Anyone have the clode?
https://mega.nz/#!X4piUYwA!zXH1vCliaO00V2v2554vegCnXzQ69jdAX... 11.7MB HTML file. It crashes the tab in Chrome 65.0.3324.2 64-bit and locks up Firefox 58.0 64-bit on Windows for me.
Works on my ff 58.0b16 win10 64bit
'Text bomb' is latest Apple bug
11–20 of 113 posts
Re: 'Text bomb' is latest Apple bug
#12The linked blog assures people that this can't be used to access data. Once something is crashing an app/OS, can you really say that? I mean, can you be sure there's no one clever enough to capitalize on the underlying software error leading to this state?
Don’t know any details about this one, but some bugs are just not exploitable beyond denial of service. If all you can do is provoke an action that makes the OS kill the process immediately, for example. Like a null pointer dereference under the right circumstances.
Re: 'Text bomb' is latest Apple bug
#13Earlier quoted context omitted.
https://mega.nz/#!X4piUYwA!zXH1vCliaO00V2v2554vegCnXzQ69jdAX... 11.7MB HTML file. It crashes the tab in Chrome 65.0.3324.2 64-bit and locks up Firefox 58.0 64-bit on Windows for me.
Works on my ff 58.0b16 win10 64bit
I tried to repeat the test in FF and you're right, it does not lock it up, but once I click in the black area of the page, it becomes unresponsive.
Re: 'Text bomb' is latest Apple bug
#14Based on a web search, https://bogdanz.me/work/diddu.html might be a working mirror of the proof of concept. It appears to contain a 10MB long UTF-8 mess in both the og:title meta content and in a mailto: link. I'd guess it's supposed to crash iOS apps by either posting that link if it displays links in a thumbnail element using og:title or otherwise by pasting the huge mailto link contained in the webpage, or perhap…
Could someone just use some sort of fuzzing software to generate these?
Just keep trying many until one hits.
Re: 'Text bomb' is latest Apple bug
#15Based on a web search, https://bogdanz.me/work/diddu.html might be a working mirror of the proof of concept. It appears to contain a 10MB long UTF-8 mess in both the og:title meta content and in a mailto: link. I'd guess it's supposed to crash iOS apps by either posting that link if it displays links in a thumbnail element using og:title or otherwise by pasting the huge mailto link contained in the webpage, or perhap…
Could someone just use some sort of fuzzing software to generate these? Just keep trying many until one hits.
You can, but the number of possible inputs is huge and fuzzing won't prove that no such input exists.
Re: 'Text bomb' is latest Apple bug
#16The linked blog assures people that this can't be used to access data. Once something is crashing an app/OS, can you really say that? I mean, can you be sure there's no one clever enough to capitalize on the underlying software error leading to this state?
That would be a general issue with app crashing, and a huge deal worth it’s own series of articles. iOS’ sandboxing makes it so unlikely this exists, it’s not worth mentioning and the sensational writing might be counterproductive to getting the actual issue fixed. To use an analogy, it’d be like mentioning that someone could hack Google in an article about Gmail downtime.
Re: 'Text bomb' is latest Apple bug
#17Sounds like AOL punters. Fate X anyone?
Right? I remember spamming people with h1 tags, then seeing them go offline. Welp, was fun for 5 minutes.
Re: 'Text bomb' is latest Apple bug
#18So shipping software has an obscure bug that can cause a crash. Why is this news?
Re: 'Text bomb' is latest Apple bug
#19Their lock screen crashing bug from iOS 11 that was fixed with 11.1 came back with 11.2 and I want to throw the thing out the window. Every time I hit the power button it crashes and have to type out the pin.
Re: 'Text bomb' is latest Apple bug
#20The linked blog assures people that this can't be used to access data. Once something is crashing an app/OS, can you really say that? I mean, can you be sure there's no one clever enough to capitalize on the underlying software error leading to this state?
Don’t know any details about this one, but some bugs are just not exploitable beyond denial of service. If all you can do is provoke an action that makes the OS kill the process immediately, for example. Like a null pointer dereference under the right circumstances.
That's kind of what I was thinking, but it sounds like you or I know about as much about the cause of the bug as the person offering assurances.