Recent iPhone models have additional hardware-based security protection for sensitive regions of the kernel memory. We discovered that to bypass this hardware-based security protection, the attackers used another hardware feature of Apple-designed SoCs.
Shorter version: Operating systems set up hardware locks and protections to confine processes, and once set up, they cannot be undone. (the hardware + OS denies modifications to the security policy)
Attacker broke out from the app sandbox. (attacker can run code in the infected process)
Broke out of the process. (gained root access; attacker can run anything)
Broke into the kernel space (gained 100% control over the hardware)
Corrupted some kernel memory via a damm magic MMIO accesses nobody knows (hardware vulnerable)
Bypassed protections that kernel set up earlier such that it cannot accidentally modify itself.
Finally broke the kernel via hardware exploit thus the attacker got rootkit level access.
Getting arbitrary code execution and root access is one thing, but breaking out from the damm kernel configured hardware protections is insane.
They basically managed to flip a “read-only” switch to “modify-as-much-as-you-like”.
The infected device at this point is broken beyond repair, as the firmware(s) may have been tampered with.
End result is a terrestrial spy brick.
This is a nightmare, but thank you for detailing this.
Having only read a little bit of this and not understanding it, it seems like the exploit works even if the recipient does not open or interact with the malicious message? Is that what i’m understanding?
If so, i’m officially stapling my tin-foil hat to my head and never using a cell phone again.
Shorter version: Operating systems set up hardware locks and protections to confine processes, and once set up, they cannot be undone. (the hardware + OS denies modifications to the security policy)
Getting arbitrary code execution and root access is one thing, but breaking out from the damm kernel configured hardware protections is insane.
They basically managed to flip a “read-only” switch to “modify-as-much-as-you-like”. The infected device at this point is broken beyond repair, as the firmware(s) may have been tampered with. End result is a terrestrial spy brick.
Not only that, but using an initial exploit which could be remotely triggered with NO user interaction or visibility. That’s scary shit
This is a nightmare, but thank you for detailing this. Having only read a little bit of this and not understanding it, it seems like the exploit works even if the recipient does not open or interact with the malicious message? Is that what i’m understanding?
If so, i’m officially stapling my tin-foil hat to my head and never using a cell phone again.