Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iMessage: Malformed Message Bricks iPhone

bugs.chromium.org

Post reply on HN
Print view View original

211–220 of 279 posts

Re: iMessage: Malformed Message Bricks iPhone

#211

Post by Scoundreller »

pcdoodle wrote: post #116
rixrax wrote: post #34

This brings back old memories from hardening the sms/text parsers of feature phones of yesteryear. There it wasn’t entirely uncommon that when you sent a malformed sms-deliver PDU (e.g. text message) to the phone and crashed parser that tried to decode it, it took also the phone down before it could ack the message back to SMSC. Which of course meant that as soon as phone was turned on and it registered to network, t…

Back in the day AOL parsed HTML for it's instant messages, a would blue screen any client running windows. It was quite easy to empty chat room(s) using this.

Some AVs would monitor for certain IRC commands and kill the connection because it looked like your computer was talking to a c&c server.

But you could also write the same code into any IRC chat room and anyone running that AV would get booted.

Re: iMessage: Malformed Message Bricks iPhone

#212

Post by icebraining »

EugeneOZ wrote: post #47

Lazy developers throw exceptions, good developers return errors. Exceptions should be exceptional. I'll use URL to this bug in my next comment-holywars to prove this point. Yes, it takes much less code to throw an exception in hope some code will catch it, but while compiler (not runtime) doesn't check it - this technique is not safe. So we should return errors, check them and handle - sometimes it means returning er…

Seems like a pretty bad example - it only caused a boot loop. That's inconvenient, but fairly minor compared to the myriad of problems that could have arisen from buggy recovery code.

Re: iMessage: Malformed Message Bricks iPhone

#213

Post by tambre »

askl wrote: post #100
rixrax wrote: post #34

This brings back old memories from hardening the sms/text parsers of feature phones of yesteryear. There it wasn’t entirely uncommon that when you sent a malformed sms-deliver PDU (e.g. text message) to the phone and crashed parser that tried to decode it, it took also the phone down before it could ack the message back to SMSC. Which of course meant that as soon as phone was turned on and it registered to network, t…

There was a nice talk about this a few years ago at the CCC congress. https://media.ccc.de/v/27c3-4060-en-attacking_mobile_phones http://www.ngolde.de/sms/smsodeath_mulliner_golde_cansecwest...

> [...] at the CCC congress

Your "congress" is redundant because CCC=Chaos Communication Congress.

Re: iMessage: Malformed Message Bricks iPhone

#214

Post by icebraining »

userbinator wrote: post #118
viraptor wrote: post #15

Earlier quoted context omitted.

Is this an issue of complexity or lack of isolation? More isolation means more complexity, but at the same time, this issue should crash the iMessage app itself, not the whole system. The fact that springboard even knows about iMessage structure is crazy...

Complexity. You don't really need isolation if the code is so simple as to obviously contain no bugs (instead of containing no obvious bugs.) Instead, we have a whole industry built upon encouraging the creation of things as complex as possible, and working around the problems caused by that by adding even more complexity, mainly because it means people have more to do. http://countercomplex.blogspot.com/2014/08/the-…

> No, downvotes from the complexity-brigade are not going to make me change my mind either.

What would?

Re: iMessage: Malformed Message Bricks iPhone

#216

Post by gruez »

arwineap wrote: post #207
applecrazy wrote: post #206

Earlier quoted context omitted.

What they should also do is block the malformed message from being sent too. Not sure how to do that, since iMessages are encrypted in transit, but I'm sure there's some way.

Apple controls the CA; it's pretty straight forward for them to check contents. iMessage really could have been something great (despite apple controlling CA) if they had just opened it up for more devices. Instead WhatsApp wiped the floor with them.

>Apple controls the CA; it's pretty straight forward for them to check contents.

and in the process eavesdrop on everybody's messages? no thanks.

Re: iMessage: Malformed Message Bricks iPhone

#217

Post by saagarjha »

romaaeterna wrote: post #135

Speaking as an ex-Apple employee, I'll just point out that a really malicious actor could have used this to harm some significant percentage of the installed iOS infrastructure, and done critical damage to Apple as a company with it. In fact, I don't know the percentage of users still on <12.3, but maybe they still could. A band-aid fix for this one bug should not be where they stop here.

> A band-aid fix for this one bug should not be where they stop here.

What do you suggest they do?

Re: iMessage: Malformed Message Bricks iPhone

#218

Post by nathancahill »

tambre wrote: post #213
askl wrote: post #100

Earlier quoted context omitted.

There was a nice talk about this a few years ago at the CCC congress. https://media.ccc.de/v/27c3-4060-en-attacking_mobile_phones http://www.ngolde.de/sms/smsodeath_mulliner_golde_cansecwest...

> [...] at the CCC congress Your "congress" is redundant because CCC=Chaos Communication Congress.

ATM machine

Re: iMessage: Malformed Message Bricks iPhone

#219

Post by saagarjha »

IloveHN84 wrote: post #172
HeWhoLurksLate wrote: post #156

bplist00ÔX$versionX$objectsY$archiverT$top † ¦U$nullÓ WNS.keysZNS.objectsV$class¢ €€¢€€€RanVldtext¢ËqÒZ$classnameX$classes\NSDictionary¢XNSObject_NSKeyedArchiverÑTroot€#-27>DKS^ehjloqsux„‰”ª­¶ÈËÐ  Ò

?

It's the serialized object used in the PoC, in binary property list format. Here's what it looks like pretty-printed:

  {
    "$archiver" => "NSKeyedArchiver"
    "$objects" => [
      0 => "$null"
      1 => {
        "$class" => {value = 5}
        "NS.keys" => [
          0 => {value = 2}
          1 => {value = 3}
        ]
        "NS.objects" => [
          0 => {value = 4}
          1 => {value = 4}
        ]
      }
      2 => "an"
      3 => "ldtext"
      4 => 77777777
      5 => {
        "$classes" => [
          0 => "NSDictionary"
          1 => "NSObject"
        ]
        "$classname" => "NSDictionary"
      }
    ]
    "$top" => {
      "root" => {value = 1}
    }
    "$version" => 100000
  }

Re: iMessage: Malformed Message Bricks iPhone

#220

Post by rayiner »

kortilla wrote: post #204
egorfine wrote: post #203

Earlier quoted context omitted.

What else could they do?

Filter. Spam detection wasn’t exactly a novel idea back then either.

With what? Especially back then, I wouldn’t assume there is anything with a programmable CPU in the data path that can inspect and filter things at line rate.
Post reply on HN