Major new iOS bug can crash iPhones and disable access to apps and iMessages

#1

Post by denzil_correa » Thu, Feb 15, 2018, 2:26 PM UTC

Major new iOS bug can crash iPhones and disable access to apps and iMessages
theverge.com

Re: Major new iOS bug can crash iPhones and disable access to apps and iMessages

#2

Post by taylodl » Thu, Feb 15, 2018, 2:48 PM UTC

What Apple, and Microsoft before them, are discovering is the tools and processes we use to create software simply doesn't scale. We're simply reaching the limits of what these giant software teams are able to produce and keep running. We can discuss solutions, but currently not everybody even agrees we have a problem. That's the first step we need to take.

Re: Major new iOS bug can crash iPhones and disable access to apps and iMessages

#3

Post by hello_asdf » Thu, Feb 15, 2018, 2:50 PM UTC

I've never done any fuzzing personally, but wouldn't this be discoverable internally during testing?

I would think that they would attempt sending all possible characters, especially because they've had issues with this in the past.

Re: Major new iOS bug can crash iPhones and disable access to apps and iMessages

#4

Post by almostdigital » Thu, Feb 15, 2018, 2:57 PM UTC

జ్ఞ‌ా

Re: Major new iOS bug can crash iPhones and disable access to apps and iMessages

#5

Post by benmmurphy » Thu, Feb 15, 2018, 3:14 PM UTC

hello_asdf wrote: post #3

I've never done any fuzzing personally, but wouldn't this be discoverable internally during testing? I would think that they would attempt sending all possible characters, especially because they've had issues with this in the past.

it looks like the single character was made up of 4 utf8 code points. so might have been trickier to detect from fuzzing than it looks.

Re: Major new iOS bug can crash iPhones and disable access to apps and iMessages

#6

Post by mattnewton » Thu, Feb 15, 2018, 3:20 PM UTC

hello_asdf wrote: post #3

I've never done any fuzzing personally, but wouldn't this be discoverable internally during testing? I would think that they would attempt sending all possible characters, especially because they've had issues with this in the past.

I would hope that after all the character-crashing-everything bugs that have hit iOS there is a team dedicated to replacing the text rendering code with something more fault tolerant.

Re: Major new iOS bug can crash iPhones and disable access to apps and iMessages

#7

Post by blub » Thu, Feb 15, 2018, 3:26 PM UTC

taylodl wrote: post #2

What Apple, and Microsoft before them, are discovering is the tools and processes we use to create software simply doesn't scale. We're simply reaching the limits of what these giant software teams are able to produce and keep running. We can discuss solutions, but currently not everybody even agrees we have a problem. That's the first step we need to take.

Bingo. The entire system including the software, hardware, people, customer demands and market pressures, (lack of) regulations has become too complex to handle by humans.

These repeated errors looks like classic system or normal accidents as defined by Perrow in his book.

Re: Major new iOS bug can crash iPhones and disable access to apps and iMessages

#8

Post by 13of40 » Thu, Feb 15, 2018, 3:26 PM UTC

taylodl wrote: post #2

What Apple, and Microsoft before them, are discovering is the tools and processes we use to create software simply doesn't scale. We're simply reaching the limits of what these giant software teams are able to produce and keep running. We can discuss solutions, but currently not everybody even agrees we have a problem. That's the first step we need to take.

I disagree that this is the product of scale. Looking at some of the bugs coming out of Apple lately and how they respond to them (assuming it's really a trend and not just a run of bad luck) it feels like they're slipping into a culture where individual feature teams are making emotional or schedule-based decisions about security without central guidance. A good example is the recent bug on MacOS where a low-privileged user could kill other users' processes and reboot the machine, but allegedly this wasn't considered a security problem. It doesn't seem like they have a core part of their organization that drives security practices and knows how to triage and give guidance on these issues, because if the bug had been escalated to a group like that, it would certainly have gotten some traction. It would be nice to hear an insider's take on it...

Re: Major new iOS bug can crash iPhones and disable access to apps and iMessages

#9

Post by evfanknitram » Thu, Feb 15, 2018, 3:26 PM UTC

taylodl wrote: post #2

What Apple, and Microsoft before them, are discovering is the tools and processes we use to create software simply doesn't scale. We're simply reaching the limits of what these giant software teams are able to produce and keep running. We can discuss solutions, but currently not everybody even agrees we have a problem. That's the first step we need to take.

Waiting for everyone to agree seems like a very futile and inefficient way to achieve progress.

Re: Major new iOS bug can crash iPhones and disable access to apps and iMessages

#10

Post by valarauca1 » Thu, Feb 15, 2018, 3:26 PM UTC

hello_asdf wrote: post #3

I've never done any fuzzing personally, but wouldn't this be discoverable internally during testing? I would think that they would attempt sending all possible characters, especially because they've had issues with this in the past.

the issue is in the compositor, what determines where the windows are that contains all your GUI widgets. You can reproduce the bug on some of the newer versions of OSX.

Likely the next two programs are disagreeing on character, and therefore widget size.