Recent iPhone models have additional hardware-based security protection for sensitive regions of the kernel memory. We discovered that to bypass this hardware-based security protection, the attackers used another hardware feature of Apple-designed SoCs.
This is a nightmare, but thank you for detailing this.
Having only read a little bit of this and not understanding it, it seems like the exploit works even if the recipient does not open or interact with the malicious message? Is that what i’m understanding?
If so, i’m officially stapling my tin-foil hat to my head and never using a cell phone again.
The attack is spread via iMessage. A vulnerable device merely needs to receive a bad message with PDF attachment. --> A Remote code execution. No user interaction.
Yikes. Indeed.
The attack entry point is via bad TrueType font + PDF attachment that only needs to processed once. Once a process touches that, the attack vector begins and exploits are chained until they get kernel mode access. After getting kernel mode access all hope is lost, the attacker owns the device.
Only sliver of hope is that fixing the attack entry point blocks the current attack. And that bug is:
This attachment exploits the remote code execution vulnerability CVE-2023-41990 in the undocumented, Apple-only ADJUST TrueType font instruction. This instruction had existed since the early nineties before a patch removed it.
But unless all the CVEs are patched, it is just matter of time a new attack entry point is found.
This is a nightmare, but thank you for detailing this. Having only read a little bit of this and not understanding it, it seems like the exploit works even if the recipient does not open or interact with the malicious message? Is that what i’m understanding?
If so, i’m officially stapling my tin-foil hat to my head and never using a cell phone again.
The attack is spread via iMessage. A vulnerable device merely needs to receive a bad message with PDF attachment. --> A Remote code execution. No user interaction.
Yikes. Indeed.
The attack entry point is via bad TrueType font + PDF attachment that only needs to processed once. Once a process touches that, the attack vector begins and exploits are chained until they get kernel mode access. After getting kernel mode access all hope is lost, the attacker owns the device.
Only sliver of hope is that fixing the attack entry point blocks the current attack. And that bug is:
But unless all the CVEs are patched, it is just matter of time a new attack entry point is found.