Comment by aemoron
16 hours ago
What's with iOS and pdfs pwning them? Reminds me of the ForcedEntry in Pegasus.
https://projectzero.google/2022/03/forcedentry-sandbox-escap...
https://www.trendmicro.com/en_gb/research/21/i/analyzing-peg...
16 hours ago
What's with iOS and pdfs pwning them? Reminds me of the ForcedEntry in Pegasus.
https://projectzero.google/2022/03/forcedentry-sandbox-escap...
https://www.trendmicro.com/en_gb/research/21/i/analyzing-peg...
PDF has been an entry point since forever, it is extremely complex and can in some cases even run javascript, it has a huge attack surface.
Why can't Apple just sandbox the damn thing? Run the renderer in a VM, call it a day.
Or just spend a few billion tokens rewriting the whole chain in a memory safe language. This nonsense is inexcusable in 2026
I sincerely believe you need much more than one billion tokens to rewrite the entire PDF dependency stack in a memory safe language. I think you underestimate how many features PDF has.
2 replies →
it offers just enough cover and deniability. Q.e.d this sub thread.
it's a feature. expect next exploit to also be pdf or image related.
The sandbox is just another layer
1 reply →
Too huge attack surface. Good candidate for victim trust (who would not open a pdf file on an iPhone?).
So pdf and images are the best vector for iPhones.
Once you escape the parser you have to reach and escape the sandbox and from there reach the kernel.
That's why you need Rust in any image decoder. FFMPEG too.
Apple has been propagating Swift for more than a decade now and at least in theory, it should be on par with Rust in terms of safety I'd say.
2 replies →
The problem here is that pdf is over bloated with features and without strictly defined standard. Rust can't help you with that, or any language for that matter. It's akin to upgrading the security system on a house on fire.
The best solution would be ditching it completely for a simpler subset of features. But that will never happen.
Rust is not a magic security wand.
8 replies →
If it wasn't PDF it'd be something else. It's everything after the PDF that's alarming here - how did they break out of the app sandbox?
I wonder if pdf.js would be more secure since it runs inside a webpage and can benefit from the browser sandboxing. Though I guess iOS has generally managed to keep most of its apps native rather than web app wrappers (as has happened on Windows).
Well it was TIFF one time
TIFFs were used as part of a PSP jailbreak as well iirc
Never mind - that only applied to origins PDF 1.x.
Does Lockdown block all PDFs?
No, it doesn't.
pdf is the new swf
Maybe with LLMs a full rewrite that’s more secure could be done
LLM and full rewrite are a recipe for cooking something that still has flaws but also doesn't work that well. The root cause is that PDF is an old format from a more innocent era. A new document standard that keeps up with the technical and security advances, learns about the lessons PDF taught us, and allows for easy conversion from old PDFs, would be the ideal solution.
Who am I kidding, I think the PDF format will outlive us.
> PDF is an old format from a more innocent era
if apple parsed pdf with (js, swift, rust) none of this would be possible. the problem is memory-unsafe code.
1 reply →
A full rewrite of what? iOS? I hope you’re kidding
Apple can rewrite the media and PDF libraries in no time in Swift/Rust, they have tons of money to waste.
2 replies →