Hacker News Reader

Comment by DyslexicAtheist | Hacker News Reader

biggest issue here isn't memory safety but the dumpster fire of imessage format that calls out to privileged parts of the system

View on HN

Which is exploitable primarily it by memory safety exploits.

Will it make attacks impossible? Probably not totally. But it might raise the cost of the attack by an order of magnitude or more and certain classes of vulnerabilities might disappear completely.

I'm suspicious of any messaging system that has ties into rich media / embedded-in-chat content. I even wish I could disable URL previews, gifs, and inline images in Signal.

I didn't know it was possible to disable URL previews in iMessage[1] until I read this comment. Does toggling this setting only prevent the preview from displaying or does it prevent the fetch altogether? I wish there were a way to white list the URL previews for certain contacts rather than turning it off all or nothing.

[1]https://discussions.apple.com/thread/7677834

It can be your "trusted" contacts that infect you though.

"Jeff Bezos was hacked by a file sent from the WhatsApp account of the crown prince of Saudi Arabia, Mohammed bin Salman"

https://en.wikipedia.org/wiki/Jeff_Bezos_phone_hacking

I didn't see a way to disable URL previews in that thread. The given "solution" is wrong -- it just disables message previews in the lock screen.

And Apple's terrible software and QA processes, like lack of CI or fuzzing, which is why Google Project Zero is discovering flaws for them.

It's an extremely common attack vector. PDFs, media message, etc. Would it be viable to create a dedicated processor specifically for parsing these things?

Reply on news.ycombinator.com