BLASTING PAST WEBP

Summary from the TLDR InfoSec newsletter

The NSO Group's BLASTPASS exploit targets iPhones via iMessage through a WebP vulnerability. The attack involves sending a PKPass file with a WebP image that caused a buffer overflow, overwriting a pointer, and executing malicious code via heap manipulation that bypasses iOS protections like ASLR and PAC. Unlike earlier exploits that need complex "weird machines," BLASTPASS uses conventional techniques such as callback-oriented programming and a multi-stage approach, with follow-up iMessages delivering final payload encryption keys.