Hacker News Reader

Comment by user214412412 | Hacker News Reader

is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?

View on HN

Apple should formalize the iMessage de facto DeviceAndAccountTakeover() API call. I lost count how many zero-click it has. Tim Apple can take the privacy high road all day but it doesn't matter if the code is rotten.

https://citizenlab.ca/2025/06/first-forensic-confirmation-of...

https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...

https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage...

https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hac...

Look up iMessage's "blastdoor" sandbox: https://support.apple.com/guide/security/blastdoor-for-messa...

FORCEDENTRY bypassed this sandbox IIRC. That was a bug in the JBIG2 decoder.

Also image formats are fairly stable, so they are a good candidate for a verified F* parser. Not sure how easy it is for pdf, maybe start with a reasonable subset of it.

Good luck doing that for stuff like PDF which can include JavaScript in the PDF file itself, or SVG+PDF which both can include raw font files, another reliable source of exploits.

PDF/A-1 and PDF/UA require unicode mapping, so embedded font files might be not as critical, you can just render unicode text, and javascript is routinely banned for being inaccessible.

Do any PDF readers other than Adobe's support JS? Apple's certainly does not, unless something has changed recently.

unfortunately sandboxes also have bugs which allows for RCE. this is typically called a "full chain" because it chains together a series of bugs (initial decoder exploit + sandbox escape exploit) to gain full RCE

This isn't just an iOS thing, and they do sandbox it. Parsers are hard.

For some reason, Apple seems reluctant about using Rust on their operating systems.

That reason is probably called Swift. But they obviously still have many many system libraries written in Objective-C, plain C or C++.

I don't see them using Rust when they have their own language under their full control, especially since both are targeting LLVM anyway.

Reply on news.ycombinator.com