Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Given the exploit vector looks like yet another iMessage attachment bug,

> The target iOS device receives a message via the iMessage service, with an attachment containing an exploit.

and that one of the effects of Lockdown Mode is

> Messages - Most message attachment types are blocked, other than certain images, video, and audio. Some features, such as links and link previews, are unavailable.

It might be prevented. Pretty sure disabling iMessage altogether sidesteps this class of bugs too. I've lost track of how many times iMessage has been the root cause of "unattended iOS RCE," at this point it's almost user negligence to have left on.



I was surprised that the article didn't mention Lockdown Mode considering the likely overlap in features. It's even possible that Lockdown Mode was developed (at least in part) to defeat these types of exploits, given the timeline.


Apple has chosen that it is more important to exploit in-group bias with bubble colors than phone security.

I joke, but I can't tell you how annoying iMessage has been. Its so bad with non-iphones, we basically switch to email or teams when doing group communication.


Generally everyone uses WhatsApp already anyway.


Likely another C-based media codec or other similar legacy file reader bug.


Is there a way to disable only the iMessage attachments functionality? (as an alternative to going full lockdown)


I don't think this is possible, but I too wish it were. I hate the fact that you can't copy a link from Messages without it opening a preview. That means if you've been forwarded a link with trackers, it's impossible to remove the tracking bits before opening. Not good!


When you long-press a link, there's a button at the top right corner that says "Hide preview". If you press it, previews will stop opening automatically everywhere.


Wow, amazing. I always thought that was just to hide this preview. Thanks a million, anonymous HN commenter!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: