Someone correct me please if I’m wrong but is this because iOS doesn’t sandbox their processes? I think I read Safari in particular doesn’t, but wonder if this is system-wide issue.

The more of this stuff we see, the more people will start using GrapheneOS, I guess.

Also wonder why they choose to publish and not cash-in the Apple bounty..

▲

odo1242 8 hours ago | parent [-]

iOS does sandbox their processes really well, that's why this hack was as difficult as it was. The Safari thing you're talking about is JIT - iOS disables all runtime code generation across the system except in Safari (for JavaScript), but this is a completely separate thing from sandboxing.

▲

cromka 6 hours ago | parent [-]

Actually, no, I now remember this was about iMessage specifically and how it isn't completely isolated/runs as system service or sth? Or about the renderer?

Which would make sense because these attacks seem to exploit the same weakness.

▲

odo1242 4 hours ago | parent [-]

iMessage's attachment renderer is also sandboxed, actually. You might be talking about this vulnerability: https://projectzero.google/2021/12/a-deep-dive-into-nso-zero..., but the second half of the vulnerability exploit chain was finding a way out of the CoreGraphics (Apple's image rendering library) sandbox to hack the rest of the system.

	▲	cromka 2 hours ago \| parent [-]
		Yes, I think that was it, thanks!