Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Exploit Breaks the iPhone's Messaging App with One Text

tomshardware.com

Post reply on HN
Print view View original

11–20 of 40 posts

Re: New Exploit Breaks the iPhone's Messaging App with One Text

#11

Post by userbinator »

The flip side of making things opaque and "just work" per Apple philosophy, is that when they don't work, trying to fix it becomes even more difficult.

This is a very unusual "exploit", however --- according to https://en.wikipedia.org/wiki/VCard it's not even a valid .vcf file but looks to be just an RTF with copious amounts of text (appears to be bytes from PNG images concatenated together, although I haven't actually tried to read them as such.)

I think there's some sort of hidden quadratic (or higher) algorithm that's causing this, along the lines of https://www.joelonsoftware.com/2001/12/11/back-to-basics/ . As a datapoint, this 7-year-old machine rendered that file as RTF (in WordPad) in less than a second. An iPhone doesn't have quite as powerful a CPU, but still shouldn't be struggling to do it.

Re: New Exploit Breaks the iPhone's Messaging App with One Text

#12

Post by userbinator »

aiur3la wrote: post #2

Serious question: this is the third time a exploit of this kind is publicly revealed for this app. How comes we don't see a global hack outbreak? I mean, script kiddies would love to break millions of phones. What has stopped them from doing that so far?

It's really just a temporary and pretty easily reverted DoS, so it's more of an annoyance than anything of a serious security exploit.

Re: New Exploit Breaks the iPhone's Messaging App with One Text

#13

Post by x1798DE »

dguido wrote: post #7
aiur3la wrote: post #2

Serious question: this is the third time a exploit of this kind is publicly revealed for this app. How comes we don't see a global hack outbreak? I mean, script kiddies would love to break millions of phones. What has stopped them from doing that so far?

The motivation is pretty weak. If people found a way to make money by doing this, it would be massively exploited. But the reward for breaking a bunch of phones is... self satisfaction? ok.

I don't know that people were seriously making money on most of the script kiddie shit that was going on on the internet back before ransomware and bitcoin and such (other than AV vendors), and yet it was rampant anyway. I imagine there are still people out there who do this sort of thing "for the lulz".

Re: New Exploit Breaks the iPhone's Messaging App with One Text

#14

Post by burntwater »

Can't say factually it would work here, but this makes me pine for the days of Blackberry Desktop Manager and its very granular backup/wipe/restore abilities.

I no longer do IT support for mobile devices, so I'm not sure what the current abilities are, but when I stopped in ~2012 the only options for both iPhones and Android were basically full wipes and restores. All or nothing. With the Blackberry you could backup/wipe/restore only SMS, or only contacts, or only calendar, etc. Could also easily transfer exactly the data you wanted to a new phone.

Re: New Exploit Breaks the iPhone's Messaging App with One Text

#15

Post by berberous »

burntwater wrote: post #14

Can't say factually it would work here, but this makes me pine for the days of Blackberry Desktop Manager and its very granular backup/wipe/restore abilities. I no longer do IT support for mobile devices, so I'm not sure what the current abilities are, but when I stopped in ~2012 the only options for both iPhones and Android were basically full wipes and restores. All or nothing. With the Blackberry you could backup/…

Yup. Apple's tech support insisted that the reason my iPhone 6 (not a 6s) shut off at 30-40% was due to a software issue, not a battery issue. They suggested I not only wipe my phone, but set it up as a brand new device. It's insane that this is the only way to fix something they claim to know is a software issue.

Re: New Exploit Breaks the iPhone's Messaging App with One Text

#18

Post by Tharre »

chatmasta wrote: post #17
dang wrote: post #16

Url changed from http://www.tomshardware.com/news/exploit-iphone-message-sing... , which points to this.

The new URL does not allow viewing unless you disable your ad blocker.

Add the following to your filters to make it work (tested with uBlock origin):

    ! 31/12/2016, 19:57:03 https://vincedes3.com/crash-message-app-iphone/
    vincedes3.com###rba2

Re: New Exploit Breaks the iPhone's Messaging App with One Text

#19

Post by NEDM64 »

Well, I didn't watch the video, but I'm guess what the video didn't show was that after 3 app crashes, the app state will be discarded and restarted as usual in a PC.

Learn about it before criticizing after watching a infotainment video on YouTube.

Then, fixing this is just a question of not opening the vCard, and update your phone software when the fix is available.

Re: New Exploit Breaks the iPhone's Messaging App with One Text

#20

Post by dimva »

x1798DE wrote: post #13
dguido wrote: post #7

Earlier quoted context omitted.

The motivation is pretty weak. If people found a way to make money by doing this, it would be massively exploited. But the reward for breaking a bunch of phones is... self satisfaction? ok.

I don't know that people were seriously making money on most of the script kiddie shit that was going on on the internet back before ransomware and bitcoin and such (other than AV vendors), and yet it was rampant anyway. I imagine there are still people out there who do this sort of thing "for the lulz".

I'm not so sure. Nowadays they can focus their energies on profitable activities like ransomware or adware. If you're going to break the law to cause grief anyway, why not make some money while you're at it?
Post reply on HN