Apple iMessage Zero-Click Hacks

https://www.wired.com/story/apple-imessage-zero-click-hacks/

by curmudgeon22 • 5 years ago

262 151 5 years ago

eyeball• 5 years ago

I turned off imessage.

I seem to be under attack lately.

3-4 times a day random links sent from gmail addresses or unknown phone numbers to imsg with sketchy looking links in them.

cyckl• 5 years ago

I’m also getting these—no idea what the exploits actually are or how they work. Am I theoretically already exploited?

gruez3• 5 years ago

Not really.

1. There's no reason why a threat actor would have to send you 3-4 messages per day. Of the exploits I've seen, they only need to send one. Sending 3-4 messages per day just unnecessarily increases the risk of getting caught (ie. the target getting suspicious and asking on hacker news whether they're getting hacked)

2. There's no reason why the message has to contain sketchy links. They could very well disguise messages as ads/notifications for well known businesses, political organizations, or from random people who got the wrong phone number.

3. There's no reason why the attacker can't erase any trace of the initial message after your device is infected, so unless you're staring at your phone 24/7 it's very easy to miss the message.

dylan6045• 5 years ago

Can you war-dial attack with these? Seems like it would be super easy for a script kiddie to just start at 111-111-1111, send message, increment by 1, repeat. Maybe narrow it down to valid area codes and what not, but seems like a super low budget thing to do.

zsmi• 5 years ago

Sure.

https://calleridreputation.com/blog/robotexts-are-replacing-...

"Robotech spammers are also targeting group messages by using automated programs to send thousands, even millions of group texts to random phone numbers with the hopes that somebody will take the prey and respond."

Also, some users give random apps access to their address book for whatever reason then there is a whole list of known good emails and numbers to spam.

rmorey• 5 years ago

Well, send from what? Every iMessage comes from an account with an Apple ID, so I presume stolen credentials would be the only way to really do this, adding to the cost.

dgfitz• 5 years ago

I hope that’s their starting point. My number has at least 1+ 0s in it. =)

WelcomeShorty• 5 years ago

So enlighten us: how did you turn off iMessage?

neilalexander2• 5 years ago

“Settings” -> “Messages” -> Toggle “iMessage” to off. Couldn’t be simpler.

sonthonax• 5 years ago

How do Zero click hacks work?

Does iMessage accept arbitrary code that it can execute?

kevingadd2• 5 years ago

Similarly to Android there have been attacks that involve exploiting bugs in the code that parses incoming messages, and then via the exploit you can get remote code execution

For example (IIRC this was a real bug), if you exploit a bug in the text layout code, you could attack a device by getting a notification to appear on the lock screen - and SMS messages usually trigger a notification

gjsman-10002• 5 years ago

There was a developer who discovered a bug with the XML parser, and wrote a whole blog post about how he was able to cause iOS's security system to malfunction using a specially-crafted XML permissions file and allow his app to do anything he wanted, even escape the sandbox. He kept it secret for years for his private experimentation until Apple patched it by accident, by adding a 5th XML parser to the other 4 for some reason and using that one instead for the permissions.

andreasley• 5 years ago

Usually by exploiting holes in some code that does parsing, e.g. for images. Here [1] is a nice write-up.

[1] https://googleprojectzero.blogspot.com/2020/04/fuzzing-image...

heavyset_go• 5 years ago

Similarly, homebrew on the PSP exploited libjpeg or libtiff, so this is one of those vectors that we're still dealing with 16 years later.

dagmx• 5 years ago

Depends on the hack but the majority seem to be from parsers for various formats, from images, to unicode and text data etc...

A message has to be able to display so many different types of content. A flaw in any one of those could be exploited. Combine a bunch of flaws together and you suddenly can do quite a bit.

rasz• 5 years ago

this header field is always 4 bytes, no need to parse length

kylehotchkiss• 5 years ago

A small way to reduce attack surface - have iMessage just setup for your iCloud email address instead of phone number. Phone numbers are becoming increasingly useless.

In fact, Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely.

There's a checkbox in Settings > Messages that does exactly this? It seems strange they published this.

kevingadd2• 5 years ago

Maybe what they mean is that some or all of the iMessage code is still running on the device even if you disable it?

judge2020• 5 years ago

SMS will still enter through Messages.app if you have SMS enabled through your carrier and plan. But no, iMessage is not used when it's disabled.

easton• 5 years ago

SMS is also exploitable though, right (Both types of messages go through Messages.app)? And you can't disable SMS entirely I don't think.

gruez3• 5 years ago

SMS is also exploitable though, right

it's less feature rich, so presumably there's less attack surface.

codetrotter• 5 years ago

you can't disable SMS entirely I don't think

Buy a data-only subscription, and use Google Voice or some sort of PBX powered app to still be able to receive regular phone calls.

Preferably I’d want a really basic voice only, open source PBX powered app for iOS that I could use. Then I could get me a data-only plan and SIM.

Caveat: I still need Norwegian BankID to work with my SIM though. I dunno if any of the data-only plans available in Norway support BankID, or if you need a regular subscription like I have now in order to use that.

CyberRage9• 5 years ago

whatsapp doesn't rely on SMS protocols nor does it rely solely on phone numbers but is still being exploited quite often.

Instant-Messaging = Worthy target for exploits.

Just like web-browsers get exploited after years of patching.

passerby1• 5 years ago

whatsapp doesn't rely on SMS protocols

Wrong. Whatsapp relies on SMS as 2FA OTP.

sneak• 5 years ago

iCloud isn't end to end encrypted for the most part - anyone security conscious should be avoiding iCloud in the first place.

SV_BubbleTime• 5 years ago

email address instead of phone number. Phone numbers are becoming increasingly useless.

Fantastic way to not have people send you messages anymore.

Phone numbers are technically becoming useless. They are practically still the by far dominant choice when someone goes to send you a new message.

We’ve had decades of texting phone numbers to reinforce this.

rsync• 5 years ago

"... Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely."

You can do this already. If you "manage" your iphone with Apple Configurator you have fine-grained control over every little thing it does. You can disable imessage (and many other things like the app store, etc.)

neilalexander2• 5 years ago

You can disable iMessage just by going into the Settings and turning the “iMessage” toggle to off. You don’t need to supervise the device or install a profile.

mrweasel2• 5 years ago

Phone numbers are becoming increasingly useless.

Not really, there's a ton of government services that require you to have a phone number (depending on where you live). I don't see any real suggestion for an alternative to having a phone number. If nothing else, to receiving notification. You can't really rely on iMessage, WhatsApp, Signal and similar services, you need one system that you're sure will cover 98% for all people. 3. parties can't even integrate into many of these services.

You could use email, but I don't really see how that's any better and many seniors will use SMS, but not email to any great extend.

SMS is still the only unified messaging service you can be sure that all your friends and family will have.

tofukid• 5 years ago

I use voip.ms and have SMS forwarded to my email. I can also reply via email. I only use a phone number for services that require one. Family and friends I will use email, iMessage, or Signal.

BiteCode_dev2• 5 years ago

Nope, when I'm on the go, I certainly have a way better communication using phone calls than whatever VOIP du jour.

Phone numbers, like emails, are very robust and reliable, interoperable, not centralized to one entity, and the quality of service vs cost ratio is excellent.

Not to mention text messages:

- they work no matter if the person is using whatsapp, telegram, signal or the new hype stuff

- no GAFAM is collecting my text history to sell me ads

- they require no internet connection

There are 3 things that we must absolutely cherish and preserve in this race for tech: cash, emails and phone numbers.

They are a beacon of stability in this sea of ever moving innovation greed.

And I say that while I'm thinking about setting up an IFPS website, compiling python 3.10 beta to test it and buy a secondary e-ink screen for my laptop. I'm not technophobic.

mavhc2• 5 years ago

Email and SMS aren't reliable, you've no way to know if they've been read.

SMS is unencrypted so someone's harvesting your data.

They require a cell tower connection, that's only 1 step away from an internet connection, probably 0 in many cases.

Cash and Phone numbers are trivial to steal.

gjsman-10002• 5 years ago

I wonder if Apple's devs are just going to say, screw it, we'll rewrite the whole thing in Rust with audits and formal analysis the whole way...

brobinson• 5 years ago

Apple had job postings last year looking for Rust developers to rewrite a service that was written in C so it's not without precedent.

Job posting links are dead now, but there was a reddit thread about it: https://old.reddit.com/r/rust/comments/fkngza/apple_hiring_r...

est313• 5 years ago

A more fresh job posting from Apple: https://old.reddit.com/r/rust/comments/ou5szr/official_rrust...

Also: https://jobs.apple.com/en-us/search?search=rust&sort=relevan...

raspasov4• 5 years ago

Rust or Swift. I am not a security expert, but I'd bet that re-writing in either would reduce the amount of such embarrassing exploits at least 10x.

From what I can tell, the combination of unsafe-by-default languages like C/C++/Obj-C and the way the human brain works is Not-A-Good-Combination© . Too many opportunities for error.

coldcode• 5 years ago

Some Apple devs still seem to love C and Obj-C (at least the ones my former employer worked with directly) and hate on Swift. Both Swift and Rust can be written to a much higher standard where the language protects you from stupidity, but only if you give up the past and use them. While you can write pretty good C-ish code (i.e. Linux), its far too easy to slip up once and the language does nothing to save your ass.

Some of Apple's OS code is pretty ancient. Switching to Swift or Rust is not necessarily a panacea if you call too many OS routines still in C-ish.

simondotau2• 5 years ago

Low level library stuff like JPEG and PNG parsing/decoding is exactly where Rust could offer massive security wins for a relatively modest change of code. The main requirement would be to ensure that the Rust versions had absolute feature parity with zero regressions.

CyberRage9• 5 years ago

Well I would dare to say iMessage isn't the biggest target to convert to Rust.

At the end of the day, it is still an app with app level permissions, sandbox etc.

Kernel\Kernel modules are far more likely to be written as they allow for vastly more access than an app.

dylan6045• 5 years ago

Unless someone applies the squeaky wheel rule. The thing causing everyone to look at you gets pushed to the top of the list.

saagarjha18• 5 years ago

It's a great target considering that a lot of other exploits go through the kernel just to get access to your iMessages.

robocat• 5 years ago

I would pick the baseband processor as the biggest target. https://www.theiphonewiki.com/wiki/Baseband_Device

Reasons for worry about the baseband code:

a) Code is written by a third parties

b) Apple is more restricted applying defence-in-depth (customised security CPU changes like PAC, customised compiler changes, etcetera).

c) harder to detect intrusion?

Versus reasons not to worry so much:

z) Baseband has more limited access to information

y) harder to make exploit survive a reboot - mainly useful as part of chain of exploit into main CPU?

x) Baseband code is device specific - helps to know target device to attack

thehappypm2• 5 years ago

iMessage has the huge bonus that it's exposed to the internet. The kernel is much harder to actually get close to. iMessage? Send them a text.

stefan_• 5 years ago

You are talking about the same company that shoved their proprietary WiFi protocol full of holes straight into the kernel. Judging from the kind of messages it emits, the latter is a true masterpiece by the way.

raspasov4• 5 years ago

Is it a fair assumption that any code written in C / C++ / Objective-C has a high likelihood of allowing zero-click hacks?

tyingq• 5 years ago

Aren't these making it past BlastDoor, written in Swift?

Pulcinella• 5 years ago

Swift has e.g. UnsafePointer if you want to work more directly with memory. Presumably if BlastDoor uses them to work directly with memory then it could still be vulnerable, though I am not sure because I am not very familiar with them. If I was excited about pointers I wouldn't be using Swift...

vlozko• 5 years ago

The exploit targets existing C code that did image decoding and used CoreFoundation to handle data reads. Blast door is Swift-based and likely very memory-safe. What I’m curious about is where the limits of BlastDoor are that it couldn’t contain this particular attack. I’m under the impression that BlastDoor was built exactly for this type of attack.

azinman22• 5 years ago

Objective-c has bounds checks and lengths built into NSData, NSArray, and NSString… so many of the buffer overflow techniques likely won’t work against it. However, images and video seem to hit C++ code and from all of the past CVEs it seems this is a giant attack surface over and over again.

I’m surprised this code isn’t being rewritten in something like Rust, but perhaps there are more things going on at play, like the plist serialization attacks that end up coding for esoteric classes that contained various bugs.

thenewwazoo• 5 years ago

As a certified member of the Rewrite It In Rust (RIIR) Reaction Force, let me answer this by saying that it’s very, very hard to get the software right, even the second time, and RIIR trades one set of unknowns for another. There are also a huge number of people who are convinced that Rust is a fad, or that C is good enough, or whatever. The same people who swore they could outbrake ABS decades ago. They do not want to learn a new, hard thing, and Rust can be hard at first.

saagarjha18• 5 years ago

Objective-C can run into other issues, though: NSSecureCoding exists for a reason ;)

mitemte• 5 years ago

Depends where the vulnerability lies. Plenty of iMessage DoS attacks [1-4] have targeted CoreText, which, I believe is written in C and CoreFoundation. I think all of these DoS attacks could be mitigated by not viewing the message and disabling message previews in notifications.

[1] https://habr.com/ru/post/191654/

[2] https://appleinsider.com/articles/15/05/27/bug-in-ios-notifi...

[3] https://blog.zecops.com/research/analyzing-the-ios-telugu-cr...

[4] https://www.macrumors.com/2018/05/09/how-to-fix-black-dot-im...

kalleboo• 5 years ago

I’m surprised this code isn’t being rewritten in something like Rust

I imagine the internal discussion is something like "by rewriting it, we will just introduce 100 new bugs. once we squash these last few bugs in the current tried-and-tested C code, it will be bulletproof!"

Being Apple I imagine they would prefer to rewrite it in Swift, but Swift may not be mature enough

FounderBurr• 5 years ago

SalimoS• 5 years ago

Wouldn’t be not parsing incoming media unless it’s for someone from contact is a first step that can reduce largely the thread ?

So it will stay the same for people in your contact list but a new touch to load for message from unknown person

CyberRage9• 5 years ago

That might sound good in theory by in practice it's unlikely to go well(by default).

Many services from banks to healthcare utilize SMS as a main way of communicating with end-users. many rely on dynamic numbers.

Moreover, spoofing SMS messages is not that hard.

Messaging apps whether it is SMS or alternatives like whatsapp, telegram etc. will always offer a powerful vector to infect devices.

lostmsu• 5 years ago

I think banks don't use inline media in their messages too often.

KaiserPro4• 5 years ago

you have made an argument against _never_ parsing media from untrusted _SMSs_

This is iMessage, and instead of _never_ parsing, requiring user action to parse. It will cut out the majority of the noclick exploits, and make iphones safer for most people.

This of course doesn't protect against spear phishing. But it should give apple time to fix their shit.

est313• 5 years ago

https://en.wikipedia.org/wiki/Dancing_pigs

xvector2• 5 years ago

A reasonable trade-off would be disabling parsing for people not in your contacts list.

harg• 5 years ago

For the general population this probably applies, but in the case of this exploit it looks like it's targeted at specific individuals. If you were someone being targeted by an oppressive government, for example, you might be a bit more cautious when clicking on suspicious-looking incoming media so I think the suggestion has value.

kossTKR• 5 years ago

"Apple hasn't issued a fix for this particular vulnerability"..."new defenses are coming with iOS 15, which will likely come out next month".

That's completely insane, isn't it? Have Apple just given up, or am i missing the scope of this vulnerability?

Also how can Apple not have better security with such an incredible amount of money in the bank?

dannyw7• 5 years ago

It can take time to fix things properly. You don't want to half arse a mitigation, only for the attacker to bypass it in a week.

bumbledraven• 5 years ago

https://archive.is/eThd5

iamnotwhoiam2• 5 years ago

Does this mean that iMessage evaluates messages as code for some reason? Why on earth would that be the case? It's a foundational security principle to not do that.

And even if they did then why is that so hard to fix?

moftz• 5 years ago

I imagine that iMessage isn't executing the code but the malware is packed into some part of the metadata that some dumb library needs to parse and some sort of buffer overflow attack is accomplished. The library is probably assuming the data is safe to parse.

kenferry• 5 years ago

It’s more like, if you send someone a photo, iMessage will decode the photo and display it. If the imaging library has a bug a maliciously crafted image may be exploitable.

iMessage has more integrations than that too. If you send someone a URL, e.g., the recipient will see a preview of the content.

iMessage does a lot to mitigate the attack surface, but people still get through.

dannyw7• 5 years ago

iMessage is also the only messaging app that triggers all its decode functions upon notification, because of its special privileged status.

xvector2• 5 years ago

Can Apple not rewrite the parsing components in a memory-safe language?

johnthuss• 5 years ago

Contrary to the article, blocking ALL media besides plain text from random senders who aren't in your contacts is exactly what most people would want and should be the default. I don't see any downsides to that approach.

bb123• 5 years ago

I wouldn't want this at all. Just off the top of my head I can think of a ton of use cases this makes hard:

* I ask a seller on FB marketplace to send me some pictures of an item

* I need to send pictures of some documents to my solicitor

* A new friend I've just met in a bar tries to send me her contact card

* My mechanic tries to send me a PDF of the invoice for his work

Sure, there are ways around all of these, but it makes iMessage (or any messaging service) a lot less useful.

dannyw7• 5 years ago

All of this can be on a "Tap to view" basis for the first media received.

Right now, iMessage processes everything in the background upon receiving.

That enables zero click, instantly delete message attacks. The only trace you have is a random imessage sound, or vibrate, with no corresponding notification.

Can be tuned to send at 4am when most people have do not disturb on.

upofadown• 5 years ago

Perhaps this idea could be extended to treating content differently for all messages from unverified identities. Getting people to verify identities in an end to end encryption system is a huge problem. This could provide a conceptual hook that would mean that unverified contacts were untrustworthy contacts. This would be a state, rather than something that you get nagged about from time to time.

Otherwise an attacker will usually be able to figure out a way to fake a message from someone already in your contact list.

Of course iMessage doesn't do identity verification which is why it does not have effective end to end encryption in the first place. So they would have to solve that, perhaps larger problem, first.

webinvest2• 5 years ago

Or anyone that you haven’t replied to yet. I text many people who aren’t in my contacts.

fencepost• 5 years ago

If you're not familiar with NSO Group and Pegasus, I highly recommend episodes 99 and 100 (just released) of the Darknet Diaries podcast.

ec109685• 5 years ago

Why aren’t lightweight hypervisors used more outside the public cloud? It seems that would go a long way in protecting the rest of the device from poorly written c code parsing user input.

saagarjha18• 5 years ago

For one, Apple's chips lacked hardware support for virtualization until last year.

yokoprime2• 5 years ago

On device? The vast majority of people don't give a flying fuck about privacy, for them the decrease in battery life would not be worth it

dannyw7• 5 years ago

so we should get rid of all security features then? No memory management, no code signing, no HTTPS, no certificate pinning?

Vierualisation has a negligible impact on power consumption.

thehappypm2• 5 years ago

The answer is probably plain old complexity.

Getting an application that's running in a hypervisor to seamlessly, for example, accept deep-link clicks is more complicated for the same reason that they're more secure. That extra boundary is another wall, another interface. And of course that means more complexity for app developers, and more compute cost/battery utilization.

eloisius3• 5 years ago

I got corrected last time this topic came up. I originally thought Messages was part of the OS and not a pre-installed userspace app. However, if it's in userspace, why is it such a vulnerable vector for compromising the phone? Is there some privilege-escalation component to this that I haven't read about?

saagarjha18• 5 years ago

iMessage is a pre-installed userspace app that uses frameworks that ship with the OS.

dannyw7• 5 years ago

iMessage is one of few apps that have broad permissions to execute code in response to notifications.

For other apps like Telegram; the server can send a predefined notification message.

For iMessage, when you get something even from someone outside your contacts, its daemon invokes specific code to handle the message, and its attachments.

Whilst this doesn't help if someone opens the app, it does at least change this from a zero click attack, to a one click attack.

(This is also another example of Apple not following its own app store rules. It has privileged access to frameworks.)

eloisius3• 5 years ago

So, in theory other messaging apps have the same vulnerabilities, but I’d have to open the message to get burnt?

saagarjha18• 5 years ago

This is not true. With the right setup, you can send a push notification to your app to wake it up and execute code. See this delegate method for example: https://developer.apple.com/documentation/uikit/uiapplicatio....

simondotau2• 5 years ago

A bit off topic, but when did we ever expect integrated apps to be restricted to App Store rules? They're literally sold as part of the device, not as an app through the App Store.

iamnotwhoiam2• 5 years ago

Am I safer if I disable iMessage or can the zero-click hacks exploit the Messages app through SMS?

webinvest2• 5 years ago

Are these exploits patched in IOS 14.7.1 or earlier?

Apple iMessage Zero-Click Hacks

Related Stories