'Text bomb' is latest Apple bug • Hacker News Board

Re: 'Text bomb' is latest Apple bug

#41

Post by Kikawala » Thu, Jan 18, 2018, 5:10 PM UTC

Orangeair wrote: post #27

Come to think of it, I believe I've heard of multiple "making the device render this text causes a crash" bugs for Apple devices, but never on any other platforms. Is this type of bug just that much more common on Apple devices, or are there plenty of other cases out there that I just don't know about?

Not just simple text, it's UTF-8. Rendering these UTF-8 "text bombs" seems to DoS several applications. This particular one crashes the messages app in iOS, crashes the tab in Chrome, and locks up FireFox. It also crashes several text editors which support UTF-8. Opens quickly in notepad, but takes several minutes in wordpad and it very laggy when scrolling.

Re: 'Text bomb' is latest Apple bug

#42

Post by [deleted] » Thu, Jan 18, 2018, 5:15 PM UTC

Kikawala wrote: post #41

Orangeair wrote: post #27

Come to think of it, I believe I've heard of multiple "making the device render this text causes a crash" bugs for Apple devices, but never on any other platforms. Is this type of bug just that much more common on Apple devices, or are there plenty of other cases out there that I just don't know about?

Not just simple text, it's UTF-8. Rendering these UTF-8 "text bombs" seems to DoS several applications. This particular one crashes the messages app in iOS, crashes the tab in Chrome, and locks up FireFox. It also crashes several text editors which support UTF-8. Opens quickly in notepad, but takes several minutes in wordpad and it very laggy when scrolling.

[deleted]

Re: 'Text bomb' is latest Apple bug

#43

Post by osteele » Thu, Jan 18, 2018, 5:20 PM UTC

hotpxl wrote: post #21

- Mr Masri said he "always reports bugs" before releasing them. Well I don't think Apple really reads bug reports.

https://support.apple.com/en-us/HT201220 has a section for “Security and privacy researchers”. The process is to send mail to product-security@apple.com, optionally encrypted by Apple Product Security's PGP key. A developer account is not required.

Since this page is the top search engine hit for several obvious searches (for example “report apple security vulnerability”), hopefully Mr Masri reported it there.

Re: 'Text bomb' is latest Apple bug

#44

Post by dspillett » Thu, Jan 18, 2018, 5:22 PM UTC

Orangeair wrote: post #27

Come to think of it, I believe I've heard of multiple "making the device render this text causes a crash" bugs for Apple devices, but never on any other platforms. Is this type of bug just that much more common on Apple devices, or are there plenty of other cases out there that I just don't know about?

> but never on any other platforms

There have been numerous crash-bugs for the Windows font renderer, and even security exploits using it (especially before windows 10, as earlier than that font rendering was performed in the kernel's space rather than user-land). I wouldn't be surprised to learn of issues (at least of the falling over variety) in common Linux rendering engines and for other OSs too.

Re: 'Text bomb' is latest Apple bug

#45

Post by [deleted] » Thu, Jan 18, 2018, 5:26 PM UTC

hamandcheese wrote: post #28

devit wrote: post #5

Based on a web search, https://bogdanz.me/work/diddu.html might be a working mirror of the proof of concept. It appears to contain a 10MB long UTF-8 mess in both the og:title meta content and in a mailto: link. I'd guess it's supposed to crash iOS apps by either posting that link if it displays links in a thumbnail element using og:title or otherwise by pasting the huge mailto link contained in the webpage, or perhap…

Can confirm, just crashed my friends iPhone X. Required a hard reboot, was locked up completely.

[deleted]

Re: 'Text bomb' is latest Apple bug

#46

Post by 68c12c16 » Thu, Jan 18, 2018, 5:30 PM UTC

68c12c16 wrote: post #39

NedIsakoff wrote: post #3

Anyone have the clode?

a mirror of the page could be found here... view-source:https://web.archive.org/web/20180117063656/https://iabem97.github.io/chaiOS/ google chrome browser seems to have disabled the display of the content but other browsers may still be fine with it...

if viewed in a hex editor, this same block of patterns repeated over and over again...seemingly to be an effort to overrun the buffer....

  0x00007B90: A5CCBACD 8774CCB4 CD81CC8D CC92CD8C     .....t..........
  0x00007BA0: CD84CC86 CC8FCD8B CD97CD86 CC9BCC8F     ................
  0x00007BB0: CC8ECC95 CC87CC82 CC94CC9B CC92CC92     ................
  0x00007BC0: CC86CD91 CD9BCC86 CC8ECCBD CC84CC8B     ................
  0x00007BD0: CC91CC88 CD9DCC81 CD81CC81 CC84CCBE     ................
  0x00007BE0: CC85CCBE CC86CC84 CD82CC86 CD9DCC89     ................
  0x00007BF0: CC85CC87 CD8CCD9D CC81CC88 CCBFCC9A     ................
  0x00007C00: CC82CC86 CD8CCC90 CD9DCC82 CC9ACC80     ................
  0x00007C10: CC93CC9B CD84CC89 CD82CD8A CCBECD8B     ................
  0x00007C20: CDA0CC83 CC8ACC8E CD98CC89 CD97CC80     ................
  0x00007C30: CD80CC8A CC8FCDA0 CC80CC80 CD84CD80     ................
  0x00007C40: CD8CCD92 CD92CD91 CC90CD98 CC83CC88     ................
  0x00007C50: CD84CD9B CCBDCD9B CC84CC8D CDA0CC8C     ................
  0x00007C60: CC81CD97 CD8BCD86 CD9BCD91 CC8ECCAA     ................
  0x00007C70: CCA7CD87 CD95CCB1 CCA8CCBC CD9CCCA6     ................
  0x00007C80: CCA6CC9D CCAFCCAA CC97CCA0 CC9ECD85     ................
  0x00007C90: CCAACCA4 CCB2CCAB CD8ECCAB CD89CD8D     ................
  0x00007CA0: CCA2CCA8 CCAACC97 CCACCCA3 CCBACD93     ................
  0x00007CB0: CC9ECCA9 CD87CCA8 CD96CCAF CCBACCA7     ................
  0x00007CC0: CCB1CCBB CCA3CCAE CCABCCA7 CD96CCBA     ................
  0x00007CD0: CCAFCCA9 CCA0CCB2 CC96CD95 CCAACCAD     ................
  0x00007CE0: CD9ACCA8 CCB9CCB9 CCB0CCA0 CD88CCBA     ................
  0x00007CF0: CCA9CD9C CCA3CCA1 CCA0CD8D CC98CCA1     ................
  0x00007D00: CCAFCCA1 CC9DCD87 CCA6CC9D CCBACCBA     ................
  0x00007D10: CCAACD9A CCBACD8D CD88CD93 CCB1CCBC     ................
  0x00007D20: CCA1CCB1 CCB3CCA4 CD9ACCB0 CCA9CCB2     ................
  0x00007D30: CC9DCCAC CCADCCB9 CC9ECD89 CD89CD9C     ................
  0x00007D40: CCA5CCA8 CC9DCD89 CCBACCA2 CC9CCC9F     ................
  0x00007D50: CCA5CCBA CD8774CC B4CD81CC 8DCC92CD     ......t.........

The author comment at the top of the page says,

If the entire code in the page was whipped up in 10 minutes, then a large part might well be some repetitive copy-paste of a core part...Not exactly sure what this core part does...but given the obvious lack of printable ascii characters (code is way above '0x7F' ), it looks that it could be some unicode type of thing, which then is a bit reminiscing of an old iOS bug back in 2015, as described at this link,

https://www.reddit.com/r/iphone/comments/37eaxs/um_can_someo...

also notice the high frequency of 0xCC and 0xCD throughout the code, which are respectively Breakpoint and INT on x86 architecture -- with its 0xCD's always followed by a single byte whose value is less than 0xA0 -- possibly x86 was used as author's development platform...

Re: 'Text bomb' is latest Apple bug

#47

Post by alwillis » Thu, Jan 18, 2018, 5:31 PM UTC

Fixed in the latest beta: https://www.macrumors.com/2018/01/17/apple-seeds-ios-11-2-5-...

Re: 'Text bomb' is latest Apple bug

#48

Post by aluhut » Thu, Jan 18, 2018, 5:32 PM UTC

Someone1234 wrote: post #34

devit wrote: post #5

Based on a web search, https://bogdanz.me/work/diddu.html might be a working mirror of the proof of concept. It appears to contain a 10MB long UTF-8 mess in both the og:title meta content and in a mailto: link. I'd guess it's supposed to crash iOS apps by either posting that link if it displays links in a thumbnail element using og:title or otherwise by pasting the huge mailto link contained in the webpage, or perhap…

That site caused Firefox 57 (64bit) to lock up on Windows 10... It is an i7, 16 GB total (7 GB free), and an SSD.

It didn't completely lock up on W7 FF 57.

The lock ups came in waves but was able to close the tab when it was unlocked.

Re: 'Text bomb' is latest Apple bug

#49

Post by sebazzz » Thu, Jan 18, 2018, 5:34 PM UTC

Orangeair wrote: post #27

Come to think of it, I believe I've heard of multiple "making the device render this text causes a crash" bugs for Apple devices, but never on any other platforms. Is this type of bug just that much more common on Apple devices, or are there plenty of other cases out there that I just don't know about?

I suppose because SMS/messages is tightly integrated with the operating system. It goes from the baseband, through the kernel.

Re: 'Text bomb' is latest Apple bug

#50

Post by roywiggins » Thu, Jan 18, 2018, 5:51 PM UTC

Orangeair wrote: post #27

Come to think of it, I believe I've heard of multiple "making the device render this text causes a crash" bugs for Apple devices, but never on any other platforms. Is this type of bug just that much more common on Apple devices, or are there plenty of other cases out there that I just don't know about?

Nokia's had one.

https://www.slashgear.com/nokia-curse-of-silence-sms-bug-pre...