Wouldn’t be not parsing incoming media unless it’s for someone from contact is a first step that can reduce largely the thread ?

So it will stay the same for people in your contact list but a new touch to load for message from unknown person

[est31]

https://en.wikipedia.org/wiki/Dancing_pigs

[eyeball]

I turned off imessage.

I seem to be under attack lately.

3-4 times a day random links sent from gmail addresses or unknown phone numbers to imsg with sketchy looking links in them.

[dylan604]

Can you war-dial attack with these? Seems like it would be super easy for a script kiddie to just start at 111-111-1111, send message, increment by 1, repeat. Maybe narrow it down to valid area codes and what not, but seems like a super low budget thing to do.

[cyckl]

I’m also getting these—no idea what the exploits actually are or how they work. Am I theoretically already exploited?

[WelcomeShorty]

So enlighten us: how did you turn off iMessage?

[fencepost]

If you're not familiar with NSO Group and Pegasus, I highly recommend episodes 99 and 100 (just released) of the Darknet Diaries podcast.

[kossTKR]

"Apple hasn't issued a fix for this particular vulnerability"..."new defenses are coming with iOS 15, which will likely come out next month".

That's completely insane, isn't it? Have Apple just given up, or am i missing the scope of this vulnerability?

Also how can Apple not have better security with such an incredible amount of money in the bank?

[dannyw]

It can take time to fix things properly. You don't want to half arse a mitigation, only for the attacker to bypass it in a week.

[eloisius]

I got corrected last time this topic came up. I originally thought Messages was part of the OS and not a pre-installed userspace app. However, if it's in userspace, why is it such a vulnerable vector for compromising the phone? Is there some privilege-escalation component to this that I haven't read about?

[dannyw]

iMessage is one of few apps that have broad permissions to execute code in response to notifications.

For other apps like Telegram; the server can send a predefined notification message.

For iMessage, when you get something even from someone outside your contacts, its daemon invokes specific code to handle the message, and its attachments.

Whilst this doesn't help if someone opens the app, it does at least change this from a zero click attack, to a one click attack.

(This is also another example of Apple not following its own app store rules. It has privileged access to frameworks.)

[saagarjha]

iMessage is a pre-installed userspace app that uses frameworks that ship with the OS.

[raspasov]

Is it a fair assumption that any code written in C / C++ / Objective-C has a high likelihood of allowing zero-click hacks?

[azinman2]

Objective-c has bounds checks and lengths built into NSData, NSArray, and NSString… so many of the buffer overflow techniques likely won’t work against it. However, images and video seem to hit C++ code and from all of the past CVEs it seems this is a giant attack surface over and over again.

I’m surprised this code isn’t being rewritten in something like Rust, but perhaps there are more things going on at play, like the plist serialization attacks that end up coding for esoteric classes that contained various bugs.

[tyingq]

Aren't these making it past BlastDoor, written in Swift?

[FounderBurr]

No

[gjsman-1000]

I wonder if Apple's devs are just going to say, screw it, we'll rewrite the whole thing in Rust with audits and formal analysis the whole way...

[brobinson]

Apple had job postings last year looking for Rust developers to rewrite a service that was written in C so it's not without precedent.

Job posting links are dead now, but there was a reddit thread about it: https://old.reddit.com/r/rust/comments/fkngza/apple_hiring_r...

[raspasov]

Rust or Swift. I am not a security expert, but I'd bet that re-writing in either would reduce the amount of such embarrassing exploits at least 10x.

From what I can tell, the combination of unsafe-by-default languages like C/C++/Obj-C and the way the human brain works is Not-A-Good-Combination© . Too many opportunities for error.

[stefan_]

You are talking about the same company that shoved their proprietary WiFi protocol full of holes straight into the kernel. Judging from the kind of messages it emits, the latter is a true masterpiece by the way.

[CyberRage]

Well I would dare to say iMessage isn't the biggest target to convert to Rust.

At the end of the day, it is still an app with app level permissions, sandbox etc.

Kernel\Kernel modules are far more likely to be written as they allow for vastly more access than an app.

[iamnotwhoiam]

Does this mean that iMessage evaluates messages as code for some reason? Why on earth would that be the case? It's a foundational security principle to not do that.

And even if they did then why is that so hard to fix?

[ec109685]

Why aren’t lightweight hypervisors used more outside the public cloud? It seems that would go a long way in protecting the rest of the device from poorly written c code parsing user input.

[thehappypm]

The answer is probably plain old complexity.

Getting an application that's running in a hypervisor to seamlessly, for example, accept deep-link clicks is more complicated for the same reason that they're more secure. That extra boundary is another wall, another interface. And of course that means more complexity for app developers, and more compute cost/battery utilization.

[saagarjha]

For one, Apple's chips lacked hardware support for virtualization until last year.

[yokoprime]

On device? The vast majority of people don't give a flying fuck about privacy, for them the decrease in battery life would not be worth it

[bumbledraven]

https://archive.is/eThd5

[iamnotwhoiam]

Am I safer if I disable iMessage or can the zero-click hacks exploit the Messages app through SMS?

[sonthonax]

How do Zero click hacks work?

Does iMessage accept arbitrary code that it can execute?

[andreasley]

Usually by exploiting holes in some code that does parsing, e.g. for images. Here [1] is a nice write-up.

[1] https://googleprojectzero.blogspot.com/2020/04/fuzzing-image...

[kevingadd]

Similarly to Android there have been attacks that involve exploiting bugs in the code that parses incoming messages, and then via the exploit you can get remote code execution

For example (IIRC this was a real bug), if you exploit a bug in the text layout code, you could attack a device by getting a notification to appear on the lock screen - and SMS messages usually trigger a notification

[dagmx]

Depends on the hack but the majority seem to be from parsers for various formats, from images, to unicode and text data etc...

A message has to be able to display so many different types of content. A flaw in any one of those could be exploited. Combine a bunch of flaws together and you suddenly can do quite a bit.

[rasz]

this header field is always 4 bytes, no need to parse length

[webinvest]

Are these exploits patched in IOS 14.7.1 or earlier?