A Look at iMessage in iOS 14
Summary: Google Project Zero's Samuel Groß published a one-week reverse engineering analysis of iOS 14's iMessage hardening, prompted by Citizen Lab's December 20 report that the suspected NSO Group iMessage zero-click exploit does not work against iOS 14 and above. The post details three central changes: a new tightly sandboxed BlastDoor service written in Swift that handles almost all parsing of untrusted iMessage data, re-randomization of the shared cache when an attack is detected, and exponential throttling of BlastDoor and imagent restarts after crashes up to an apparent maximum of 20 minutes.
Bottom line: The throttling change alone turns an exploit that relied on repeatedly crashing the targeted service from a few minutes of work into multiple hours to roughly half a day, which is the difference between a practical remote attack and one an attacker may not bother finishing.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026