How a single line of code could brick your iPhone (rambo.codes)

Article summary

A security researcher discovered a vulnerability in iOS that allows a single line of code to brick an iPhone by exploiting a legacy public API called Darwin notifications. The vulnerability can be used to trigger a denial-of-service attack, causing the device to enter a 'Restore in Progress' mode and eventually requiring a device erase and restore from backup. The researcher reported the issue to Apple, which has since been addressed in iOS 18.3. The bug was found to be exploitable due to the lack of verification of the sender of Darwin notifications.

Main themes

• iOS vulnerability
• Darwin notifications
• bug bounty
• vulnerability market
• denial-of-service attacks
• security research

What commenters say

• The discovery of the vulnerability is impressive due to its simplicity and effectiveness.
• Some commenters reminisce about old vulnerabilities and exploits, such as the 'ping of death' and AOL chatroom crashes.
• The bug bounty payout of $17,500 is considered relatively good compared to other companies' payouts.
• There is a discussion about the ethics of selling vulnerabilities to companies like Zerodium, with some arguing that it is unethical due to the potential for weaponization.
• The market for denial-of-service vulnerabilities is considered to be small or nonexistent by some commenters.
• Others argue that rendering a target's device unusable can be a useful payload for certain actors.
• The patch implemented by Apple is considered to be a good solution, but some commenters think that the underlying issue should be reworked regardless.
• The vulnerability highlights the importance of verifying the sender of notifications to prevent similar exploits in the future.