As Apple prepares for its iPhone 11 launch on Tuesday, the recent stumbles suggest it's time for the company to go beyond fixing the individual security flaws that have made those iPhone attacks possible, and to instead examine the deeper issues in iOS that have produced those abundant bugs. According to iOS-focused security researchers, that means taking a hard look at two key inroads into an iPhone's internals: Safari and iMessage.While vulnerabilities in those apps offer only an initial foothold into an iOS device—a hacker still has to find other bugs that allow them to penetrate deeper into the phone's operating system—those surface-level flaws have nonetheless helped to make the recent spate of iOS attacks possible. Apple declined to comment on the record.
"If you want to compromise an iPhone, these are the best ways to do it," says independent security researcher Linus Henze of the two apps. Henze gained notoriety as an Apple hacker after revealing a macOS vulnerability known as KeySteal earlier this year. He and other iOS researchers argue that when it comes to the security of both iMessage and WebKit—the browser engine that serves as the foundation not just of Safari but all iOS browsers—iOS suffers from Apple's preference for its own code above that of other companies. "Apple trusts their own code way more than the code of others," says Henze. "They just don’t want to accept the fact that they make bugs in their own code, too."
Lily Hay Newman covers information security, digital privacy, and hacking for WIRED.Silvanovich, who worked on the research with fellow Project Zero member Samuel Groß, got interested in interaction-less bugs because of a recent, dramatic WhatsApp vulnerability that allowed nation-state spies to compromise a phone just by calling it—even if the recipient didn’t answer the call.
Caught in a WebKitAs a result, Apple has insisted that only its own WebKit engine be allowed to handle that unsigned code. "They trust their own stuff more," Henze says. "And if they make an exception for Chrome, they have to make an exception for everyone."The problem with making WebKit mandatory, according to security researchers, is that Apple's browser engine is in some respects less secure than Chrome's. Amy Burnett, a founder of security firm Ret2 who leads trainings in both Chrome and WebKit exploitation, says that it's not clear which of the two browsers has the most exploitable bugs. But she argues that Chrome's bugs are fixed faster, which she credits in part to Google's internal efforts to find and eliminate security flaws in its own code, often through automated techniques like fuzzing .
Google also offers a bug bounty for Chrome flaws, which incentivizes hackers to find and report them, whereas Apple offers no such bounty for WebKit unless a WebKit bug is integrated into an attack technique that penetrates deeper into iOS . "You’re going to find similar bug classes in both browsers," says Burnett. "The question is whether they can get rid of enough of the low hanging fruit, and it seems like Google is doing a better job there." Burnett adds that Chrome's sandbox, which isolates the browser from the rest of the operating system, is also "notoriously" difficult to bypass—more so than WebKit's—making any Chrome bugs that do persist less useful for gaining further access to a device.