Sweet QuaDreams or Nightmare before Christmas? Dissecting an iOS 0-Day

The talk opens with the private sector offensive actor market, where firms sell intrusion and surveillance tools to governments, and the risk when those tools reach journalists, dissidents and opposition figures. The case centers on a spyware sample tied to QuaDream, an Israeli vendor that has since gone out of business. The speakers separate zero-day from zero-click attacks and explain why BlastDoor hardening of iMessage pushed attackers toward other entry points.

The research combined two directions. One began with a victim phone, where log review found an implausible binary launched from a system staging directory. The other started from a Go sample attributed to the same actor and was reversed top-down. The sample collected device status, audio, photos, location and keychain items, and it used a declarative predicate language so operators could decide when each feature fired. It also injected code into the process that generates Apple ID two-factor codes and hooked time functions to mint codes for arbitrary times. A calendar cleanup routine led the team to recover a backdated invite from iCloud. That invite carried XML inside a calendar field, which reached the phone's XML parser. The exact parser flaw was not identified, but the injected XML was confirmed to reach the parser.

The takeaways are practical. Sharing findings across groups uncovered the vector. Newly added cloud-synced services create fresh attack surface. Lockdown mode blocked such interactions from unknown accounts in cases the researchers saw. Because persistence is hard on iOS, a reliable zero-click lets attackers simply reinfect a device after a reboot.