The security research firm Calif, led by Thai Duong, has publicly demonstrated a series of exploits targeting the iPhone. These demonstrations, revealed at Hexacon in Paris, showcase the firm's ability to bypass core iOS security measures. The highlights of the presentation include a one-click exploit, a demonstration of a vulnerability potentially triggered via a PDF link in iMessage, and a persistent jailbreak—a feat that has been notably difficult to achieve on modern iOS versions for nearly a decade.
Technically, the exploits appear to target complex interaction points within the iOS ecosystem. One demo suggests a vulnerability in how the system handles PDF attachments, a common attack vector due to the complexity of parsing such files. Another demonstration focused on achieving a root shell, which involves escalating privileges to the highest level of the operating system. These types of attacks often rely on finding indirect vectors, such as memory corruption in modules that handle external data, to bypass hardware-backed protections like Pointer Authentication Codes (PAC) and Control Flow Integrity (CFI).
While these demonstrations highlight significant security gaps, they also spark debate regarding the accessibility of such research and the efficacy of current defenses. Some observers questioned whether Apple's 'Lockdown Mode'—designed to mitigate common attack vectors—would be effective against these specific exploits. Additionally, the use of Large Language Models (LLMs) in the research process was noted as a significant factor in the team's ability to identify and weaponize these vulnerabilities. The firm's work underscores the persistent arms race between mobile security architecture and advanced vulnerability research techniques.