A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution (googleprojectzero.blogspot.com)

Article summary

Researchers from Google Project Zero analyzed a zero-click iMessage exploit developed by NSO Group, which uses a vulnerability in the CoreGraphics PDF parser to achieve remote code execution. The exploit uses a technique called 'fake gif' to target the vulnerability, and it is considered one of the most technically sophisticated exploits ever seen. The vulnerability was fixed in iOS 14.8. The exploit's complexity and capabilities demonstrate the advanced cyber capabilities provided by NSO Group.

Main themes

• NSO Group exploits
• iMessage vulnerability
• zero-click exploits
• compression algorithm vulnerabilities
• Turing complete machines
• return-oriented programming

What commenters say

• The exploit's use of a compression format's instructions to create logic gates and a small computer architecture is a remarkable feat of engineering.
• The complexity of the exploit is not unique and similar exploits can be found in the wild with much less sophistication.
• The jump from buffer overflow to remote code execution is not always straightforward and can require significant additional work.
• The iMessage attack surface is massive and running in an unsafe language is a significant security risk.
• Creating a Turing complete machine within a compression algorithm is an impressive achievement, but the details of how control flow is handled are unclear.
• The use of return-oriented programming chaining 'gadgets' is a common exploitation technique, but the technique used in this exploit is more complex.
• Limiting the features available to untrusted contacts, such as only allowing ASCII messages, could help prevent similar exploits in the future.