- cypherpunks@lists.ogf.org

Russian Foreign Ministry spokeswoman Maria Zakharova needs raping
by professor rat 17 Dec '21

17 Dec '21

Bad joke, sorry. I apologize. But it shows the pressure we're all operating under here. Journalist complains about journalist persecution - journalists reporting https://groups.io/g/marxmail/topic/caitlin_johnstone_the/87770944?p=,,,20,0… Media journalists are spinning a case against a fellow journalist? Sounds like cannibalism in a leper-colony. Cannibal Caitlan calls on all pseudo-left pundits to do their duty " … The most powerful regime on the planet imprisoning a journalist for journalistic activity is as brazen and obvious an act of tyranny as you could possibly come up with, and yet you still get pseudoleft pundits acting like you’re some kind of weird freak for expecting them to oppose it. . . "

1 0

JFK files release damming of Marxist Communist, James A. Donald
by professor rat 17 Dec '21

17 Dec '21

JFK files - Many of the files shed light on Oswald’s Soviet and Cuban embassy visits, and mention tensions between the United States and Cuba, and a statement from Marxist leader Fidel Castro about possible danger to U.S. leaders “if they helped in any attempt to do away with leaders of Cuba.” The documents also include discussion, in the days after the assassination, of the potential for Cuban involvement in the killing of Kennedy. One CIA document marked “Secret” states that one individual that Kennedy’s assassin spoke to was the Soviet embassy’s consul, who had links to the Marxist KGB’s “assassination department.” The pair discussed the gunman’s efforts to obtain a visa to visit the Soviet Union, according to the documents. On Oct. 3, 1963, more than one month before the assassination, self-described Marxist revolutionary, Donald, sorry, Oswald drove back into the United States through a crossing point at the Texas border. Also made public was a report that Australians in 1962 had received a tip from a man who claimed there was a plot to kill Kennedy. The man claimed he was a driver for Marxist Communist Soviet diplomats.

1 0

Ham actor charged with violent sexual assault
by professor rat 17 Dec '21

17 Dec '21

"Will you be my Mary Magdalene, Heather? And bathe my feet at the cross?" - Assange 2011 https://www.today.com/money/how-julian-assange-could-seduce-even-you-1C8368… Julian Assange arrested in London on rape charges https://www.csmonitor.com/World/terrorism-security/2010/1207/WikiLeaks-Juli… GEOFFREY "sexual offence for a man to deliberately deceive a partner whose consent has been conditional upon his use of a condom" ROBERTSON JULIAN " Being guilty of aggravated rape has nothing to do with our party" A. Broinowski. Wikileaks Party NSW candidate for au Senate. 2013.

1 0

Cryptocurrency: Tax Havens Being Sought By HODLers
by grarpamp 17 Dec '21

17 Dec '21

Crypto Rich Flock To Puerto Rico, World's New Luxury Tax Haven Paradise https://www.bloomberg.com/news/features/2021-12-11/crypto-rich-are-moving-t… https://news.bloombergtax.com/daily-tax-report/irs-seizes-foothold-on-puert… https://home.treasury.gov/system/files/136/The-American-Families-Plan-Tax-C… President Joe Biden says the 1980s Reagan era trickle-down economics doesn't work as he wants to roll back tax cuts for the rich. The impending clampdown has spooked top affluent investors, including crypto investors, who are descending to Puerto Rico to dodge tax hikes. Puerto Rico passed two important tax bills in 2012 that has transformed the island into a cryptocurrency tax haven paradise. Under Act 22 of its local tax code, the Caribbean island and unincorporated U.S. territory offers full exemption from all local taxes on passive income to new residents. Act 20, provides a 4% corporate tax rate and exemptions on dividends. This is a much better deal than the U.S., where investors pay 20% in long-term capital games and 37% in short-term gains. The explosion of remote work, expansion of crypto markets, and tax haven have made the Caribbean island attractive for crypto investors. That was the case for Anthony Emtman, who left Los Angeles behind and bought a condo at the resort in March. The chief executive officer of Ikigai Asset Management is now a part of a burgeoning crypto community along Puerto Rico's north shore, where the tropical weather is just a bonus. Emtman and his crypto peers take a page out of hedge funds' books and seek residence on the island to reap huge tax savings. - Bloomberg The rise in crypto markets has made it an easy target for the Biden administration and Democrats to tax the living hell out of the industry. Smart money understands what's coming and wants no parts of it. Crypto funds Pantera Capital and Redwood City Ventures have moved to the tropical island to escape U.S. taxes. Facebook product manager-turned-whistleblower Frances Haugen recently disclosed that she moved to Puerto Rico to be with her crypto buddies. Now, "it's not just, 'Move to Puerto Rico to save tax,'" said Giovanni Mendez, a corporate tax attorney. "It's, 'Move to Puerto Rico because everybody is there.'" Puerto Rico's tax laws were put in place to help its struggling economy a decade ago. Hedge funds have been shifting operations from the Northeast U.S. to the island for at least half a decade or more. So far this year, Puerto Rico has received more than 1,200 applications — a record — through its Individual Investors Act, which exempts new residents from paying taxes on capital gains, according to the island's Department of Economic Development and Commerce. The number of U.S. mainlanders seeking Puerto Rico's tax breaks has tripled this year. Another 274 corporations, LLCs, partnerships and other entities were approved for the Exports Services Act, which provides a 4% corporate tax rate and a 100% exemption on dividends. Both fall under Puerto Rico's Act 60, a group of tax breaks that were packaged together in 2019 to attract investment not just from crypto, but finance, tech and other industries. -Bloomberg Michael Terpin, the founder of BitAngels, moved to the island from Las Vegas in 2016. He's known as the "messiah" for convincing people to move to the island. Crypto investors are interested in several areas on the island: Bahia, which resides 26 miles east of San Juan, and the Ritz-Carlton Dorado Beach resort. The wave of new newcomers has lifted property markets in the country. Francisco Diaz Fournier, the founding partner of Luxury Collection Real Estate, said some properties are now selling for more than $20 million. "Right now we are selling a home in Dorado Beach for $27 million, and another one is going for $29 million," Fournier said. Blanca Lopez, the founder of Gramercy Real Estate Group, said Bahia prices per square foot have doubled. "We are seeing prices north of $3,000 per square foot," Lopez said. She said homes in Condado are between $1,400 to $1,500 per square foot, an approximately 35% increase from a year ago. Meanwhile, inventory is running low for high-end homes. "We don't have room, at least not in Dorado, Bahia or Condado," said Fournier. "The market is spreading out, so we're seeing spillovers in areas of San Juan where people wouldn't look before." So far, the tax incentives appear to be working. Crypto investors flock to the island to dodge Biden's proposed tax increases. However, the IRS has a message for net-worth individuals, corporations, and cryptocurrency traders moving to the island: 'We're waiting for you...' The bad news is the push for statehood would kill its tax system. In the meantime, wealthy crypto investors don't care and seek tax shelter on the tropical island. Hedge fund managers have been descending on Puerto Rico in the hopes of dodging Biden tax hikes, and to take advantage of tax incentives rolled out in 2012 which have lured high net-worth individuals, corporations and cryptocurrency traders alike. If you fall under any of the above and you're falsely claiming to be a resident of Puerto Rico, the IRS has a message for you: 'We're waiting for you...' According to Bloomberg Tax, the agency has been the focus of a "sweeping" review to examine individuals who took advantages of the tax incentives. According to the report, "More than 4,000 mainland U.S. residents and firms have moved to the territory between 2012 and 2019, revealing potentially hundreds of millions of dollars in lost tax revenue to the U.S. government, according to an IRS report delivered to Congress." At issue are taxpayers who may have excluded income subject to U.S. tax, or failed to file and report income altogether when they moved to Puerto Rico, according to the IRS notice. The agency is also targeting those who claim to be bona fide residents of Puerto Rico but may be “erroneously reporting” U.S. income to evade taxes. The IRS’s push is taking place as Biden’s proposed tax increases have triggered moves by America’s wealthiest from high-tax states like New York and California, while hedge funds like Izzy Englander’s Millennium Management and ExodusPoint Capital Management have moved to establish subsidiaries on the island. An ExodusPoint spokesman declined to comment, while a representative for Millennium did not respond. -Bloomberg Tax Tax attorneys who advise HNW clients on Puerto Rican tax incentives are already reporting that they've received requests for information from the IRS, while more audits are expected now that the US tax filing deadline has passed. "The IRS doesn’t start a campaign and not follow through," said international tax layer J. Clark Armitage. "There are going to be a lot of audits." The Puerto Rico crackdown is part of a wider sweep by the Treasury Department, which estimated that wealthy taxpayers are hiding billions of dollars in income. According to Treasury Secretary Janet Yellen, the tax gap between what's owed and what's collected could grow to $7 trillion over the next decade if nothing is done. "One of the purposes of a campaign is to stop whatever fraud is going on while you’re doing the investigations and audits," said former IRS commissioner John Koskinen. "You like to stop people in their tracks." Campaigns by the IRS often take years to organize, as agents begin to detect factual patterns that indicate a significant loss of revenue due to non-compliance. In the case of Puerto Rico, much of the focus will be on establishing whether individuals are truly island residents and whether they properly sourced income to Puerto Rico. Unlike previous IRS efforts, the campaign’s origins began in Congress after lawmakers requested a report from the agency in their 2020 appropriations bill over concerns Puerto Rico’s tax laws may be enabling tax avoidance and that federal and state governments were being shorted revenue. “Every revenue authority everywhere is facing the same issue of needing to find an efficient process when there are fewer resources and budget constraints,” said Sharon Katz-Pearlman, global head of dispute resolution and controversy for KPMG. The IRS’ report to Congress calculated that more than 1,924 applicants—corporations, LLCs, partnerships, and other types—had been granted tax benefits under the Exports Services Act (formerly known as Act 20) as of March 2020 based on partial information provided by Puerto Rico. Act 20 offers entities a 4% corporate rate on business income and 100% tax exemption on dividends. That provision along with the Individual Investors Act have now been consolidated into a new incentive law to attract individuals and investments to the island. https://www.sovereignman.com/trends/what-happens-if-puerto-rico-became-a-st… What Happens If Puerto Rico Becomes A State? In late 2018, after more than seven fantastic years of living in Chile, I decided to move to Puerto Rico to take advantage of the island’s incredible tax incentives. By moving to Puerto Rico, I traded my right to vote in US federal elections for a 4% tax rate. And I’m pretty confident I got the better end of that deal. I’ve written about this quite extensively– but stick with me, because there’s a new twist to the story. As we’ve covered before, Puerto Rico is a territory of the United States. This means that the island falls under the jurisdiction of the US government for certain matters, like immigration and national defense. But it operates independently in other matters– like taxes. In fact, taxes is probably the most important one: Puerto Rico has its own tax system that’s completely independent from the United States. So residents of Puerto Rico can disconnect entirely from the US tax system, as long as their income is generated from Puerto Rican sources. This is a critical point: what constitutes Puerto Rican income? According to the tax code, this includes dividends paid by a Puerto Rican business, as well as capital gains from certain investments like stocks and bonds. So if you live in Puerto Rico and make most of your money from your Puerto Rican business, or you trade stocks, commodities, crypto, etc., then in most cases your income would be considered Puerto Rican in origin. If that’s the case, you are generally no longer required to pay US federal taxes on that income. In fact you might not even have to file a federal tax return at all. Instead, you would pay Puerto Rican taxes. And that’s where the incentives come in. Several years ago the Puerto Rican government established a number of extraordinary tax incentives, specifically targeted at those two cases– Traders, whose primary source of income is capital gains from their financial investments, literally pay ZERO tax. And entrepreneurs with qualifying businesses are only required to pay a 4% corporate tax rate (plus a tiny municipal rate that’s just a fraction of a percent, depending on which city you live in.) Plus, any dividends that your company pays to you are tax free as long as you live in Puerto Rico. This is an enormous benefit. If you live in the US mainland and operate an LLC, you’d pay, say, a 25% to 40% average tax rate on business income, not counting self-employment tax. If you run your business through a corporation, you’d pay 21% corporate profits tax, plus an additional 15% to 20% dividend tax, plus the 3.8% Obamacare surtax, plus state and local tax. In Puerto Rico it’s just 4%. Call it 4.5% to account for the local municipal tax. But that’s it. No extra dividend tax. No Obamacare surtax. You put more than 95% of your earnings in your pocket. This isn’t some obscure loophole or shady tax shelter. It’s the law. Section 933 of the United States federal tax code specifically exempts US citizens from federal tax on their Puerto Rican sourced income, as long as they are bona fide Puerto Rico residents . (Note that if you have US-sourced income, or income from foreign countries, that income would still be taxable by the IRS. Section 933 only excludes Puerto Rican income from US federal tax.) And in Puerto Rico, the incentives are also codified by law. In fact, once your tax incentive application is approved, you actually sign a contract with the government and are issued an individual tax decree. So even if they change the law later, you’d still be grandfathered in under the old rules, and continue to enjoy your current tax benefits. Now, here’s the twist: there are very, very few events that could trigger a problem with your tax incentives. But one of them just became more likely: Puerto Rico is currently a US territory. But there’s been a movement for quite some time for Puerto Rico to become a state… similar to how there’s a statehood movement for Washington DC. Just like DC, Puerto Rico tends to skew quite liberal politically. So the blue party in the US is very much in favor of Puerto Rico and DC becoming states. (I hate breaking down the world into red and blue, but in this case, it’s relevant.) It means they would likely pick up 2 more senate seats for each one, nearly guaranteeing the Democrats control of the United States Senate. Several months ago, in fact, the House of Representatives passed a bill authorizing DC to become the 51st state. It was killed in the Senate. But it shows the movement is real. Last week, Puerto Ricans had their own election. And statehood was on the ballot. The final tally showed that a majority of Puerto Ricans want to become a state. The Democratic party wants them to become a state. And if that happens, the benefits would go away. Sure, your company would still be subject to a 4% tax rate in Puerto Rico. But then you’d have to pay US federal income tax on top of that. So statehood pretty much kills the deal. But does last week’s vote mean that Puerto Rico will become a state? No, not necessarily. Statehood would require approval by the US House of Representatives. Then the Senate would have to approve it. And in order for that to happen, the Democrats would need to take control of the Senate AND agree to eliminate the filibuster. Then the President would need to sign it into law. So, it’s possible this could happen, but it’s not especially likely. And even if it did happen, there would still be several years of a transition process. So, bottom line, the tax incentives in Puerto Rico are still valid and extremely valuable. And even if they only exist for another 3-5 years, they’re still definitely worth considering.

1 0

Now we see the violence inherent in the NAP-voluntarist schema
by professor rat 17 Dec '21

17 Dec '21

Federal prosecutors alleged that Ross Ulbricht, while preening, posing and posturing as a 'peaceful agorist ', had paid $730,000 in murder-for-hire deals targeting at least five people, allegedly because they threatened to reveal Ulbricht's Silk Road enterprise. This evidence even noted Ulbricht wanted totally innocent bystanders murdered as well while being introduced at trial and supporting these heinous allegations. The evidence that Ulbricht had commissioned murders was considered by the judge in sentencing Ulbricht to life, and was a factor in the Second Circuit's decision to affirm the life sentence. Radicals defending Ulbricht defend a system where rich bastards can tell us what noble pacifists they are in public while hiring hitmen in private. Bit like FOX news recently. These sort of lying fascist assholes need to be driven out with heavy blows where-ever the fuck they congregate - even in Acapulco.

1 0

A Batshit crazy Manifesto
by professor rat 17 Dec '21

17 Dec '21

To show how batshit-crazy all Infowars type sprays about " GovCorp ' are it should be enough to compare them with Erman and Engels . . . https://www.marxists.org/archive/marx/works/1848/communist-manifesto/ch01.h… ". . . The executive of the modern state is but a committee for managing the common affairs of the whole bourgeoisie. . . " Alex Jones eat your heart out.

1 0

GovCorp morons never shut the fuck up
by professor rat 17 Dec '21

17 Dec '21

What kind of freakin' moron lumps together NSA, CIA, GCHQ, FVEY, Chinese, KGB, Israel, Swiss, German, FAANG type companies, etc and calls this ' GovCorp'!? Ohai Gramps . . .

1 0

Wikileaks approve 778 billion for the Pentagon
by professor rat 17 Dec '21

17 Dec '21

Sorry - congress did that - not Wikileaks. My bat. Alice certainly isn't in for a very nice time of it " #VeryAssange JULIAN " I'll be so disheartened that I'll lower myself to government contracting work " ASSANGE 2007. “I am not a politician.” - Julian Assange. JULIAN " "I don't like your tone. If it continues you're out " ASSANGE JULIAN " If you have a problem ... piss off " ASSANGE JULIAN " "If you fuck up, I'll hunt you down and kill you" ASSANGE

1 0

Persecuted journalist deserves solidarity and support
by professor rat 17 Dec '21

17 Dec '21

'The Taliban say they'll kill me if they find me': a female reporter still on the run speaks out. And in related news . . . David Leigh and Luke Harding's history of WikiLeaks describes how journalists took Assange to Moro's, a classy Spanish restaurant in central London. A reporter worried that Assange would risk killing Afghans who had co-operated with American forces if he put US secrets online without taking the basic precaution of removing their names. "Well, they're informants," Assange replied. "So, if they get killed, they've got it coming to them. They deserve it."

1 0

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
by zeynepaydogan 16 Dec '21

16 Dec '21

Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with us on the technical analysis. The editorial opinions reflected below are solely Project Zero’s and do not necessarily reflect those of the organizations we collaborated with during this research. Earlier this year, Citizen Lab managed to capture an NSO iMessage-based zero-click exploit being used to target a Saudi activist. In this two-part blog post series we will describe for the first time how an in-the-wild zero-click iMessage exploit works. Based on our research and findings, we assess this to be one of the most technically sophisticated exploits we've ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states. The vulnerability discussed in this blog post was fixed on September 13, 2021 in [iOS 14.8](https://support.apple.com/en-us/HT212807) as CVE-2021-30860. NSO [NSO](https://en.wikipedia.org/wiki/NSO_Group)[Group](https://en.wikipedia.o… is one of the [highest-profile providers of "access-as-a-service"](https://www.atlanticcouncil.org/in-depth-research-reports/report/countering-cyber-proliferation-zeroing-in-on-access-as-a-service/), selling packaged hacking solutions which [enable nation state actors without a home-grown offensive cyber capability to "pay-to-play"](https://www.atlanticcouncil.org/in-depth-research-reports/issue-brief/surveillance-technology-at-the-fair/), vastly expanding the number of nations with such cyber capabilities. For years, groups like Citizen Lab and Amnesty International have been tracking the use of NSO's mobile spyware package "Pegasus". Despite NSO's claims that they "[[evaluate] the potential for adverse human rights impacts arising from the misuse of NSO products](https://www.nsogroup.com/governance/human-rights-policy/)" Pegasus has been linked to [the hacking of the New York Times journalist Ben Hubbard by the Saudi regime](https://citizenlab.ca/2020/01/stopping-the-press-new-york-times-journalist-targeted-by-saudi-linked-pegasus-spyware-operator/), [hacking of human rights defenders in Morocco](https://www.amnesty.org/en/latest/research/2019/10/morocco-human-r… and [Bahrain](https://citizenlab.ca/2021/08/bahrain-hacks-activists-with-nso-group-zero-click-iphone-exploits/), [the targeting of Amnesty International staff](https://www.amnesty.org/en/latest/research/2018/08/amnesty-internati… and dozens of other cases. Last month the United States added NSO to the "Entity List", severely restricting the ability of US companies to do business with NSO and [stating in a press release](https://www.commerce.gov/news/press-releases/2021/11/commerce-adds… that "[NSO's tools] enabled foreign governments to conduct transnational repression, which is the practice of authoritarian governments targeting dissidents, journalists and activists outside of their sovereign borders to silence dissent." Citizen Lab was able to recover these Pegasus exploits from an iPhone and therefore this analysis covers NSO's capabilities against iPhone. We are aware that NSO sells similar zero-click capabilities which target Android devices; Project Zero does not have samples of these exploits but if you do, please reach out. From One to Zero In previous cases such as the [Million Dollar Dissident from 2016](https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/), targets were sent links in SMS messages source: https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-… The target was only hacked when they clicked the link, a technique known as a one-click exploit. Recently, however, it has been documented that NSO is offering their clients zero-click exploitation technology, where even very technically savvy targets who might not click a phishing link are completely unaware they are being targeted. In the zero-click scenario no user interaction is required. Meaning, the attacker doesn't need to send phishing messages; the exploit just works silently in the background. Short of not using a device, there is no way to prevent exploitation by a zero-click exploit; it's a weapon against which there is no defense. One weird trick The initial entry point for Pegasus on iPhone is iMessage. This means that a victim can be targeted just using their phone number or AppleID username. iMessage has native support for GIF images, the typically small and low quality animated images popular in meme culture. You can send and receive GIFs in iMessage chats and they show up in the chat window. Apple wanted to make those GIFs loop endlessly rather than only play once, so very early on in the [iMessage parsing and processing pipeline](https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage… (after a message has been received but well before the message is shown), iMessage calls the following method in the IMTranscoderAgent process (outside the "BlastDoor" sandbox), passing any image file received with the extension .gif: [IMGIFUtils copyGifFromPath:toDestinationPath:error] Looking at the selector name, the intention here was probably to just copy the GIF file before editing the loop count field, but the semantics of this method are different. Under the hood it uses the CoreGraphics APIs to render the source image to a new GIF file at the destination path. And just because the source filename has to end in .gif, that doesn't mean it's really a GIF file. The ImageIO library, [as detailed in a previous Project Zero blogpost](https://googleprojectzero.blogspot.com/2020/04/fuzzing-imageio.ht…, is used to guess the correct format of the source file and parse it, completely ignoring the file extension. Using this "fake gif" trick, over 20 image codecs are suddenly part of the iMessage zero-click attack surface, including some very obscure and complex formats, remotely exposing probably hundreds of thousands of lines of code. Note: Apple inform us that they have restricted the available ImageIO formats reachable from IMTranscoderAgent starting in iOS 14.8.1 (26 October 2021), and completely removed the GIF code path from IMTranscoderAgent starting in iOS 15.0 (20 September 2021), with GIF decoding taking place entirely within BlastDoor. PDF in your GIF NSO uses the "fake gif" trick to target a vulnerability in the CoreGraphics PDF parser. PDF was a popular target for exploitation around a decade ago, due to its ubiquity and complexity. Plus, the availability of javascript inside PDFs made development of reliable exploits far easier. The CoreGraphics PDF parser doesn't seem to interpret javascript, but NSO managed to find something equally powerful inside the CoreGraphics PDF parser... Extreme compression In the late 1990's, bandwidth and storage were much more scarce than they are now. It was in that environment that the [JBIG2](https://en.wikipedia.org/wiki/JBIG2) standard emerged. JBIG2 is a domain specific image codec designed to compress images where pixels can only be black or white. It was developed to achieve extremely high compression ratios for scans of text documents and was implemented and used in high-end office scanner/printer devices like the XEROX WorkCenter device shown below. If you used the scan to pdf functionality of a device like this a decade ago, your PDF likely had a JBIG2 stream in it. The PDFs files produced by those scanners were exceptionally small, perhaps only a few kilobytes. There are two novel techniques which JBIG2 uses to achieve these extreme compression ratios which are relevant to this exploit: Technique 1: Segmentation and substitution Effectively every text document, especially those written in languages with small alphabets like English or German, consists of many repeated letters (also known as glyphs) on each page. JBIG2 tries to segment each page into glyphs then uses simple pattern matching to match up glyphs which look the same: https://blogger.googleusercontent.com/img/a/AVvXsEh6iNZLjmFtsjnVl7fWtG-Kq-T… Simple pattern matching can find all the shapes which look similar on a page, in this case all the 'e's JBIG2 doesn't actually know anything about glyphs and it isn't doing OCR (optical character recognition.) A JBIG encoder is just looking for connected regions of pixels and grouping similar looking regions together. The compression algorithm is to simply substitute all sufficiently-similar looking regions with a copy of just one of them: https://blogger.googleusercontent.com/img/a/AVvXsEgxM5VTCT6dKeMRITKT6kQDsQu… Replacing all occurrences of similar glyphs with a copy of just one often yields a document which is still quite legible and enables very high compression ratios In this case the output is perfectly readable but the amount of information to be stored is significantly reduced. Rather than needing to store all the original pixel information for the whole page you only need a compressed version of the "reference glyph" for each character and the relative coordinates of all the places where copies should be made. The decompression algorithm then treats the output page like a canvas and "draws" the exact same glyph at all the stored locations. There's a significant issue with such a scheme: it's far too easy for a poor encoder to accidentally swap similar looking characters, and this can happen with interesting consequences. [D. Kriesel's blog has some motivating examples](http://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres_are_s… where PDFs of scanned invoices have different figures or PDFs of scanned construction drawings end up with incorrect measurements. These aren't the issues we're looking at, but they are one significant reason why JBIG2 is not a common compression format anymore. Technique 2: Refinement coding As mentioned above, the substitution based compression output is lossy. After a round of compression and decompression the rendered output doesn't look exactly like the input. But JBIG2 also supports lossless compression as well as an intermediate "less lossy" compression mode. It does this by also storing (and compressing) the difference between the substituted glyph and each original glyph. Here's an example showing a difference mask between a substituted character on the left and the original lossless character in the middle: https://blogger.googleusercontent.com/img/a/AVvXsEiJn4fCqItjd3bgJ_re3nMHB4a… Using the XOR operator on bitmaps to compute a difference image In this simple example the encoder can store the difference mask shown on the right, then during decompression the difference mask can be XORed with the substituted character to recover the exact pixels making up the original character. There are some more tricks outside of the scope of this blog post to further compress that difference mask using the intermediate forms of the substituted character as a "context" for the compression. Rather than completely encoding the entire difference in one go, it can be done in steps, with each iteration using a logical operator (one of AND, OR, XOR or XNOR) to set, clear or flip bits. Each successive refinement step brings the rendered output closer to the original and this allows a level of control over the "lossiness" of the compression. The implementation of these refinement coding steps is very flexible and they are also able to "read" values already present on the output canvas. A JBIG2 stream Most of the CoreGraphics PDF decoder appears to be Apple proprietary code, but the JBIG2 implementation is from Xpdf, [the source code for which is freely available](https://www.xpdfreader.com/download.html). The JBIG2 format is a series of segments, which can be thought of as a series of drawing commands which are executed sequentially in a single pass. The CoreGraphics JBIG2 parser supports 19 different segment types which include operations like defining a new page, decoding a huffman table or rendering a bitmap to given coordinates on the page. Segments are represented by the class JBIG2Segment and its subclasses JBIG2Bitmap and JBIG2SymbolDict. A JBIG2Bitmap represents a rectangular array of pixels. Its data field points to a backing-buffer containing the rendering canvas. A JBIG2SymbolDict groups JBIG2Bitmaps together. The destination page is represented as a JBIG2Bitmap, as are individual glyphs. JBIG2Segments can be referred to by a segment number and the GList vector type stores pointers to all the JBIG2Segments. To look up a segment by segment number the GList is scanned sequentially. The vulnerability The vulnerability is a classic integer overflow when collating referenced segments: Guint numSyms; // (1) numSyms = 0; for (i = 0; i < nRefSegs; ++i) { if ((seg = findSegment(refSegs[i]))) { if (seg->getType() == jbig2SegSymbolDict) { numSyms += ((JBIG2SymbolDict *)seg)->getSize(); // (2) } else if (seg->getType() == jbig2SegCodeTable) { codeTables->append(seg); } } else { error(errSyntaxError, getPos(), "Invalid segment reference in JBIG2 text region"); delete codeTables; return; } } ... // get the symbol bitmaps syms = (JBIG2Bitmap **)gmallocn(numSyms, sizeof(JBIG2Bitmap *)); // (3) kk = 0; for (i = 0; i < nRefSegs; ++i) { if ((seg = findSegment(refSegs[i]))) { if (seg->getType() == jbig2SegSymbolDict) { symbolDict = (JBIG2SymbolDict *)seg; for (k = 0; k < symbolDict->getSize(); ++k) { syms[kk++] = symbolDict->getBitmap(k); // (4) } } } } numSyms is a 32-bit integer declared at (1). By supplying carefully crafted reference segments it's possible for the repeated addition at (2) to cause numSyms to overflow to a controlled, small value. Inside the inner-most loop at (4) JBIG2Bitmap pointer values are written into the undersized syms buffer. Without another trick this loop would write over 32GB of data into the undersized syms buffer, certainly causing a crash. To avoid that crash the heap is groomed such that the first few writes off of the end of the syms buffer corrupt the GList backing buffer. This GList stores all known segments and is used by the findSegments routine to map from the segment numbers passed in refSegs to JBIG2Segment pointers. The overflow causes the JBIG2Segment pointers in the GList to be overwritten with JBIG2Bitmap pointers at (4). Conveniently since JBIG2Bitmap inherits from JBIG2Segment the seg->getType() virtual call succeed even on devices where Pointer Authentication is enabled (which is used to perform a weak type check on virtual calls) but the returned type will now not be equal to jbig2SegSymbolDict thus causing further writes at (4) to not be reached and bounding the extent of the memory corruption. A simplified view of the memory layout when the heap overflow occurs showing the undersized-buffer below the GList backing buffer and the JBIG2Bitmap Boundless unbounding Directly after the corrupted segments GList, the attacker grooms the JBIG2Bitmap object which represents the current page (the place to where current drawing commands render). JBIG2Bitmaps are simple wrappers around a backing buffer, storing the buffer’s width and height (in bits) as well as a line value which defines how many bytes are stored for each The memory layout of the JBIG2Bitmap object showing the segnum, w, h and line fields which are corrupted during the overflow By carefully structuring refSegs they can stop the overflow after writing exactly three more JBIG2Bitmap pointers after the end of the segments GList buffer. This overwrites the vtable pointer and the first four fields of the JBIG2Bitmap representing the current page. Due to the nature of the iOS address space layout these pointers are very likely to be in the second 4GB of virtual memory, with addresses between 0x100000000 and 0x1ffffffff. Since all iOS hardware is little endian (meaning that the w and line fields are likely to be overwritten with 0x1 — the most-significant half of a JBIG2Bitmap pointer) and the segNum and h fields are likely to be overwritten with the least-significant half of such a pointer, a fairly random value depending on heap layout and ASLR somewhere between 0x100000 and 0xffffffff. This gives the current destination page JBIG2Bitmap an unknown, but very large, value for h. Since that h value is used for bounds checking and is supposed to reflect the allocated size of the page backing buffer, this has the effect of "unbounding" the drawing canvas. This means that subsequent JBIG2 segment commands can read and write memory outside of the original bounds of the page backing buffer. The heap groom also places the current page's backing buffer just below the undersized syms buffer, such that when the page JBIG2Bitmap is unbounded, it's able to read and write its own fields: The memory layout showing how the unbounded bitmap backing buffer is able to reference the JBIG2Bitmap object and modify fields in it as it is located after the backing buffer in memory By rendering 4-byte bitmaps at the correct canvas coordinates they can write to all the fields of the page JBIG2Bitmap and by carefully choosing new values for w, h and line, they can write to arbitrary offsets from the page backing buffer. At this point it would also be possible to write to arbitrary absolute memory addresses if you knew their offsets from the page backing buffer. But how to compute those offsets? Thus far, this exploit has proceeded in a manner very similar to a "canonical" scripting language exploit which in Javascript might end up with an unbounded ArrayBuffer object with access to memory. But in those cases the attacker has the ability to run arbitrary Javascript which can obviously be used to compute offsets and perform arbitrary computations. How do you do that in a single-pass image parser? My other compression format is turing-complete! As mentioned earlier, the sequence of steps which implement JBIG2 refinement are very flexible. Refinement steps can reference both the output bitmap and any previously created segments, as well as render output to either the current page or a segment. By carefully crafting the context-dependent part of the refinement decompression, it's possible to craft sequences of segments where only the refinement combination operators have any effect. In practice this means it is possible to apply the AND, OR, XOR and XNOR logical operators between memory regions at arbitrary offsets from the current page's JBIG2Bitmap backing buffer. And since that has been unbounded… it's possible to perform those logical operations on memory at arbitrary out-of-bounds offsets: The memory layout showing how logical operators can be applied out-of-bounds It's when you take this to its most extreme form that things start to get really interesting. What if rather than operating on glyph-sized sub-rectangles you instead operated on single bits? You can now provide as input a sequence of JBIG2 segment commands which implement a sequence of logical bit operations to apply to the page. And since the page buffer has been unbounded those bit operations can operate on arbitrary memory. With a bit of back-of-the-envelope scribbling you can convince yourself that with just the available AND, OR, XOR and XNOR logical operators you can in fact compute any computable function - the simplest proof being that you can create a logical NOT operator by XORing with 1 and then putting an AND gate in front of that to form a NAND gate: https://blogger.googleusercontent.com/img/a/AVvXsEgU2PbU_PLrLOH1W-ZuOIC0aR5… An AND gate connected to one input of an XOR gate. The other XOR gate input is connected to the constant value 1 creating an NAND. A NAND gate is an example of a universal logic gate; one from which all other gates can be built and from which a circuit can be [built to compute any computable function](https://www.nand2tetris.org/). Practical circuits JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent. The bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying. In a future post (currently being finished), we'll take a look at exactly how they escape the IMTranscoderAgent sandbox.

1 0