Technology

59300 readers

4750 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

347

Kaspersky/Securelist researchers detail zero-click iPhone exploit involving four distinct zero-day vulnerabilities, including undocumented hardware features in iPhone chips (securelist.com)

submitted 10 months ago by GamingChairModel@lemmy.world to c/technology@lemmy.world

23 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] JATtho@lemmy.world 20 points 10 months ago (2 children)

Shorter version: Operating systems set up hardware locks and protections to confine processes, and once set up, they cannot be undone. (the hardware + OS denies modifications to the security policy)

Attacker broke out from the app sandbox. (attacker can run code in the infected process)
Broke out of the process. (gained root access; attacker can run anything)
Broke into the kernel space (gained 100% control over the hardware)
Corrupted some kernel memory via a damm magic MMIO accesses nobody knows (hardware vulnerable)
Bypassed protections that kernel set up earlier such that it cannot accidentally modify itself.
Finally broke the kernel via hardware exploit thus the attacker got rootkit level access.

Getting arbitrary code execution and root access is one thing, but breaking out from the damm kernel configured hardware protections is insane.

They basically managed to flip a "read-only" switch to "modify-as-much-as-you-like". The infected device at this point is broken beyond repair, as the firmware(s) may have been tampered with. End result is a terrestrial spy brick.

[–] phx@lemmy.ca 9 points 10 months ago

Not only that, but using an initial exploit which could be remotely triggered with NO user interaction or visibility. That's scary shit

[–] archomrade@midwest.social 7 points 10 months ago* (last edited 10 months ago) (1 children)

This is a nightmare, but thank you for detailing this. Having only read a little bit of this and not understanding it, it seems like the exploit works even if the recipient does not open or interact with the malicious message? Is that what i'm understanding?

If so, i'm officially stapling my tin-foil hat to my head and never using a cell phone again.

[–] JATtho@lemmy.world 7 points 10 months ago

The attack is spread via iMessage. A vulnerable device merely needs to receive a bad message with PDF attachment. --> A Remote code execution. No user interaction.

Yikes. Indeed.

The attack entry point is via bad TrueType font + PDF attachment that only needs to processed once. Once a process touches that, the attack vector begins and exploits are chained until they get kernel mode access. After getting kernel mode access all hope is lost, the attacker owns the device.

Only sliver of hope is that fixing the attack entry point blocks the current attack. And that bug is:

This attachment exploits the remote code execution vulnerability CVE-2023-41990 in the undocumented, Apple-only ADJUST TrueType font instruction. This instruction had existed since the early nineties before a patch removed it.

But unless all the CVEs are patched, it is just matter of time a new attack entry point is found.