My theory on how the webp 0day was discovered #short

2024-09-30

[public] 9.7K views, 588 likes, dislikes audio only

Want to learn more about hacking? Checkout our courses on https://www.hextree.io (ad)

I have spent many hours looking at the webp vulnerability used in the 0day attack against iPhones. In the past videos we have seen why fuzzers have a hard time finding the issue, so I wanted to understand how this was discovered. And I think I have a good theory!

Part 1: Huffman Tables /youtube/video/lAyhKaclsPM

Part 2: Fuzzing libwebp /youtube/video/PJLWlmp8CDM

Sources:

https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/

https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html

https://googleprojectzero.blogspot.com/2020/01/remote-iphone-exploitation-part-1.html

https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html

https://github.com/seemoo-lab/frida-scripts/blob/main/scripts/libdispatch.js

https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html

https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/

https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html

https://github.com/libjxl/libjxl/blob/4b9dbde293f7f282b6952a02340300abfca2b184/lib/jxl/huffman_table.cc#L51