Shorter version: Operating systems set up hardware locks and protections to confine processes, and once set up, they cannot be undone. (the hardware + OS denies modifications to the security policy)
- Attacker broke out from the app sandbox. (attacker can run code in the infected process)
- Broke out of the process. (gained root access; attacker can run anything)
- Broke into the kernel space (gained 100% control over the hardware)
- Corrupted some kernel memory via a damm magic MMIO accesses nobody knows (hardware vulnerable)
- Bypassed protections that kernel set up earlier such that it cannot accidentally modify itself.
- Finally broke the kernel via hardware exploit thus the attacker got rootkit level access.
Getting arbitrary code execution and root access is one thing, but breaking out from the damm kernel configured hardware protections is insane.
They basically managed to flip a “read-only” switch to “modify-as-much-as-you-like”. The infected device at this point is broken beyond repair, as the firmware(s) may have been tampered with. End result is a terrestrial spy brick.
It’s gonna be a “yikes” from me, dawg
Can someone much smarter than I am, explain like I’m a toddler?
Basically they found out that anyone who knows how this work can send you an iMessage with an attachment that won’t show up on your end without the need of your interaction and do whatever they want on your iphone.
P.S. I’m not smart nor I’m an expert.
So you can think of security as being done in layers. iPhones have apps exist in a sort of “prison”, so a malicious app can’t go modify other apps or the OS. It exists solely in its own little room. It can pass notes under the door to the OS to ask for calculations, and receive the results of those calculations. But it can’t leave that room to modify things outside. And the OS can run verifications on the notes it gets passed, to ensure they’re not malicious before it tries to calculate them. Lastly, the OS uses a secure calculator called the kernel to actually make those calculations and get the results.
First, this attack exploited a PDF vulnerability, to attack iMessage. When the victim receives the message with the infected PDF, iMessage attempts to generate a preview of it; This initiates the attack. This happens automatically, and means the user doesn’t even need to interact with the message. This attack hijacks the Messages app, and essentially allows Messages to break out of the room it was sealed in. Now iMessage is able to modify other apps and interact with the OS directly
Next, it attempts to get outside of the OS, to the kernel. The kernel is essentially the hardware level of the phone, where everything is 1’s and 0’s. The user interacts with the app, the app interacts with the OS, and the OS interacts with the kernel to do the actual processing. But even inside of the OS, the kernel has protections; That calculator is secure, and can’t be modified. The OS has large parts of the kernel marked as “read only” so it can’t be changed. The OS only allows itself to push the specific buttons on the calculator that it knows will work correctly. This is intentional, to prevent accidental or malicious kernel modifications. If an app asks the OS to push any insecure buttons or change the calculator, the OS will normally refuse.
But this attack uses another zero-day vector to break out of the OS and interact with the kernel directly. Now the app is able to type on the calculator without talking to the OS first. But this still isn’t enough, because the kernel is still marked as read-only. Lastly, the attack uses another zero-day exploit to attack a hardware vulnerability, and flip those sections of the kernel from read-only to lol-yeah-you-can-write-whatever-you-want. This allows the compromised app to modify the calculator to produce whatever results they want. They can change the calculator to have 1+1=3.
And once the kernel has been rewritten, the entire phone is compromised. Even an OS update won’t fix things, because the OS is only interacting with the kernel (which is still compromised even after the OS update.) Even if you fix the OS to prevent another attack, the calculator still says 1+1=3. The hacker essentially owns the entire device at that point, because kernel-level access will allow them to supersede the OS.
Is this type of thing why BlackBerry used to reign supreme when it came to device security?
Makes me laugh because of how cultishly people claim iphone is secur, yet we keep hearing how susceptible it really is to attacks. There is a real disconnect there.
I would feel foolish making these claims, and paying more for a device that’s only real achievement is a walled garden.
This is kind of a ridiculous take. I hate iPhones, but this is not a “hurr durr iPhones bad and insecure” moment. I implore you to look at the sophistication of this attack. The attack chain is so ridiculously long and complex, and only because of the security of the iPhone. This is not a script kiddie attack, and could only be executed by a very determined party.
No device is secure, and any and all computers could potentially fall victim to an attack like this, but it is absolutely ignorant to say that iPhones don’t offer any more security than other devices.
FYI: I don’t think you’re replying to someone acting in good faith.
That’s called projection.
deleted by creator
