The Fully Remote Attack Surface of the iPhone (googleprojectzero.blogspot.com)

Article summary

The article discusses the fully remote attack surface of the iPhone, specifically highlighting vulnerabilities in SMS, MMS, and iMessage. The attack surface is affected by various factors, including the use of old serialization libraries and the configuration of Visual Voicemail. The article also mentions that some carriers block VVM IMAP requests to external servers, which can limit the attack surface. The vulnerabilities found in the article have been reported and fixed by Apple.

Main themes

• iPhone security
• remote attack surface
• vulnerability disclosure
• mobile messaging
• carrier policies

What commenters say

• The release of code used to create attacks is valuable for the security community, as it allows for transparency and further research.
• The use of old serialization libraries in iMessage is a significant security risk that needs to be addressed.
• Vendors are not incentivized to prioritize security, and instead focus on pushing out new features and additions.
• Coordinated disclosure of vulnerabilities is important to balance the need for transparency with the need to protect users from potential exploits.
• The concept of 'responsible disclosure' is problematic, as it implies an ethical obligation to prioritize vendor interests over user safety.
• Public disclosure of vulnerabilities without delay could be an effective way to pressure companies to take security more seriously.
• The lack of investment in security research by companies like Apple is a concern, as it allows competitors to discover vulnerabilities first.
• Users have the right to know about vulnerabilities that affect their devices, even if a patch is not yet available.