You must log in or register to comment.
Couldn’t think of a better title, TL;DR via receiving an iMessage with a specially crafted image, an attacker can get full access to your device. Update iOS immediately to resolve the issue
PSA: Android just published a patch for a very similar vulnerability in their September Security release. You should update your Android devices ASAP.
Which CVE is that and where can i read a description of how this vulnerability is being used?
CVE-2023-35674 No real details published yet but Google discussed it in their September security bulletin.
I feel like people who are naive enough to have auto download MMS on from random numbers deserve their devices hacked anyway. Does this affect people who dont have auto download MMS on? I usually just delete the text before it even downloads any attachments.
Get off that high horse.
How do you block MMS from unknown senders on iOS?
Settings > Messages > SMS/MMS > MMS Messaging (uncheck)
And/Or
Message Filtering > Filter Unknown Senders (checked)
Those seem to be the likely options, but I’ve zero idea if those will work.
sorry, I was meaning to reply on the android comment to the post I actually commented on.
at this point most iphone users are very much used to reicive images within imessage and have already forgotten that mms existed or are too young to actually ever had to deal with it, so to them it’s just yet another picture.
you are correct. I was meaning to imply harshly that people should not have auto download MMS on, though. Too many remain blissfully ignorant and uncaring about their own security to even go through options and change the defaults.
lol, even if people went through to change their defaults, why would they expect an image to be able to hijack their device?
There’s so many automated things on smart phones nowadays, should we disable everything to ensure avoiding future exploits?
They would expect an image to hijack their device because they’ve been warned about downloading attachments in basically every Internet safety anything. We should disable things like nfc and other security vulnerabilities when not in use, it doesn’t take a genius to figure out which can be dangerous.
I’d never get random dick pictures that way though.
Damn…so this isn’t the fun kernel level access exploit.
This is the boring, my data could be compromised exploit.
Fuck, the NSO group managed that shit again?!
lmao, iMessage again ? zero user interaction needed, again ?!
Well done Apple
It’s literally been 3 days since Android had a vulnerability of this exact nature: remote code execution with zero user interaction required (CVE-2023-35674).
Every piece of software has vulnerabilities lurking within. What matters is the velocity at which vendors address and resolve those vulnerabilities. Apple and Google are both exemplary at getting patches out quickly.
Stop bringing up old news. We’re hating on Apple today!
Oops! I forgot to check the schedule.
Every piece of software has vulnerabilities lurking within.
Remind me why we put up with this again? Formal verification does exist.
Formal Verification doesn’t guarantee that the code is free of vulnerability, it just increases confidence in its security. It’s never perfect.
butbutbut… blue box
Article missing, here is the archive link. https://web.archive.org/web/20230908134811/https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/
Edit: able to access now but I’ll leave it here just in case.
It looks like I need to make some space for an update -.-
Is this fixed if using the iOS 17 Beta?
I’d assume in the next public/developer preview, yeah
I just relistened to Dark Net Diaries episode about this! (episode 100, titled NSO) Highly Recommend
ios “the more secure choice” try not to have a 0-day exploit challenge
Lockdown mode stops it.
