The BLASTPASS exploit leverages a vulnerability in WebP image parsing within a PKPass file, using a complex heap manipulation technique to trigger a controlled memory corruption. By carefully crafting a malicious PKPass with a WebP image, TIFF metadata, and a binary property list, the attackers can achieve code execution in the MessagesBlastDoorService through a callback-oriented programming (COP) technique that bypasses Pointer Authentication Code (PAC). This exploit demonstrates the sophisticated and multi-layered approach NSO Group uses to compromise iOS devices, highlighting the ongoing cat-and-mouse game between exploit developers and platform security teams. Citizen Lab caught the chain in the wild in September 2023 on the iPhone of an employee of a Washington DC-based civil society organization, and Apple patched it as CVE-2023-41064 and CVE-2023-41061 in iOS 16.6.1.
