Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Text bomb' is latest Apple bug

bbc.com

Post reply on HN
Print view View original

1–10 of 113 posts

Re: 'Text bomb' is latest Apple bug

#5

Post by devit »

Based on a web search, https://bogdanz.me/work/diddu.html might be a working mirror of the proof of concept.

It appears to contain a 10MB long UTF-8 mess in both the og:title meta content and in a mailto: link.

I'd guess it's supposed to crash iOS apps by either posting that link if it displays links in a thumbnail element using og:title or otherwise by pasting the huge mailto link contained in the webpage, or perhaps only the e-mail address.

Re: 'Text bomb' is latest Apple bug

#8

Post by netsharc »

devit wrote: post #5

Based on a web search, https://bogdanz.me/work/diddu.html might be a working mirror of the proof of concept. It appears to contain a 10MB long UTF-8 mess in both the og:title meta content and in a mailto: link. I'd guess it's supposed to crash iOS apps by either posting that link if it displays links in a thumbnail element using og:title or otherwise by pasting the huge mailto link contained in the webpage, or perhap…

Hah. View-Source takes forever to load (in Vivaldi). Wget says it's a 20 MB file. Opening it in Joe in Cygwin kills the Cygwin process. Neat.

Also the href attribute inside the points to a HTML URL, but that returns a 404...

Re: 'Text bomb' is latest Apple bug

#9

Post by menacingly »

The linked blog assures people that this can't be used to access data. Once something is crashing an app/OS, can you really say that? I mean, can you be sure there's no one clever enough to capitalize on the underlying software error leading to this state?
Post reply on HN