Calif teases Signal 1-click and iMessage demos from Hexacon
The Calif blog (blog.calif.io) has published a terse post about a series of demos its authors say they revealed at the Hexacon conference in Paris "today". The post carries no explicit date, and the authors write only as "we"; it names no individuals. The post's title refers to having "hacked the iPhone", but the body does not elaborate on that claim.
The body is a four-item list. Item 1 is "Signal 1-click". Item 2 is a rhetorical jab: "But who cares about a third-party app when everyone uses iMessage, right?", which points to an iMessage demo. Item 3 asks "Can your iPhone do this?" and does not say what the demo shows. Item 4 is a joke on the acronym APT: "APT stands for Apple Persistent Threat".
The authors state that "Everything will be released in due time" and give no timescale. The post offers no vulnerability details, CVEs, affected iOS versions or exploitation mechanism. It does not say what the Signal or iMessage demos achieve beyond the label "1-click", and it says nothing about vendor notification, patches or Apple's response.
Key facts
- The Calif blog says it revealed a series of demos at Hexacon in Paris "today"; the post gives no explicit date.
- The list opens with a "Signal 1-click" demo, followed by an item aimed at iMessage.
- Item 4 expands APT as "Apple Persistent Threat", a play on the usual meaning of the acronym.
- The authors say "Everything will be released in due time" and give no timescale.
- No vulnerability details, CVEs, affected iOS versions or exploitation mechanism are given.
Why it matters
If the demos are what the post implies, they target the iPhone and two widely used messaging paths: Signal and iMessage. The post's title claims the authors hacked "the iPhone", but the body does not elaborate on that. For now it is a teaser from a security conference, and the substance is still to come.
Who it affects
The post points at users of Signal and iMessage on iPhone, since those are the two apps named. It does not say which devices, iOS versions or app versions were involved, so the real exposure cannot be judged from this text.
How to use it
There is nothing to apply yet. The authors say everything will be released in due time, and no timescale is given. The practical step is to watch the Calif blog for the full material before drawing conclusions or changing any settings.
How solid is it
Thin. The source is a 271-character post from the Calif blog with a four-item list and no technical detail. The authors write as "we" and name no individuals. It does not state what the Signal or iMessage demos achieve, and the claim that the iPhone was hacked is not elaborated in the body. Nothing here can be independently checked until the promised release.
Risks and caveats
Do not read more into the list than it says. Only "Signal 1-click" is stated for the first item; the post does not say the iPhone was fully compromised or jailbroken. It says nothing about vendor notification, patches or Apple's response. Item 3 does not say what its demo shows, and the APT line is a joke on the acronym, not a technical finding.
“Everything will be released in due time.”
— Calif, blog.calif.io