Hacker News Reader

Comment by MiguelHudnandez | Hacker News Reader

These fixes came out today, apparently timed with the announcement, make sure updates are applied for you and yours.

https://support.apple.com/en-us/HT201222

Interestingly, no kernel vulnerability or anything is mentioned.

As far as I know, any parsing code for iMessages should run within the BlastDoor sandbox – is there another vulnerability in the chain that is not reported here?

Image I/O has been mentioned elsewhere. Suspect it's code that's running in process from that library that's doing it.

I think you're right but I don't see any detailed information from The Citizen Lab. I expect a lot more information after some embargo timer runs out.

For context, here's another report from them outlining a similar vulnerability: https://citizenlab.ca/2021/08/bahrain-hacks-activists-with-n...

One CVE is in Wallet and Citizen Lab mention PassKit. My guess is that BlastDoor deserializes the PassKit payload successfully, then sends it to PassKit which subsequently decodes a malicious image outside of BlastDoor.

Yup. You can just have your crafted webp (This is the patch for the ImageIO bug https://chromium.googlesource.com/webm/libwebp/+/902bc919033...) image with the .png extension (inside your passkit - https://developer.apple.com/library/archive/documentation/Us...) and you send it to your target..

Probably 3 - sandbox escape, being able to launch a process in privileged mode and something that adds to the kernel table of allowed hashes.

But it is totally possible for them to have been able only to identify one of them if they didn't intercept the whole attack.

It may be the case that either the kernel vulnerability hasn't been analyzed or fixed yet, or that they were not able to capture it. Many of these exploits have multiple stages and grabbing the later ones is difficult.

Is that still true when you control the source code and compiler? Or just for external researchers?

It’s not that reverse engineering is the challenge but that the exploit likely gets downloaded from a server that isn’t online anymore.

Curious why no fix is out for iOS 15 yet. Is iOS 15 not vulnerable to this attack? Or is there often a delay in backporting security fixes that I'm not aware of? And if so, should I be implementing a workaround if I wanted to protect against these exploits?

Active support ended a year ago (12 Sep 2022), but somehow it still saw a security release on 24 Jul 2023. Perhaps we will see one more?

They've been supporting iOS 15 with security updates for devices that can't update to iOS 16. Not sure how long they'll continue doing it but I imagine it'll be for a good while.

Looks like they just released an update that fixes CVE-2023-41064 at least: https://support.apple.com/en-au/HT213913

Reply on news.ycombinator.com