When a new iOS update comes out, not many people click on the security notes link to see the details. Perhaps they once did but found the info hard to follow or to connect it to how it would impact them.
The recent iOS 16.5.1 (c) release was somewhat clear for average users: “Processing web content may lead to arbitrary code execution”. Many users would understand this to be a vulnerability triggered by web browsing in Safari and perhaps be a bit more careful what they click on until the update is installed. They may not know what arbitrary code execution means but get that it isn’t good. They may also miss the point that it impacts apps other than Safari, including most messaging apps, but overall, they get the main point.
But what about when the security notes contain other issues, how does the following impact a user? The following is from the iOS 16.5 security notes:
ImageIO
Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later
Impact: Processing an image may lead to arbitrary code execution
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2023-32384: Meysam Firouzi @R00tkitsmm working with Trend Micro Zero Day Initiative
When a user reads “Processing an image may lead to arbitrary code execution”, they might assume that it means a user has downloaded a malicious image from some sketchy web site and then opened it in an image editing app or would have to have taken obvious steps to trigger the exploit. It also doesn’t mention specific apps that are vulnerable so probably nothing to worry about, right?
But thanks to the way messaging apps work (except for Numbers Station!), all an attacker has to do to trigger this exploit on a victim’s device is to know what identifiers they are using in messaging apps. For Signal or WhatsApp this would be the victim’s mobile phone number. Attackers can search on the victim’s identifier in the messaging app to see if they are using it and then send a specially crafted message with a purported image attachment to the victim’s account and voila, owned. No victim interaction required, no tricking the victim, nothing…hence it is called a zero-click exploit. The victim’s messaging app will happily receive the malicious message, begin processing the “image”, the device is exploited and the exploit chain then deletes the incoming message that carried it to the device so the victim never even sees the message. Then all of their sensitive data is exfiltrated back to the attacker. More advanced attackers will also leave software on the device to continue stealing data in the future, often until the device is rebooted, but in some cases beyond that. Of course there is also the option for the attacker to track the victim via the device’s GPS or to listen to discussions happening in the space where the device is located via the built-in microphone.
Numbers Station protects against zero-click exploits, including ones caused by unknown to the public vulnerabilities, in a number of ways. The initial way is by not processing image attachments in the background as messages arrive. Instead messages from unknown senders, i.e. the attacker in the above scenario, are quarantined with no processing at all of the image attachment, thereby not triggering the exploit. Users can also decide to submit to us any quarantined messages they feel are suspicious for us to analyze and determine if an exploit is present. If one is, we will alert the user and Apple. No other app offers this type of containment or analysis, and without it, it is very difficult to ever find an actual zero-click exploit chain being actively used in the wild. Usually just fragments of artifacts of compromise are found if the user later notices some unusual behaviour occurring, which is rare to begin with, and physically provides their device to a researcher. You can read our FAQ for more info on other ways we protect our users.
Other than using Numbers Station, you can protect yourself by also updating rapidly after an update becomes available, do not put it off. One of two things happens when a vulnerability is publicly released:
- Attackers that were unaware of the vulnerability begin researching and race to create an exploit to take advantage of it and use it against any of their targets before they update. This could take them a bit of time to do though, so users have a bit of time to update.
- Attackers that already knew about the vulnerability and have an exploit for it in their toolkit begin immediately launching it against any potential target they, or their clients, ever had. The exploit is already “burned” so there is no longer any concern about burning it. Before it was public, attackers might have been more selective about who they used it against, now they’ll try it against a few thousand targets all at once.
So next time you see “arbitrary code execution” in an issue for ImageIO, immediately read it as “it is highly likely that users of common messaging apps were and are currently actively being exploited and there is nothing the users of those apps could do to detect it or stop it”. Attackers, like Israel’s NSO Group and their clients, weep every time one of these vulnerabilities gets discovered and outed publicly, they thrive on ImageIO vulnerabilities. By using Numbers Station, you can stop them even before the vulnerabilities are found.
Samuel Groß (formerly of Google Project Zero) has an excellent blog post on his research in to ImageIO and the impact vulnerabilities in it have for messaging app users. While the post is from 2020, the same types of issues are impacting users today, as recently as iOS 16.5 for certain. It is highly likely that there are still a number of publicly unknown vulnerabilities in ImageIO, or related to image processing in general, that are being actively used against victims of other messaging apps.
