Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Text bomb' is latest Apple bug

bbc.com

Post reply on HN
Print view View original

51–60 of 113 posts

Re: 'Text bomb' is latest Apple bug

#51

Post by saurik »

1123581321 wrote: post #16
menacingly wrote: post #9

The linked blog assures people that this can't be used to access data. Once something is crashing an app/OS, can you really say that? I mean, can you be sure there's no one clever enough to capitalize on the underlying software error leading to this state?

That would be a general issue with app crashing, and a huge deal worth it’s own series of articles. iOS’ sandboxing makes it so unlikely this exists, it’s not worth mentioning and the sensational writing might be counterproductive to getting the actual issue fixed. To use an analogy, it’d be like mentioning that someone could hack Google in an article about Gmail downtime.

The SMS app is itself "data", and it is probably the most sensitive data on my phone other than my keychain. You don't have to take a step back and say "Google": ignore you have a way to DoS someone's usage of Gmail, you can still note that "this can't be used to access data from Gmail".

Re: 'Text bomb' is latest Apple bug

#52

Post by herodotus »

hotpxl wrote: post #21

- Mr Masri said he "always reports bugs" before releasing them. Well I don't think Apple really reads bug reports.

If you submit a report on bugreport.apple.com, it will be triaged and (if necessary) passed on to the appropriate team to asses. I fixed several external user reported bugs when I worked at apple. You have to have a developer account to use bugreport. Now that I have retired, I use it. The people triaging do not know I used to be at apple. Not all the issues I report get resolved, just because they are probably low priority. But the important ones are dealt with, usually quite quickly.

Re: 'Text bomb' is latest Apple bug

#54

Post by ryanlol »

Orangeair wrote: post #27

Come to think of it, I believe I've heard of multiple "making the device render this text causes a crash" bugs for Apple devices, but never on any other platforms. Is this type of bug just that much more common on Apple devices, or are there plenty of other cases out there that I just don't know about?

>or are there plenty of other cases out there that I just don't know about?

Yeah, go on IRC sometime and you’ll probably find out relatively quick.

Plenty of magic strings that break things on various platforms, hardly just an OS X thing.

Re: 'Text bomb' is latest Apple bug

#55

Post by rspeer »

Anyone got any information on how the text rendering bug actually works (not just hand-waving it away as "oh it's UTF-8")?

I can see that the file alternates between segments of:

- Repetitions of the glyph "t̴́̍̒", which is a lowercase t with a combining tilde overlay, an acute accent, a vertical line above, and a turned comma above

- Random-looking ASCII characters with lots of apostrophes (spelled as ' in the HTML)

- Short sequences of spaces, non-breaking spaces, and zero-width joiners

- Occasional emoji

The "t̴́̍̒"s manage to slow down my terminal and glitch its rendering a bit. Is it that they're unexpectedly tall? But we've had zalgo-text for a while and it hasn't actually crashed devices.

Re: 'Text bomb' is latest Apple bug

#56

Post by Bitcoin_McPonzi »

jakobegger wrote: post #33

So a crashing bug in the text rendering framework is now worth an article in major publications? I stumbled over two or three of them in the last couple of years while debugging crash reports sent in by customers. Seems that text rendering is hard. Maybe fuzzing CoreText would be a worthwhile target to discover vulnerabilities?

I'm not sure either Y Combinator News nor the linked site are "major publications".

It is news, because there's a _completely passive_ way to crash a device, and crashes nearly always will allow for unauthorized code execution, given enough resources to work on the problem. You could launch a DOS attack on phones this way, and we all know that Cell Phones are how we're warned about emergencies, etc.

For what it's worth, Microsoft Edge, my default browser, had no problems with this page.

Re: 'Text bomb' is latest Apple bug

#58

Post by on_and_off »

Orangeair wrote: post #27

Come to think of it, I believe I've heard of multiple "making the device render this text causes a crash" bugs for Apple devices, but never on any other platforms. Is this type of bug just that much more common on Apple devices, or are there plenty of other cases out there that I just don't know about?

More of a potential problem than an existing one but I know potential issues have shapped how fonts are delivered on Android :

A recent version of the OS + support lib added the possibility to reference a font in your app in order to have it downloaded (if necessary) and applied to your views.

IIRC It is restricted to one font delivery system only allowing fonts available on Google fonts. Not because of a power grab, but because fonts are not just graphics but also run a bunch of code.

So unrestricted access would have been a big security hole.

If you want more details, the font team talked about it at length during an Android Developer Backstage podcast episode.

Re: 'Text bomb' is latest Apple bug

#59

Post by zackify »

jakobegger wrote: post #33

So a crashing bug in the text rendering framework is now worth an article in major publications? I stumbled over two or three of them in the last couple of years while debugging crash reports sent in by customers. Seems that text rendering is hard. Maybe fuzzing CoreText would be a worthwhile target to discover vulnerabilities?

My iPhone X wont even open imessages after trying to delete two texts with this message, i would say its a pretty big problem

Re: 'Text bomb' is latest Apple bug

#60

Post by korzun »

rspeer wrote: post #55

Anyone got any information on how the text rendering bug actually works (not just hand-waving it away as "oh it's UTF-8")? I can see that the file alternates between segments of: - Repetitions of the glyph "t̴́̍̒", which is a lowercase t with a combining tilde overlay, an acute accent, a vertical line above, and a turned comma above - Random-looking ASCII characters with lots of apostrophes (spelled as ' in the H…

I believe it might have something to do with sizing down/padding of the parent elements that attempt to contain the out of spec characters.
Post reply on HN