SN 955 Apple CVEs

[Sushi]

One thing I wish was addressed in this episode is if “lockdown mode” would have prevented this exploit chain. Since lockdown mode is designed to neuter iMessage a bit, it may have thwarted the original attack vector in the exploit chain. Seems this is exactly the use case for this feature. Anybody know if this is the case?

 

[Steve]

Ah... THAT is a really great point and question. I haven't encountered anything about that.

 

[Badrod]

The Kaspersky guys were asked about Lockdown Mode during the Q&A at the end of their talk at Chaos. They answered [I'm paraphrasing] that more investigation is needed, but likely not because the attack uses core system calls used by all the CPUs ... but maybe, because Lockdown blocks certain file types.
Here's the link: Q&A-Lockdown

 

[Sushi]

The Kaspersky guys were asked about Lockdown Mode during the Q&A at the end of their talk at Chaos. They answered [I'm paraphrasing] that more investigation is needed, but likely not because the attack uses core system calls used by all the CPUs ... but maybe, because Lockdown blocks certain file types.
Here's the link: Q&A-Lockdown

Good find. It seems the initial attack vector at the start of the chain might be mitigated, but the other CVEs most likely would not be. They said additional research was needed.