Hacker News new | ask | show | jobs
by twobitshifter 1423 days ago
Its not about privileges, the iMessage blastdoor exploit built a turing machine using a weird old image format and then escaped.

https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

1 comments

Privileged is the wrong word, but GP is not entirely wrong. What you linked to is only the first part of the exploit and analysis.

From the conclusion of the second post, which analyses the sandbox escape:

> Perhaps the most striking takeaway is the depth of the attack surface reachable from what would hopefully be a fairly constrained sandbox. [...] The expressive power of NSXPC just seems fundamentally ill-suited for use across sandbox boundaries, even though it was designed with exactly that in mind. [...]

(The above is severely cut down, reading at least the entire conclusion or even the whole post is worth it)

https://googleprojectzero.blogspot.com/2022/03/forcedentry-s...