@bryanjclark the writeups on those exploits are fascinating. Like the one that devised an entire hardware architecture on top of a tiny image operator exploit, and they built a compiler to write code for it

@bryanjclark I believe it’s a combination of: 1. Image containers offer a lot of places to hide bits here and there. Had a buddy get into Steganography back in the early 2000s.
2. Images are one of the few files that iOS will download and parse when it’s pushed to you so they can put them in notifications and such.

@bryanjclark this one, god I am glad I was not misremembering it. As I replied to you I was thinking “did I hallucinate that? Sounds like science fiction”

It’s not:

https://en.m.wikipedia.org/wiki/FORCEDENTRY

@bryanjclark whither BlastDoor? https://9to5mac.com/2021/01/28/apple-adopts-new-blastdoor-security-system-on-ios-14-to-reinforce-imessage-integrity/

@bryanjclark this is such a fascinating exploit if it uses server-based passkit push updates to deliver compromised payloads that don't get handled by blastdoor until it's too late. i would imagine the problem is that images require a non-finite amount of space after decompression but that some cleverly compressed regions can exhaust the amount of memory allocated and allow you to traipse over old dylib code that executes at a higher privilege level. my understanding is that blastdoor prevents this for most data that comes in from imessage, but probably older codepaths are still vulnerable (i'm guessing lockdown mode just nixes all features that don't route initially through blastdoor)

@bryanjclark wasn't there a whole out-of-process architecture thing a few releases ago that was supposed to eradicate this vector all together?

https://9to5mac.com/2021/01/28/apple-adopts-new-blastdoor-security-system-on-ios-14-to-reinforce-imessage-integrity/

@nsfmc @bryanjclark Overwriting code would invalidate its code signature

@bryanjclark followup

“Fix OOB write in BuildHuffmanTable”… “ The patch suggests that it was possible to overflow the Huffman table when decoding an untrusted image…”

https://blog.isosceles.com/the-webp-0day/

@bryanjclark yes!! top notch branding!