<story><title>The Many Possibilities of iMessage File Vulnerability</title><url>https://googleprojectzero.blogspot.com/2019/08/the-many-possibilities-of-cve-2019-8646.html?m=1</url></story><parent_chain><item><author>Someone1234</author><text>To me the key question is: Why is iMessage not a normal iOS app?&lt;p&gt;We&amp;#x27;ve seen numerous iMessage bugs over the years inc. full OS take-overs (often used for jailbreak), soft bricking (endless restarts due to corrupt notifications&amp;#x2F;requiring a factory reset), crashes that reboot the phone (once), and a bunch of potential for escalation&amp;#x2F;code execution.&lt;p&gt;None of this is possible with apps in the normal iOS sandbox. The apps themselves would crash, but they&amp;#x27;re context confined, they cannot bring down the underlying OS, write invalid notifications, or cause a kernel panic.&lt;p&gt;But they&amp;#x27;ve designed iMessage to act like a part of the underlying OS for no real reason. You could very easily hand off the most hazardous parts of iMessage&amp;#x27;s inner workings into the app&amp;#x27;s context, or even another user space&amp;#x2F;context confined service, and just let them crash like normal apps do.&lt;p&gt;Ten years ago it was common for font processing to happen in the kernel. This was problematic because front processing is hard, and bugs occur. Since then we&amp;#x27;ve seen many migrate fonts into userland. Why is iMessage&amp;#x27;s security model so far behind the times, it is a lot less critical&amp;#x2F;performance impacted than fonts, but yet has worse security than most font systems in 2019?</text></item></parent_chain><comment><author>csande17</author><text>I suspect it&amp;#x27;s because historically, iOS didn&amp;#x27;t have a way to embed views from one app into another app. When Apple wanted to let you view iMessages from the lock screen, or expose iMessage via Share buttons in third-party apps, they accomplished that by shoving most of iMessage into the operating system itself.&lt;p&gt;These days, there &lt;i&gt;are&lt;/i&gt; systems to do this properly (it&amp;#x27;s how third-party keyboards work, for example), but Apple is a small indie company that does not have the resources to refactor iMessage to use the iOS features they created.</text></comment>
<story><title>The Many Possibilities of iMessage File Vulnerability</title><url>https://googleprojectzero.blogspot.com/2019/08/the-many-possibilities-of-cve-2019-8646.html?m=1</url></story><parent_chain><item><author>Someone1234</author><text>To me the key question is: Why is iMessage not a normal iOS app?&lt;p&gt;We&amp;#x27;ve seen numerous iMessage bugs over the years inc. full OS take-overs (often used for jailbreak), soft bricking (endless restarts due to corrupt notifications&amp;#x2F;requiring a factory reset), crashes that reboot the phone (once), and a bunch of potential for escalation&amp;#x2F;code execution.&lt;p&gt;None of this is possible with apps in the normal iOS sandbox. The apps themselves would crash, but they&amp;#x27;re context confined, they cannot bring down the underlying OS, write invalid notifications, or cause a kernel panic.&lt;p&gt;But they&amp;#x27;ve designed iMessage to act like a part of the underlying OS for no real reason. You could very easily hand off the most hazardous parts of iMessage&amp;#x27;s inner workings into the app&amp;#x27;s context, or even another user space&amp;#x2F;context confined service, and just let them crash like normal apps do.&lt;p&gt;Ten years ago it was common for font processing to happen in the kernel. This was problematic because front processing is hard, and bugs occur. Since then we&amp;#x27;ve seen many migrate fonts into userland. Why is iMessage&amp;#x27;s security model so far behind the times, it is a lot less critical&amp;#x2F;performance impacted than fonts, but yet has worse security than most font systems in 2019?</text></item></parent_chain><comment><author>saagarjha</author><text>iMessage &lt;i&gt;is&lt;/i&gt; a normal iOS app, at least mostly. It has access to a couple of entitlements that normal apps don&amp;#x27;t get, since it needs to do things like access Apple Pay and launch iMessage apps, but it&amp;#x27;s possible to have the app itself crash without hosing the entire OS. The problems we&amp;#x27;re seeing here, however, are issues where iMessage&amp;#x27;s (buggy) frameworks are being loaded into the SpringBoard process (which is essentially the UI shell for iOS) and this is what is crashing, causing the phone to be unusable. So the solution here would be to stop allowing for message parsing to happen in contexts like these. (Also, as far as I am aware, there have not been any jailbreaks in iMessage that rely on the app being special in any particular way because it&amp;#x27;s really not.)</text></comment>