"It also indicates that Apple has a MAJOR blinking red five-alarm-fire problem with iMessage security that their BlastDoor Framework (introduced in iOS 14 to make zero-click exploitation more difficult) ain't solving."
And:
"BlastDoor is a great step, to be sure, but it's pretty lame to just slap sandboxing on iMessage and hope for the best. How about: "don't automatically run extremely complex and buggy parsing on data that strangers push to your phone?!"
Only run the known dodgy parsing code on stuff coming from people in your contact list, not just on any random image that comes in.
On incoming message, check one thing and one thing only: is the sender in the contact list? If YES...
+ Run the message through BlastDoor and continue as normal.
If NOT…
- Stop all non-essential parsing immediately.
- Continue with a flow similar to modern e-mail clients (To increase your privacy, we have blocked some elements of this message).
- Only continue normal message parsing if the user explicitly consents.