Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Text bomb' is latest Apple bug

bbc.com

Post reply on HN
Print view View original

61–70 of 113 posts

Re: 'Text bomb' is latest Apple bug

#61

Post by qubex »

menacingly wrote: post #22
1123581321 wrote: post #16

Earlier quoted context omitted.

That would be a general issue with app crashing, and a huge deal worth it’s own series of articles. iOS’ sandboxing makes it so unlikely this exists, it’s not worth mentioning and the sensational writing might be counterproductive to getting the actual issue fixed. To use an analogy, it’d be like mentioning that someone could hack Google in an article about Gmail downtime.

I see your point, but I actually think users should be _more_ alarmed when an input makes software crash, for just this reason. They tend to think of it as a harmless annoyance. Also, while sandboxing may be designed to prevent this, Messages is probably also designed not to crash on link sharing.

There's far more risk in software not crashing when it gets malformed or otherwise unexpected input. If an application crashes, it's memory space has been relinquished and its execution process aborted. Yes, something could've been spawned, but... in general crashing when something unexpected comes up is more sensible, desirable behaviour.

(Or am I wrong? I'm not a professional programmer. I'm just reasoning from common sense.)

Re: 'Text bomb' is latest Apple bug

#62

Post by testplzignore »

Someone1234 wrote: post #34
devit wrote: post #5

Based on a web search, https://bogdanz.me/work/diddu.html might be a working mirror of the proof of concept. It appears to contain a 10MB long UTF-8 mess in both the og:title meta content and in a mailto: link. I'd guess it's supposed to crash iOS apps by either posting that link if it displays links in a thumbnail element using og:title or otherwise by pasting the huge mailto link contained in the webpage, or perhap…

That site caused Firefox 57 (64bit) to lock up on Windows 10... It is an i7, 16 GB total (7 GB free), and an SSD.

Same for me, except on Windows 7. CPU spiked to 100% and I warmed up my hands with the extra heat :). Closing the tab and waiting a minute or so (the usual thing I do for cpu/memory intensive pages like this) didn't work. I had to completely restart Firefox to get it back to normal.

Re: 'Text bomb' is latest Apple bug

#64

Post by AgentME »

qubex wrote: post #61
menacingly wrote: post #22

Earlier quoted context omitted.

I see your point, but I actually think users should be _more_ alarmed when an input makes software crash, for just this reason. They tend to think of it as a harmless annoyance. Also, while sandboxing may be designed to prevent this, Messages is probably also designed not to crash on link sharing.

There's far more risk in software not crashing when it gets malformed or otherwise unexpected input. If an application crashes, it's memory space has been relinquished and its execution process aborted. Yes, something could've been spawned, but... in general crashing when something unexpected comes up is more sensible, desirable behaviour. (Or am I wrong? I'm not a professional programmer. I'm just reasoning from com…

The bug causing this crash might be exploitable. Think of a classic buffer overflow: if you overflow a buffer with all zeroes or random data, then the return address most likely gets overwritten with garbage that doesn't point to valid code or a mapped address and the process crashes. But if the attacker specially chose the data they put in the buffer, then they could choose to overwrite the return address with a valid memory address and make the process execute the attacker's own code.

If software written in C/C++ crashes and it's not because of a null pointer dereference specifically, then it's realistic to worry about whether it might be because of an exploitable bug (like a buffer overflow, a double-free, etc). One common way for people to try to find exploitable bugs is to script a program to re-run with random input data to figure out which inputs crash it, and then they debug the crashes to see if they're caused by exploitable bugs.

Re: 'Text bomb' is latest Apple bug

#65

Post by [deleted] »

dspillett wrote: post #44
Orangeair wrote: post #27

Come to think of it, I believe I've heard of multiple "making the device render this text causes a crash" bugs for Apple devices, but never on any other platforms. Is this type of bug just that much more common on Apple devices, or are there plenty of other cases out there that I just don't know about?

> but never on any other platforms There have been numerous crash-bugs for the Windows font renderer, and even security exploits using it (especially before windows 10, as earlier than that font rendering was performed in the kernel's space rather than user-land). I wouldn't be surprised to learn of issues (at least of the falling over variety) in common Linux rendering engines and for other OSs too.

[deleted]

Re: 'Text bomb' is latest Apple bug

#66

Post by kevin_thibedeau »

dspillett wrote: post #44
Orangeair wrote: post #27

Come to think of it, I believe I've heard of multiple "making the device render this text causes a crash" bugs for Apple devices, but never on any other platforms. Is this type of bug just that much more common on Apple devices, or are there plenty of other cases out there that I just don't know about?

> but never on any other platforms There have been numerous crash-bugs for the Windows font renderer, and even security exploits using it (especially before windows 10, as earlier than that font rendering was performed in the kernel's space rather than user-land). I wouldn't be surprised to learn of issues (at least of the falling over variety) in common Linux rendering engines and for other OSs too.

The Windows bugs are usually tied into executing TTF hint bytecode which is ignored by Freetype.

Re: 'Text bomb' is latest Apple bug

#67

Post by macintux »

qubex wrote: post #61
menacingly wrote: post #22

Earlier quoted context omitted.

I see your point, but I actually think users should be _more_ alarmed when an input makes software crash, for just this reason. They tend to think of it as a harmless annoyance. Also, while sandboxing may be designed to prevent this, Messages is probably also designed not to crash on link sharing.

There's far more risk in software not crashing when it gets malformed or otherwise unexpected input. If an application crashes, it's memory space has been relinquished and its execution process aborted. Yes, something could've been spawned, but... in general crashing when something unexpected comes up is more sensible, desirable behaviour. (Or am I wrong? I'm not a professional programmer. I'm just reasoning from com…

You're not wrong. AgentME is correct, that crashes can be exploitable, but it is definitely more dangerous for software to continue after its data is corrupted.

The Erlang programming language, in fact, is built around the idea that as soon as you see data you don't expect, you crash, and an external process will start you back up in a known good state.

Re: 'Text bomb' is latest Apple bug

#69

Post by maxmcd »

zackify wrote: post #59
jakobegger wrote: post #33

So a crashing bug in the text rendering framework is now worth an article in major publications? I stumbled over two or three of them in the last couple of years while debugging crash reports sent in by customers. Seems that text rendering is hard. Maybe fuzzing CoreText would be a worthwhile target to discover vulnerabilities?

My iPhone X wont even open imessages after trying to delete two texts with this message, i would say its a pretty big problem

I believe the solution present on this linked page will help you: https://www.vincedes3.com/save.html

Opens imessage again with a message draft so that you can delete the conversation without fetching the linked bug

Re: 'Text bomb' is latest Apple bug

#70

Post by madeofpalk »

gondo wrote: post #53
alwillis wrote: post #47

Fixed in the latest beta: https://www.macrumors.com/2018/01/17/apple-seeds-ios-11-2-5-...

and yet again they don't care about older iOS versions for people who don't want to brick their phones with updates

How do you update software without updating it? I'm literally at a loss with how you would like them to resolve it if you don't want to install updates.
Post reply on HN