<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="auto">What everyone calls SMS almost always includes MMS, which is a layered superset of SMS capabilities (using OTT IP, FWIW).</div>
<div dir="auto"><br>
</div>
<div dir="auto">MMS is capable of sending images. While they normally get transcoded at least once, and usually 3 times (wtf, I know), it is possible for a sufficiently-sophisticated attacker to send webP images bypassing all the transcoding. To do so, the
attacker would need an SS7 connection, but while expensive, that's not a massive technical hurdle.<span></span></div>
<div dir="auto"><br>
</div>
<div dir="auto">So... sadly that's still a zero-click vuln on every cell phone with a carrier that isn't still in the dark ages.</div>
<div dir="auto"><br>
</div>
<div dir="auto">-Adam</div>
<div id="ms-outlook-mobile-signature" dir="auto">
<div><br>
</div>
Get <a href="https://aka.ms/AAb9ysg">Outlook for Android</a></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Roundtable <roundtable-bounces@muug.ca> on behalf of Gilbert Detillieux <Gilbert.Detillieux@umanitoba.ca><br>
<b>Sent:</b> Thursday, October 5, 2023 10:48:04 AM<br>
<b>To:</b> Continuation of Round Table discussion <roundtable@muug.ca><br>
<b>Subject:</b> Re: [RndTbl] CVE-2023-41064</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On 2023-10-04 8:16 p.m., Trevor Cordes wrote:<br>
> Fun.<br>
> <br>
> <a href="https://www.tenable.com/blog/cve-2023-41064-cve-2023-4863-cve-2023-5129-faq-imageio-webp-zero-days">
https://www.tenable.com/blog/cve-2023-41064-cve-2023-4863-cve-2023-5129-faq-imageio-webp-zero-days</a><br>
> <br>
> If you have an Apple device, it must be updated. If it's no longer<br>
> supported/updated, throw it away.<br>
<br>
See also...<br>
<br>
<a href="https://www.bleepingcomputer.com/news/security/google-assigns-new-maximum-rated-cve-to-libwebp-bug-exploited-in-attacks/">https://www.bleepingcomputer.com/news/security/google-assigns-new-maximum-rated-cve-to-libwebp-bug-exploited-in-attacks/</a><br>
<a href="https://www.bleepingcomputer.com/news/security/apple-backports-blastpass-zero-day-fix-to-older-iphones/">https://www.bleepingcomputer.com/news/security/apple-backports-blastpass-zero-day-fix-to-older-iphones/</a><br>
<br>
> Anyone can send you a text or imessage (whatever that is) with a crafted<br>
> webp image and p0wn your whole device: no clicks or user interaction<br>
> required.<br>
<br>
iMessage is Apple's augmented/proprietary message protocol, which allows <br>
for multi-media attachments to a text message. Based on what I read, I <br>
think the vulnerability in libwebp can only be exploited via iMessage <br>
and not via SMS text messages to iOS devices (since those wouldn't <br>
contain images). Fortunately, you can disable iMessage support in iOS, <br>
if you don't use it.<br>
<br>
> Same bug in Chrome: update your Chrome. If you cannot on that device<br>
> (i.e. Win7) then throw it away or find a new OS/browser. But at least<br>
> you'd have to visit a malicious web page.<br>
> <br>
> Also affects linux webp libraries, so patch your stuff and restart any<br>
> dynamically linked browsers/clients.<br>
<br>
Yeah, the list of apps and other frameworks that use libwebp is huge, <br>
and includes pretty much every modern browser, and even embedded <br>
mini-browsers to implement OAuth2 and such, if I'm not mistaken.<br>
<br>
Even if this isn't as potentially nasty as the iMessage exploit, its <br>
scope is much larger.<br>
<br>
Too bad they don't just give you an option to not load WebP images. <br>
(Wonder who's using those currently, other than Google?...)<br>
<br>
-- <br>
Gilbert Detillieux E-mail: Gilbert.Detillieux@umanitoba.ca<br>
Computer Science Web: <a href="http://www.cs.umanitoba.ca/~gedetil/">
http://www.cs.umanitoba.ca/~gedetil/</a><br>
University of Manitoba Phone: 204-474-8161<br>
Winnipeg MB CANADA R3T 2N2<br>
<br>
_______________________________________________<br>
Roundtable mailing list<br>
Roundtable@muug.ca<br>
<a href="https://muug.ca/mailman/listinfo/roundtable">https://muug.ca/mailman/listinfo/roundtable</a><br>
</div>
</span></font></div>
</body>
</html>