Live data from Hacker News

iMessage: Malformed Message Bricks iPhone

bugs.chromium.org

221–230 of 279 posts

Re: iMessage: Malformed Message Bricks iPhone

#221
post #199

Speaking as an ex-Apple employee, I'll just point out that a really malicious actor could have used this to harm some significant percentage of the installed iOS infrastructure, and done critical damage to Apple as a company with it. In fact, I don't know the percentage of users still on <12.3, but maybe they still could. A band-aid fix for this one bug should not be where they stop here.

They're (Apple) rather lucky that their user base vehemently upgrades whenever possible.

I've iPhone user I've ever met outside tech circles avoids installing OS updates. They end up updating soon anyway for a variety of reasons (some updated apps stop working, update occurs "on its own" overnight, to get rid of of the notification icon, and so on).

Re: iMessage: Malformed Message Bricks iPhone

#222

Earlier quoted context omitted.

Not all malware is a "virus." Has iOS ever had anything where one app could "corrupt" other apps?

> Not all malware is a "virus." Haha, this is called moving the goal post. Fanboys do this all the time :) Edit: Plenty of buffer overflow and momory corruptions are listed for iOS just in 2019. https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

> Haha, this is called moving the goal post. Fanboys do this all the time :)

Ignoring the jab, which has no place here, malware is a general term which includes viruses. From the Wikipedia page on computer viruses (https://en.wikipedia.org/wiki/Computer_virus):

> The term "virus" is also misused by extension to refer to other types of malware. "Malware" encompasses computer viruses along with many other forms of malicious software, such as computer "worms", ransomware, spyware, adware, trojan horses, keyloggers, rootkits, bootkits, malicious Browser Helper Object (BHOs), and other malicious software. The majority of active malware threats are actually trojan horse programs or computer worms rather than computer viruses. The term computer virus, coined by Fred Cohen in 1985, is a misnomer.[16] Viruses often perform some type of harmful activity on infected host computers, such as acquisition of hard disk space or central processing unit (CPU) time, accessing private information (e.g., credit card numbers), corrupting data, displaying political or humorous messages on the user's screen, spamming their e-mail contacts, logging their keystrokes, or even rendering the computer useless. However, not all viruses carry a destructive "payload" and attempt to hide themselves—the defining characteristic of viruses is that they are self-replicating computer programs which modify other software without user consent.

> Edit: Plenty of buffer overflow and momory corruptions are listed for iOS just in 2019.

Again, these aren't viruses or even malware.

Re: iMessage: Malformed Message Bricks iPhone

#223

Earlier quoted context omitted.

Strange nostalgic memories of "AOHell" and "LuciferX" come to mind... If I remember, a lot of them were visual basic apps that would use SendKeys() to control AOL via keyboard shortcuts. A little like the wild west back then...

Anyone recall the "SubZer0" proggie? (and who else recalls calling apps "proggies" in our kitchy chat rooms?)

I remember Sub-7 and its modules, including those that forced the user to play (and win) a game of tic-tac-toe, could melt the screen, flip the screen upside down and misc destructive things.

Re: iMessage: Malformed Message Bricks iPhone

#224

Earlier quoted context omitted.

That's not really a coupling issue, but a matter of GPU drivers not generally being hardened against shader/usage bugs. Similar issues have existed on Windows, Linux, etc. browsers with WebGL support.

> That's not really a coupling issue, but a matter of GPU drivers not generally being hardened against shader/usage bugs. You shouldn't be able to crash the whole operating system (not just the display server, display driver, etc.) with an ordinary shader, even if it crashes the shader compiler or causes the GPU not to halt. It's not as though I wrote these shaders in an attempt to crash iOS.

On an iOS device crashing a critical component such as SpringBoard is often indistinguishable to the casual user from a reboot.

Re: iMessage: Malformed Message Bricks iPhone

#225

Earlier quoted context omitted.

Back in the day AOL parsed HTML for it's instant messages, a would blue screen any client running windows. It was quite easy to empty chat room(s) using this.

Some AVs would monitor for certain IRC commands and kill the connection because it looked like your computer was talking to a c&c server. But you could also write the same code into any IRC chat room and anyone running that AV would get booted.

DCC SEND startkeylogger 0 0 0

Re: iMessage: Malformed Message Bricks iPhone

#226

Earlier quoted context omitted.

Easier way to boot a group of people off of Yahoo Games back in the day when you wanted to clear up a room... Just post in the general chat area. “Hey, to speed up Yahoo Games, press alt-f4.”

Iirc the social engineering script was to “hold the alt key and repeatedly tap f4”. That has the two keys far enough from each other in prose to trick more people.

I always heard "hold down alt and press each f key one at a time", people forget about alt f4 if you don't specifically say f4

Re: iMessage: Malformed Message Bricks iPhone

#227

Looks like the "curse of complexity" strikes again... every time I see bugs like this, I wonder if it's because of some code that tries to be a little "too smart" in trying to parse what could be arbitrary data, and forgetting some edge-case. (If you have JS disabled, you can click "View in Old UI" and then view source to see the content. I find that a bit ironic in the context of this specfic bug...)

Is this an issue of complexity or lack of isolation? More isolation means more complexity, but at the same time, this issue should crash the iMessage app itself, not the whole system. The fact that springboard even knows about iMessage structure is crazy...

Springboard itself doesn't, but it loads a framework into itself that does; commenters here have suggested this is because it needs to render notifications: https://news.ycombinator.com/item?id=20380588

Re: iMessage: Malformed Message Bricks iPhone

#228

Speaking as an ex-Apple employee, I'll just point out that a really malicious actor could have used this to harm some significant percentage of the installed iOS infrastructure, and done critical damage to Apple as a company with it. In fact, I don't know the percentage of users still on <12.3, but maybe they still could. A band-aid fix for this one bug should not be where they stop here.

> A band-aid fix for this one bug should not be where they stop here. What do you suggest they do?

they can force-push emergency fixes

Re: iMessage: Malformed Message Bricks iPhone

#229
post #166

Earlier quoted context omitted.

People want to use one app to do all their messaging. iMessage is not that app unless 100% of the people you message use iPhones. For a lot of people Whatsapp or Telegram can be that app.

Well seeing that iMessage integrates with SMS, it’s not just for iMessage users. While there are a lot of reasons not to want to use iMessage but only being able to talk to other iOS users isn’t one.

"XXX liked 'some dumb comment'"

Ugh, so sick of seeing that

Re: iMessage: Malformed Message Bricks iPhone

#230

Wow, you could actually lose the data with this bug. Glad it was fixed in 12.3. I remember the last time something like this happened (4-5 years ago?) it would only crash the phone.

You only lose data if you’re not backing up your phone - it’s not a corruption bug that breaks the ability to restore backups (like one of the iOS iOS 11 developer betas did).

You can still lose data because you can't really back up the whole phone with standard tools.
Post reply on HN