8 ms·
How a single line of code could brick your iPhone
- _rrnv 1y agoGreat work! This is my favourite type of vulnerability, simple, effective and brutal. Reminds me of a time two decades ago when with a friend from uni we theorised about a perfect server vulnerability where you’d exploit a machine by pinging it. And of course, two years ago it was in fact discovered as CVE-2022-23093.
- Rygian 1y agoPing of death was already a thing two decades ago. https://web.archive.org/web/19981206105844/http://www.sophist.demon.co.uk/ping/ https://web.archive.org/web/19981206105844/http://www.sophis...
- dgfitz 1y agoThis link doesn’t show me anything useful.
- giantrobot 1y agoTry scrolling down. On mobile (maybe because of ad blockers) Wayback pages have a full screen of white space above the page contents anymore for me. This happens on pretty much every Wayback page I've tried. It's also relatively recent and I'm not sure the exact cause.
- jasongill 1y agoTry https://insecure.org/sploits/ping-o-death.html https://insecure.org/sploits/ping-o-death.html
- jasongill 1y agoIt was actually almost 3 decades ago, making me feel extremely old - the period right at the end of '96 and into mid '97 when this was a popular way to cause mischief via IRC was truly a magical time
- anyfoo 1y agoHard to believe that during those times in IRC, you were used to automatically (and proudly) advertising your IP address, your exact client version, and the means for a direct connection to your client without any server in between (CTCP, literally “client-to-client protocol”). And all of that most often with no packet filter whatsoever, not even NAT, in between. Everything was plaintext, including “authentication”, which was (at best) just asking the “ident server” on the same machine as your client who you claimed to be, which was considered sufficient because, after all, to run identd on its “privileged” low port meant you were an “administrator” (i.e. root of a unix machine).
- sneak 1y agoCTCP messages still go through the server. DCC (direct client connection) are the p2p connections you are thinking of, but they of course don’t work behind nat. I was behind NAT when I first got on IRC in ‘98. I set it up with ipfwadm.
- anyfoo 1y agoAh you are right, I mixed CTCP and DCC up. The former was also used to set up the latter I think? (Among other things.) I joined IRC in the early 90s, there was no NAT then, packet filtering was uncommon, and practically nothing on the Internet was encrypted. It was a very different time.
- chasd00 1y agoDeath on flaxxen wings
- driverdan 1y agoWhen I was in college circa 2001 we used to prank each other with the ping of death and other crash exploits. Also random IPs on the college network when we were bored. It was crazy how long it was around for and how easy it was to exploit.
- _rrnv 1y agoDOS yes, but that freebsd cve I referenced is a theoretical RCE.
- NitpickLawyer 1y agoBack in the dial-up days you could disconnect someone by adding ATH commands to a ping payload field.
- brontitall 1y agoOnly if their modem didn’t implement the Hayes command set properly or you could otherwise control the per-character timing of the OS sending. It required a pause (1sec by default), “+++” with no pauses, another pause, _then_ the ATH command
- wat10000 1y agoWhich was fairly common, as Hayes had a patent on those pauses.
- brontitall 1y agoHuh, TIL. I guess they might have used TIES https://en.wikipedia.org/wiki/Time_Independent_Escape_Sequence https://en.wikipedia.org/wiki/Time_Independent_Escape_Sequen...
- NitpickLawyer 1y agoI had an external USRobotics 56k modem, I was immune. But the many many "bulk" no-name modems were vulnerable. You could ping entire ranges of dial-up IPs and watch the results on big IRC channels. Uhmmm, allegedly :)
- mycall 1y agoCommas provided 2 second pauses
- brontitall 1y agoOnly in the dial string to ATD, surely?
- cryptoegorophy 1y ago
- dado3212 1y agoNeat, $17,500 is pretty good, I’m so used to these blog posts being for peanuts, or where companies fix the vulnerability but don’t pay out at all. Apple’s gotten better about this since 2019.
- nativeit 1y agoI read a comment under the story about the recent YouTube vulnerability where one could unmask the related Google account and its owner using the standard YouTube API (something similar to that anyway), and they explained a lot of lesser-known nuances in establishing values for bounties like these, and it helped explain a lot (not all) of the reasons for what might seem like low-ball/high-ball valuations on the surface. If I can find their comment I’ll post back, it was really insightful. That said, there are also plenty of examples of people just getting shafted.
- sdeframond 1y agoProbably one of those https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=Tptacek%20Bounty&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
- nativeit 1y ago100% Thanks for the assist.
- croisillon 1y agois this the one: https://news.ycombinator.com/item?id=43025038 https://news.ycombinator.com/item?id=43025038
- williamscales 1y agoThat’s definitely the one I thought of
- deleted 1y ago[deleted]
- shrx 1y ago> Looking into the binaries, SpringBoard was observing that notification to trigger the UI. The notification is triggered when the device is being restored from a local backup via a connected computer, but as established before, any process could send the notification and trick the system into entering that mode. This should probably be reworked regardless if the patch described in the article was implemented.
- jonplackett 1y agoAnyone know how long ago that system would have been introduced? It seems like such an obvious security concern. Maybe it was pre-AppStore? And more assumed trust in other apps?
- plorkyeran 1y agoThe notification API is quite old (iOS 3). It's explicitly an untrusted API that you shouldn't use for something like showing the restore in progress UI, so I suspect that was something written quite a bit later. Widget extensions are iOS 14. There's older ways to run background tasks, but none of them would give the soft brick. Background fetch, for example, originally didn't run until after you launched an app for the first time after restarting.
- MBCook 1y agoWasn’t it in OS X before that?
- plorkyeran 1y agoDocumentation claims 10.6, which is the equivalent OS X version (both are the 2009 releases).
- duskwuff 1y agoThis is an internal broadcast notification API (akin to dbus on Linux), distinct from the API used to display notifications to the user.
- brcmthrowaway 1y agoUltimately, does this require installing a sketchy app in the first place?
- g-b-r 1y agoOr a reputable one with that line of code included (in one of the updates, after having built a good reputation); maybe dormant until a certain date.
- MBCook 1y agoOr a bug in some good app that allows an attacker to execute the right thing.
- saagarjha 1y agoYes.
- piyuv 1y agoLots of credible apps use lots of dependencies. Find an abandoned one, get your code into it, …
- urbandw311er 1y agoNice. I can only imagine what a crap day in the office it was when the iOS core team reviewed that one.
- doesnt_know 1y agoI get that it's potentially lower priority since a user needs to actively install a malicious app, but that timeline doesn't exactly feel me with confidence...
- 95014_refugee 1y agoThe exploit as described doesn't "brick" the device; that would require permanently disabling it. A tethered restore would be all that's required to recover in this case.
- the__alchemist 1y agoFrom observation, "brick" has evolved, as things do in language. In practice, it rarely means the traditional definition you refer to, but the softer one used here.
- Kerbonut 1y agoAlmost like a "soft"-brick, if you would.
- taneq 1y agoYou could say the device was pillowed. :D Although given the typical behaviour of old phone batteries, I guess that’s a little ambiguous.
- dmckeon 1y agoThus, perhaps "loafed" as in something brick-like, but which may also be soft. And a "loafed" device, being idle, would be loafing.
- nullhole 1y agoA soft brick would be a brick before being fired in an oven, no? So maybe the term shouldn't be 'soft brick' but rather 'muddied'. "That updated muddied my device, I had to clean it up with a restore"
- dgoldstein0 1y agoI appreciate the sentiment but I don't see that catching on. I think a variant of bricked makes sense as it basically means you can't use the device until you can figure out how to fix it. Which the "muddied" analogy doesn't really fit - it's usually possible to use muddy things if not necessarily pleasant.
- moduspol 1y agoDoesn't this imply that third-party apps with their own notification schemes could be impersonated similarly? They wouldn't be able to brick the phone, obviously, but they could potentially trigger other actions.
- andrekandre 1y ago> That single line of code was enough to make the device enter “Restore in Progress”. > as established before, any process could send the notification and trick the system into entering that mode. sleep data, sleep...
- e28eta 1y agoI’m fascinated that they aren’t requiring an entitlement for all usage of setting & posting notifications through this API. A way to share 64 bits of information (at a time) to any process on the device? That is right in the wheelhouse of tracking a user across apps. I don’t specifically know the types of things that you’d want to share across apps, but there’s a long history of cross process information channels being removed or restricted. If the system is storing values for you, and isn’t keeping track of which app they came from, now you’ve got persistent storage across app deletion & re-install, as long as there isn’t a reboot in between. I think you could easily use it to work around IDFA or IDFV resets, as a simple example.
- tgv 1y ago> That is right in the wheelhouse of tracking a user across apps. The design is old. It probably predates facebook, so it's not been intentional, as your comment might be interpreted. But it certainly seems ripe for abuse. I'm curious if it would actually be used for that, because any app that can access internet already has a better way to share information.
- LunaSea 1y agoFacebook predates iPhones by 3 years.
- jen20 1y agoNSNotificationCenter predates the iPhone by 13 years, though…
- varenc 1y agoI was interning at Facebook in '07 when the first iPhone was released. Can confirm! Someone was 3rd in line at the Palo Alto Apple store and brought it over to the office. Though iOS definitely predates 3rd party apps and the ad based economy. Which is a bit of a tautology.
- tgv 1y agoAccording to the docs, NSNotificationCenter already was present in Mac OS X 10.0. It seems to be present in NextSTEP 3.3, which was released in 1995 (http://www.cilinder.be/docs/next/NeXTStep/3.3/nd/Foundation/Classes/NSNotificationCenter.htmld/index.html http://www.cilinder.be/docs/next/NeXTStep/3.3/nd/Foundation/...).
- keepamovin 1y agoThis was an epic read. That very old skool API was so powerful! Cool demo seeing it trigger all this low-level states for iOS. I wonder what happened to notify_post now..
- Loocid 1y agoThe sheer simplicity of this exploit is wild.
- gitroom 1y agoDamn, makes me miss those old IRC days but also, stuff like this just reminds me how risky even tiny changes can be on any tech. You think security ever gets ahead or we just keep patching leaks forever?
- genewitch 1y agoDepends, are people going to keep producing new code?
- pmlnr 1y agoI wonder if this can be "ported" to dbus, udev, or devd.
- rashkov 1y agoSeems like this should have been obvious to someone on the iOS team, no? Like, "hey we need a way to trigger springboard UI events.." "ok let's just use this unauthenticated bus and have springboard subscribe to it" Something like that? Only thing I can think of is that this line of code was written so long ago and it's way at the bottom of the abstraction stack, so no one had a look
- cryptonector 1y agoThis reminds me of how there is zero authorization for `NOTIFY` in PostgreSQL. IMO there should at least be the option to `CREATE CHANNEL ...` and then use `GRANT` to indicate who can `NOTIFY`. In practice this is not a big problem because usually one grants very few users direct access to a PG DB.
- kvetching 1y agoIn general, the vulnerability of our computers is major national security concern as we enter in the era of AGI. This administration needs to setup a system hardening commission. In the era of AI... if we aren't using the leading AI to hack our own systems first, then when the capability to use the latest models to hack is widely available, we are going to have a bad time.