Apple has created a new "BlastDoor" security system for iMessage in iOS 14 to stop malicious actors from targeting individual iPhone customers with a text message.
Over the years, various bugs in the Messages app have opened numerous new attack vectors for bad parties who would leverage shared cache or brute force attacks to break into the Messages app. Security researchers have been warning that Apple's popular iMessage messaging feature was doing a poor job of sanitizing incoming user data.
iMessage Remote Code Execution Bugs
Parsing untrusted input is always risky and bad actors are all too aware of this. A malicious user would typically discover a zero-day Messages bug and exploit it in the wild. Then sometime later after being informed about it, Apple would patch the vulnerability. This cat and mouse game between Apple and the security community is nothing new.
BlastDoor fixes this by parsing all iMessage data in an isolated environment. This prevents maliciously crafted texts from breaking the Messages app, stealing user data, or harming the underlying operating system. Sandboxing separates running programs from the rest of the system and is already heavily used in several places throughout iOS.
A Very Sturdy Messages Vault
BlastDoor brings a sandboxing mechanism to the confines of the Messages app and iMessage. According to ZDNet, this new security mechanism in iOS 14, iPadOS 14, and macOS 11 was first discovered by Google's Project Zero security researcher Samuel Groß.
But this has piqued Samuel's interest, especially after he discovered that iOS 14, iPadOS 14, and macOS 11 introduce improved security defenses for the Messages app. According to his blog post, the BlastDoor system adds a strong layer of security to iMessage.
Overall, these changes are probably very close to the best that could've been done given the need for backwards compatibility, and they should have a significant impact on the security of iMessage and the platform as a whole.
The blog post goes to great lengths to detail not only the new BlastDoor service but also other improvements for more secure processing of iMessages data, including resliding of the shared cache and exponential throttling.
It's great to see Apple putting aside the resources for these kinds of large refactorings to improve end users' security. Furthermore, these changes also highlight the value of offensive security work: not just single bugs were fixed, but instead structural improvements were made based on insights gained from exploit development work.
Summing up, Groß called the new BlastDoor feature close to "the best that could've been done given the need for backwards compatibility."
Major Security Patches in iOS 14.4
The iOS 14.4 and iPadOS 14.4 updates include patches for three vulnerabilities that Apple says "may have been actively exploited" in the wild. When used together, the vulnerabilities make possible privilege escalation and remote code execution attacks.
Neither Apple nor security researchers would publicly say whether those patched exploits might have been used to carry out a hacking campaign that targeted Al Jazeera staffers and journalists. For what it'w worth, the Citizen Lab project has confirmed that the suspected exploit which made possible the Al Jazeera hack is indeed no longer working in iOS 14.
How Can I Protect Myself?
The best way to protect oneself against unknown Messages exploit is by keeping devices up to date. Update the system software on your devices as soon as updates become available. Don't open suspicious attachments or unsolicited texts from unknown contacts. This won't completely protect you from zero-day exploits, but these measures---combined with the new BlastDoor security feature---should help improve your security.
To update your iPhone, iPad, or iPod touch to the latest iOS software wirelessly, venture into Settings > General > Software Update. If you see a message saying an update is available, tap "Install Now". The device must be plugged into power and connected to Wi-Fi.
To update the macOS operating system software on your Mac, choose "System Preferences" from the Apple menu and select the "Software Update" option. If any updates are available, click the "Update Now" button to install them. You might be asked to enter your administrator password to finish installing the update.