Google researcher discovers new iOS security system

With the release of iOS 14 last fall, Apple added a new security system for iPhones and iPads to protect users from attacks via the iMessage instant messaging client.

Named BlastDoor, this new iOS security feature was discovered by Samuel Groß, a security researcher with Project Zero, a Google security team tasked with finding vulnerabilities in commonly used software.

Groß said the new BlastDoor service is a basic sandbox, a type of security service that runs code separately from the rest of the operating system.

Although iOS ships with several sandbox engines, BlastDoor is a new addition that operates only at the iMessage application level.

Its function is to take incoming messages, unpack and process their content in a secure and isolated environment, where any malicious code hidden within a message cannot interact with or damage the underlying operating system or recover user data.

The need for a service like BlastDoor became obvious after several security researchers pointed out in the past that the iMessage service was doing a poor job of cleaning up user input.

Over the past three years, there have been several instances where security researchers or real-world attackers have found iMessage remote code execution (RCE) bugs and have abused these problems to develop exploits that would allow them to take control of an iPhone just by sending a simple text, photo, or video to someone’s device.

The last of these attacks occurred last year, over the summer, and was detailed in a Citizen Lab report called “The Great iPwn”, which described a hacking campaign that targeted Al Jazeera employees and journalists.

Groß said he was drawn to investigate the internal details of iOS 14 after reading in the Citizen Lab report that day zero of the attackers stopped working after the release of iOS 14, which apparently included better security defenses.

After probing the inner workings of iOS 14 for a week, Groß said he believed Apple finally listened to the security research community and improved the handling of iMessage input content by adding the BlastDoor sandbox to the iMessage source code.

“Overall, these changes are probably very close to the best that could have been done, given the need for backward compatibility, and are expected to have a significant impact on the security of iMessage and the platform as a whole,” Groß said in a blog. post today.

“It’s great to see Apple reserving resources for these types of major refactorings to improve end user security.”