New iMessage exploit allows hackers to hijack your iPhone by simply sending you a message

New iMessage exploit allows hackers to hijack your iPhone by simply sending you a message
A new, "interaction-less" bug in iMessage was recently discovered that could allow hackers to gain access to your iPhone. The exploit being interaction-less means that you don't need to do anything—download any files or click any suspicious links—to get your device compromised. What's even worse, you don't even need to open the iMessage app for the exploit to work.

At the Black Hat security conference in Las Vegas this week, Google Project Zero researcher Natalie Silvanovich showed off a number of these so-called interaction-less bugs in iMessage that could be used to gain remote access to an iPhone. Wired reports that Apple has already patched five of them, but there are a handful that are yet to receive the company;s attention.

Following the recently uncovered vulnerabilities in WhatsApp, Silvanovich and her colleague Samuel Groß started investigating for similar exploits in SMS, MMS, and voicemail, but found none. Then, they shifted their attention to iMessage and started reverse engineering the app, which lead to some worrisome discoveries.

According to the researchers, the vulnerabilities that they uncovered in iMessage are likely a result of the complex (and ever-expanding) nature of the app. Apple's messaging client not only allows users to send each other files, voice messages, photos, and Animojis, but also has many integrations with third-party apps, like OpenTable and Airbnb. This makes securing every potential backdoor increasingly difficult, though the researchers claim that Apple is actually doing a good job.

Silvanovich says that iOS has many security checks in place, but the bug she and Groß discovered takes advantage of the underlying logic of the operating system, which makes it possible to bypass the security net. A potential attacker could send a targeted iMessage with specific content in it that Apple's servers would interpret in a certain way and send the target a message that would then automatically trigger the exploit, granting the attacker access to the phone.

Interaction-less bugs are highly sought after in the hacking community, as they don't require the target to do anything. The iMessage vulnerabilities discovered by the Google Project Zero members could fetch prices in the vicinity of "millions or even tens of millions" on the exploit market.

FEATURED VIDEO

26 Comments

1. Tsepz_GP

Posts: 1176; Member since: Apr 12, 2012

The good thing here is that once they patch it up all of us will get the update at once and not have to wait for multiple variants to be updated, my iPad and iPhone will be updated on the same day. I hope the WhatsApp flaws can also be sorted out ASAP.

3. Papa_Ji

Posts: 859; Member since: Jun 27, 2016

perfect reply...What someone can expect form iSheep

5. Tizo101

Posts: 572; Member since: Jun 05, 2015

Android doesn't have this problem... android is almost perfect even without updates

12. Tsepz_GP

Posts: 1176; Member since: Apr 12, 2012

It does, did you not see the WhatsApp exploits?

15. JCASS889

Posts: 568; Member since: May 18, 2018

Whatsapp is a 3rd party app not a system level app so it has nothing to do with Android, I don't use what app so it doesn't affect me.

24. sgodsell

Posts: 7456; Member since: Mar 16, 2013

Well maybe if you just talk to Siri some more, then Apple might hear your issues and get around to fixing all of the privacy and security issues.

8. cmdacos

Posts: 4269; Member since: Nov 01, 2016

This would only require an app update, not an update of the full phone.

10. Back_from_beyond

Posts: 1440; Member since: Sep 04, 2015

Or Apple can do as Google did and separate core apps like messaging, dialer, contacts and so on from OS updates and allow them to be updated as regular apps. That's one of the reasons system updates on Android are much less of a necessity.

11. ph00ny

Posts: 2055; Member since: May 26, 2011

and then same bug/exploit will reappear several versions down

4. Back_from_beyond

Posts: 1440; Member since: Sep 04, 2015

Apple say: Thank you, Google.

7. shiv179

Posts: 176; Member since: Aug 08, 2012

Thank you again Google!

13. blingblingthing

Posts: 978; Member since: Oct 23, 2012

I thought iOS was secure, what happened here guys?

14. Papa_Ji

Posts: 859; Member since: Jun 27, 2016

It's secure....but only for iSheep.

16. lyndon420

Posts: 6836; Member since: Jul 11, 2012

Google has been coming to apple's rescue quite a bit lately. Hopefully apple is grateful.

17. Vancetastic

Posts: 1614; Member since: May 17, 2017

I guess nothing is perfect.

19. tedkord

Posts: 17417; Member since: Jun 17, 2009

Some things much less so than fanboys world have you believe.

22. Vancetastic

Posts: 1614; Member since: May 17, 2017

Right? The deflections and excuses are at lease somewhat amusing.

20. Tipus

Posts: 894; Member since: Sep 30, 2016

" Most secure Os" LMAO :)))

21. TBomb

Posts: 1579; Member since: Dec 28, 2012

Can someone give an unbiased explanation on how the imessage app is such an easy way to ruin someone's iphone experience? Between the text you send that can brick a phone to this, there has to be a reason why this is possible on an iPhone/imessage but not with other phones/apps.

23. Vancetastic

Posts: 1614; Member since: May 17, 2017

Well, you CAN use other messaging apps, but you can’t be sure everyone else on an iPhone does. Also, iMessage is for the cool kids. Blue bubbles rule, green bubbles drool. It’s actually incredibly stupid.

25. lyndon420

Posts: 6836; Member since: Jul 11, 2012

Lmao...so true! It's also ironic that the most loyal of iOS users aren't here providing their feedback on this issue (probably hiding in a corner somewhere sobbing their hearts out)...

28. Vancetastic

Posts: 1614; Member since: May 17, 2017

I asked midan for his take, and he somewhat predictably didn’t answer.

26. mackan84

Posts: 560; Member since: Feb 13, 2014

Simple, Apple tries to compete with Facebooks messenger and f***s it up. More features doesn’t always mean happy customers. I mean weren’t we already able to play games with each other using a standalone app?

30. andrewc31394

Posts: 298; Member since: Jun 23, 2012

i love how people who despise "green bubble" people never like to mention how many times this has happened with iPhones lol.

* Some comments have been hidden, because they don't meet the discussions rules.

Latest Stories

This copy is for your personal, non-commercial use only. You can order presentation-ready copies for distribution to your colleagues, clients or customers at https://www.parsintl.com/phonearena or use the Reprints & Permissions tool that appears at the bottom of each web page. Visit https://www.parsintl.com/ for samples and additional information.