NowSecure's company blog publishes mobile security research, including reverse engineering of iMessage, app flaws in DeepSeek, and Samsung vulnerabilities.
HN links its research on iMessage internals and the Samsung keyboard flaw, where a commenter summarizes insecure SwiftKey language pack downloads over HTTP.
NowSecure has some details about this flaw [0]. Summary:
The SwiftKey keyboard (which can't be uninstalled) checks for language packs via HTTP:
http://skslm.swiftkey.net/samsung/downloads/v1.3-USA/languagePacks.json
That returns a list of download URLs and SHA1 hashes (which are obviously useless when they're in the same plain text response).
These download links look like:
http://skslm.swiftkey.net/samsung/downloads/v1.3-USA/en_US.zip
The zip file is downloaded and then extracted as system user. The zip file may contain paths like ../../../../../../../../data/payload, which basically allows to write anywhere on the file system.
This can be (ab)used for a system level remote code execution.
Ryan Welton also published a video demonstrating the exploit. [1]
0: https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/
1: https://www.youtube.com/watch?v=uvvejToiWrY
tl;dr it does aggressive device fingerprinting, root detection, has anti-tampering mechanisms, bundles native code and has dynamic code loading and execution facilities.
IMO, none of which should be necessary for an app like this
A dynamic analysis is still needed to confirm what it actually does.
I decided to do this after a researcher found obfuscated surveillance code in the web app https://apnews.com/article/deepseek-china-generative-ai-internet-security-concerns-c52562f8c4760a81c4f76bc5fbdebad0
NowSecure found similar not great runtime behavior in the iOS mobile app https://www.nowsecure.com/press-releases/nowsecure-urges-enterprises-to-ban-the-deepseek-ios-mobile-app/
We're Chicago-based startup [1] that helps secure mobile apps and devices and recently completed a 12.5m Series A.
If you're interested in mobile security, you can get an idea about our work in a recently vulnerability we helped Samsung patch impacting 200m+ devices. [2]
Over 50% of our company is remote and we're hiring 30+ people this year. If you're interested in mobile and/or security, would love to hear from you. [3]
[1] https://www.nowsecure.com/
[2] https://www.nowsecure.com/blog/2015/01/27/samsung-corrupdate-vulnerability-affects-millions/
[3] https://www.nowsecure.com/careers/
It would be great, but I wonder how realistic it is to expect. iMessage seems to be pretty strongly tied to the apple account identity, their internal credentials, their push servers, etc. https://www.nowsecure.com/blog/2021/01/27/reverse-engineering-imessage-leveraging-the-hardware-to-protect-the-software/
They'd have to either rewrite quite a bit to be more ecosystem-independent, or somehow port all the necessary layers to work on other systems. There's a good reason nobody reverse engineered and reimplemented iMessage so far, even though it's "just a messaging app".
There has been some research around the APN protocol and iMessage in the past by NowSecure[0] and otherse (see links in the article). I would guess the usefullness of a reverse engineered variant is just too low given the requirement for a valid serial number for each account.
[0]: https://www.nowsecure.com/blog/2021/01/27/reverse-engineering-imessage-leveraging-the-hardware-to-protect-the-software/