<story><title>An iOS zero-click radio proximity exploit odyssey</title><url>https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html</url></story><parent_chain><item><author>Animats</author><text>&lt;i&gt;Unfortunately, it&amp;#x27;s the same old story. A fairly trivial buffer overflow programming error in C++ code in the kernel parsing untrusted data, exposed to remote attackers. In fact, this entire exploit uses just a single memory corruption vulnerability to compromise the flagship iPhone 11 Pro device. With just this one issue I was able to defeat all the mitigations in order to remotely gain native code execution and kernel memory read and write.&lt;/i&gt;&lt;p&gt;Yes, same old buffer C&amp;#x2F;C++ overflow problem. We have mainstream alternatives now. C#. Go. Rust. It&amp;#x27;s time to move on.</text></item></parent_chain><comment><author>blub</author><text>The code where the bug happens is legal C++, but it uses absolutely none of the memory safety improvements which were added to the language in the past... twenty years probably. It&amp;#x27;s basically C with classes.&lt;p&gt;If they haven&amp;#x27;t kept up with the changes in their current language, what makes one think that they would &amp;quot;move on&amp;quot; to the alternatives, two of which aren&amp;#x27;t even alternatives?&lt;p&gt;Before they switch to Rust it would be much faster and more efficient to use smart pointers, std::array, std::vector and stop using memcpy.</text></comment>
<story><title>An iOS zero-click radio proximity exploit odyssey</title><url>https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html</url></story><parent_chain><item><author>Animats</author><text>&lt;i&gt;Unfortunately, it&amp;#x27;s the same old story. A fairly trivial buffer overflow programming error in C++ code in the kernel parsing untrusted data, exposed to remote attackers. In fact, this entire exploit uses just a single memory corruption vulnerability to compromise the flagship iPhone 11 Pro device. With just this one issue I was able to defeat all the mitigations in order to remotely gain native code execution and kernel memory read and write.&lt;/i&gt;&lt;p&gt;Yes, same old buffer C&amp;#x2F;C++ overflow problem. We have mainstream alternatives now. C#. Go. Rust. It&amp;#x27;s time to move on.</text></item></parent_chain><comment><author>colesantiago</author><text>IMO this is huge.&lt;p&gt;Thankfully, Apple is starting to hire Rust developers as well as AWS.&lt;p&gt;The tide is changing, one day we will see some Rust code in iOS&amp;#x2F;macOS so that these issues are a thing of the past.</text></comment>