Analysing a Pegasus 0-click Exploit for iOS - Billy Ellis

Looking into the exploitation of an iOS 16.6 vulnerability. This bug was exploited in-the-wild as part of a Pegasus chain and has publicly referred to as 'blastpass'.

The bug is CVE-2023-41064 - an issue when decoding webp files, leading to a limited out-of-bounds write primitive.

we'll focus only on the exploitation techniques, not the bug itself as this has been documented extensively online already.

We'll look at how the attackers cleverly target heap metadata in the target process to upgrade the basic primitive into a much more powerful use-after-free on a CFSet backing buffer. Then we'll see how they partially corrupt one of the object pointers within the set to make it point to fully controlled data, where they prepare a fake CFReadStream object to ultimately get code execution.

Original writeup from Ian Beer
Blasting Past Webp - Project Zero

Exploiting the libwebp Vulnerability, Part 1: Playing with Huffman Code | DARKNAVY

#Pegasus

>Dirty Sánchez

Nice nickname for a bastard.


https://x.com/elonmusk/status/2018746867056513207

Never again means right now

I voted against the rule to bring
this omnibus forward for a vote.
Great reasons 🧵

Aids

REFUSED: My amendment to
prevent the government from
installing a “kill switch” in your
personal vehicle.

BLOCKED: My amendment
to freeze the funds for
“daycare fraud.”

BLOCKED: My amendment
to stop
warrantless surveillance of
Americans via loopholes in
the Foreign Intelligence
Surveillance Act (FISA).

BLOCKED: My amendment
to end the propagandizing
of U.S. citizens by the State
Department and the U.S.
Agency for Global Media
(USAGM). 02/03

Not long ago.

propaganda on
our citizens,

Smith-Mundt
Modernization Act.