Recent iPhone models have additional hardware-based security protection for sensitive regions of the kernel memory. We discovered that to bypass this hardware-based security protection, the attackers used another hardware feature of Apple-designed SoCs.
Basically they found out that anyone who knows how this work can send you an iMessage with an attachment that won’t show up on your end without the need of your interaction and do whatever they want on your iphone.
What the other dude said, but the level of sophistication was miles beyond what you typically see from even nation states. The takeaway is you cannot defend yourself from a nation that wants your information.
Lockdown mode was released by Apple after these devices had already been infected for 3+ years, and was a response to evidence that iMessage preview functionality was already actively being exploited to spy on people.
Someone figured out a way that could hijack iMessage through sending a special malicious PDF that took advantage of a flaw in some legacy font rendering code unique to Apple, that even Apple hadn’t used in decades.
Then, that PDF launched a JavaScript debugger that is built into iPhones, and took advantage of a flaw in that to jump into putting some code into the parts of user memory, that the system doesn’t fully trust.
Then, that code takes advantage of another flaw to bypass the system’s protections for not fully trusting that code, to secretly launch a web browser and navigate to a secret webpage that runs a much bigger piece of malware.
That malware can read and modify basically anything on the system, and was used to read all sorts of sensitive data: message history, location information, app data, etc.
Because the whole exploit chain was so advanced and involved so many different previously unknown vulnerabilities, basically the list of possible suspects is very, very short: some kind of nation state with advanced hacking capabilities.
So you can think of security as being done in layers. iPhones have apps exist in a sort of “prison”, so a malicious app can’t go modify other apps or the OS. It exists solely in its own little room. It can pass notes under the door to the OS to ask for calculations, and receive the results of those calculations. But it can’t leave that room to modify things outside. And the OS can run verifications on the notes it gets passed, to ensure they’re not malicious before it tries to calculate them. Lastly, the OS uses a secure calculator called the kernel to actually make those calculations and get the results.
First, this attack exploited a PDF vulnerability, to attack iMessage. When the victim receives the message with the infected PDF, iMessage attempts to generate a preview of it; This initiates the attack. This happens automatically, and means the user doesn’t even need to interact with the message. This attack hijacks the Messages app, and essentially allows Messages to break out of the room it was sealed in. Now iMessage is able to modify other apps and interact with the OS directly
Next, it attempts to get outside of the OS, to the kernel. The kernel is essentially the hardware level of the phone, where everything is 1’s and 0’s. The user interacts with the app, the app interacts with the OS, and the OS interacts with the kernel to do the actual processing. But even inside of the OS, the kernel has protections; That calculator is secure, and can’t be modified. The OS has large parts of the kernel marked as “read only” so it can’t be changed. The OS only allows itself to push the specific buttons on the calculator that it knows will work correctly. This is intentional, to prevent accidental or malicious kernel modifications. If an app asks the OS to push any insecure buttons or change the calculator, the OS will normally refuse.
But this attack uses another zero-day vector to break out of the OS and interact with the kernel directly. Now the app is able to type on the calculator without talking to the OS first. But this still isn’t enough, because the kernel is still marked as read-only. Lastly, the attack uses another zero-day exploit to attack a hardware vulnerability, and flip those sections of the kernel from read-only to lol-yeah-you-can-write-whatever-you-want. This allows the compromised app to modify the calculator to produce whatever results they want. They can change the calculator to have 1+1=3.
And once the kernel has been rewritten, the entire phone is compromised. Even an OS update won’t fix things, because the OS is only interacting with the kernel (which is still compromised even after the OS update.) Even if you fix the OS to prevent another attack, the calculator still says 1+1=3. The hacker essentially owns the entire device at that point, because kernel-level access will allow them to supersede the OS.
Here’s the summary for the wikipedia article you mentioned in your comment:
BlackBerry Limited (formerly Research In Motion) is a Canadian software company specializing in cybersecurity. Founded in 1984, it originally developed the BlackBerry brand of interactive pagers, smartphones and tablets. In 2016, it transitioned toa cybersecurity enterprise software and services company under CEO John S. Chen. Its products are used by various businesses, car manufacturers, and government agencies to prevent hacking and ransomware attacks. They include the BlackBerry Cylance, the QNX real-time operating system; BlackBerry Enterprise Server (BlackBerry Unified Endpoint Manager), and a Unified Endpoint Management (UEM) platform.
Can someone much smarter than I am, explain like I’m a toddler?
Basically they found out that anyone who knows how this work can send you an iMessage with an attachment that won’t show up on your end without the need of your interaction and do whatever they want on your iphone.
P.S. I’m not smart nor I’m an expert.
What the other dude said, but the level of sophistication was miles beyond what you typically see from even nation states. The takeaway is you cannot defend yourself from a nation that wants your information.
Well, it certainly helps when that nation gets to build hardware backdoors into the stuff you buy.
Iirc lockdown mode would prevent this exploit from working
Lockdown mode was released by Apple after these devices had already been infected for 3+ years, and was a response to evidence that iMessage preview functionality was already actively being exploited to spy on people.
Someone figured out a way that could hijack iMessage through sending a special malicious PDF that took advantage of a flaw in some legacy font rendering code unique to Apple, that even Apple hadn’t used in decades.
Then, that PDF launched a JavaScript debugger that is built into iPhones, and took advantage of a flaw in that to jump into putting some code into the parts of user memory, that the system doesn’t fully trust.
Then, that code takes advantage of another flaw to bypass the system’s protections for not fully trusting that code, to secretly launch a web browser and navigate to a secret webpage that runs a much bigger piece of malware.
That malware can read and modify basically anything on the system, and was used to read all sorts of sensitive data: message history, location information, app data, etc.
Because the whole exploit chain was so advanced and involved so many different previously unknown vulnerabilities, basically the list of possible suspects is very, very short: some kind of nation state with advanced hacking capabilities.
So you can think of security as being done in layers. iPhones have apps exist in a sort of “prison”, so a malicious app can’t go modify other apps or the OS. It exists solely in its own little room. It can pass notes under the door to the OS to ask for calculations, and receive the results of those calculations. But it can’t leave that room to modify things outside. And the OS can run verifications on the notes it gets passed, to ensure they’re not malicious before it tries to calculate them. Lastly, the OS uses a secure calculator called the kernel to actually make those calculations and get the results.
First, this attack exploited a PDF vulnerability, to attack iMessage. When the victim receives the message with the infected PDF, iMessage attempts to generate a preview of it; This initiates the attack. This happens automatically, and means the user doesn’t even need to interact with the message. This attack hijacks the Messages app, and essentially allows Messages to break out of the room it was sealed in. Now iMessage is able to modify other apps and interact with the OS directly
Next, it attempts to get outside of the OS, to the kernel. The kernel is essentially the hardware level of the phone, where everything is 1’s and 0’s. The user interacts with the app, the app interacts with the OS, and the OS interacts with the kernel to do the actual processing. But even inside of the OS, the kernel has protections; That calculator is secure, and can’t be modified. The OS has large parts of the kernel marked as “read only” so it can’t be changed. The OS only allows itself to push the specific buttons on the calculator that it knows will work correctly. This is intentional, to prevent accidental or malicious kernel modifications. If an app asks the OS to push any insecure buttons or change the calculator, the OS will normally refuse.
But this attack uses another zero-day vector to break out of the OS and interact with the kernel directly. Now the app is able to type on the calculator without talking to the OS first. But this still isn’t enough, because the kernel is still marked as read-only. Lastly, the attack uses another zero-day exploit to attack a hardware vulnerability, and flip those sections of the kernel from read-only to lol-yeah-you-can-write-whatever-you-want. This allows the compromised app to modify the calculator to produce whatever results they want. They can change the calculator to have 1+1=3.
And once the kernel has been rewritten, the entire phone is compromised. Even an OS update won’t fix things, because the OS is only interacting with the kernel (which is still compromised even after the OS update.) Even if you fix the OS to prevent another attack, the calculator still says 1+1=3. The hacker essentially owns the entire device at that point, because kernel-level access will allow them to supersede the OS.
Is this type of thing why BlackBerry used to reign supreme when it came to device security?
Thanks for your comment it gave me a lot of thoughts like: “Why did I think that my blackberry was secure (or more secure than other phones)?”
TLDR: I couldn’t find the answer but I think it’s because they were the first major smartphone and had a encrypted messaging app.
Here’s a few sources for further reading.
Obligatory Wikipedia Overview: https://en.m.wikipedia.org/wiki/BlackBerry_Limited
Blackberry had early smartphones and went all in on keyboard phones:
https://d3.harvard.edu/platform-digit/submission/the-rise-and-fall-and-rise-again-of-blackberry/
Sorry I couldn’t have been more helpful, but hopefully this gives you a good starting point.
Here’s the summary for the wikipedia article you mentioned in your comment:
BlackBerry Limited (formerly Research In Motion) is a Canadian software company specializing in cybersecurity. Founded in 1984, it originally developed the BlackBerry brand of interactive pagers, smartphones and tablets. In 2016, it transitioned to a cybersecurity enterprise software and services company under CEO John S. Chen. Its products are used by various businesses, car manufacturers, and government agencies to prevent hacking and ransomware attacks. They include the BlackBerry Cylance, the QNX real-time operating system; BlackBerry Enterprise Server (BlackBerry Unified Endpoint Manager), and a Unified Endpoint Management (UEM) platform.article | about