Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

497902

Suspended
Sep 25, 2010
905
229
Depends what kind of security you're talking about. Security against receiving unwanted messages, maybe. I've never used Signal, so idk. Btw, iMessage is supposedly end-to-end encrypted with a key Apple never holds, but there's no reason to believe the claim.

The security of no one else being capable of reading your messages. Unlike iMessage, everyone can check Signal's source code for proof.
 

CarlJ

macrumors 604
Feb 23, 2004
6,971
12,135
San Diego, CA, USA
this particular Unicode string cannot be rendered properly and leads to system crashing.
"cannot be rendered properly", okay, fine, misteaks hapen soemtimes. But "leads to system crashing"? Really? For like the fourth time? No! Go through this code and make it stop making assumptions, and sanity check the inputs. At best it should be displaying an empty black frame to indicate "there's one or more characters here that I can't decode or figure out how to display". But it feels like they're putting additional band-aids on a library to fix specific bugs found, rather than saying, "displaying Unicode is crashing the OS a second time? We need a team to audit the entire library." This is like what Microsoft was doing with Win98 and security, "oh, someone found a way in? let's patch that one way in" (rinse/repeat one thousand times).
 

fairuz

macrumors 68020
Aug 27, 2017
2,486
2,589
Silicon Valley
"cannot be rendered properly", okay, fine, misteaks hapen soemtimes. But "leads to system crashing"? Really? For like the fourth time? No! Go through this code and make it stop making assumptions, and sanity check the inputs. At best it should be displaying an empty black frame to indicate "there's one or more characters here that I can't decode or figure out how to display". But it feels like they're putting additional band-aids on a library to fix specific bugs found, rather than saying, "displaying Unicode is crashing the OS a second time? We need a team to audit the entire library." This is like what Microsoft was doing with Win98 and security, "oh, someone found a way in? let's patch that one way in" (rinse/repeat one thousand times).
It's probably the layout of one or more characters cascading to improper layouts of other things, causing a crash. I don't know why they can't catch this, but I would assume the iOS and Android devs aren't incompetent. Text layout with full accessibility and other support is complicated.
[doublepost=1525883735][/doublepost]
Better solution = use signal and delete any non-private messaging app
That doesn't fix this problem. It also would not allow me to message anyone I know in real life, lol.
[doublepost=1525883775][/doublepost]
The security of no one else being capable of reading your messages. Unlike iMessage, everyone can check Signal's source code for proof.
Well that doesn't matter here. It's about getting malicious messages. If anything, privacy guarantees make that harder to enforce.
 
Last edited:

alllexx

macrumors member
Mar 21, 2016
59
99
So, if this is the same issue as the Android one, then it's not like the Telugu bug, which was a legitimate character string that was failing, but something designed deliberately to crash a renderer by embedding thousands of control characters within a message. But, if that's the case and that you can't crash messages by simply sending a black spot and a pointing emoji to someone, then how does it propagate?
To my understanding, you are correct about this being caused by thousands of control characters with a width of zero
 

mi7chy

macrumors G4
Oct 24, 2014
10,495
11,155
Hangouts, at least on Android, has never been affected by these frequent iMessage vulnerabilities. You'd think people would stop using iMessage and switch to something else after the first infection or first few infections like with STDs.
 
Last edited:

PBG4 Dude

macrumors 601
Jul 6, 2007
4,268
4,479
It's like no one at Apple or Google has ever met Little Bobby Tables.

exploits_of_a_mom.png
 

TimUSCA

macrumors 6502a
Mar 17, 2006
701
1,539
Aiken, SC
I’m pretty sure it doesn’t compete with Signal from a security standpoint.
How so? iMessage is totally encrypted and tokenized. Add the fact that it's already integrated into every iOS device and auto-sends as SMS when the receiver needs it, I don't see how anything else could possibly be better. Any service that requires me to ask someone to download the app so I can message them isn't worth using IMO.
 
  • Like
Reactions: SRLMJ23

497902

Suspended
Sep 25, 2010
905
229
How so? iMessage is totally encrypted and tokenized. Add the fact that it's already integrated into every iOS device and auto-sends as SMS when the receiver needs it, I don't see how anything else could possibly be better. Any service that requires me to ask someone to download the app so I can message them isn't worth using IMO.

Yeah, that’s what they tell you. (Facebook tells us the same thing about WhatsApp btw, now would you trust them?) It’s closed sourced so no one knows what’s in the code. Signal on the other hand though is open source and anyone can check exactly how it works.
 

SRLMJ23

macrumors 68020
Jul 11, 2008
2,307
1,413
Central New York
...and another issue with iOS 11!

This is getting a little ridiculous. We will have another patch coming up in the next couple days probably and then next week most likely iOS 11.4. Obviously they might just combine the patch into iOS 11.4, but still...this is getting crazy.

:apple:
 

SRLMJ23

macrumors 68020
Jul 11, 2008
2,307
1,413
Central New York
How so? iMessage is totally encrypted and tokenized. Add the fact that it's already integrated into every iOS device and auto-sends as SMS when the receiver needs it, I don't see how anything else could possibly be better. Any service that requires me to ask someone to download the app so I can message them isn't worth using IMO.

I agree 100%. It would bother me if someone asked me to download an app just to message them, and vice versa! Like you said, iMessage is very secure. End-to-end encryption and tokenized.

I trust Apple when it comes to the security of iMessage.

:apple:
 
  • Like
Reactions: ignatius345

ignatius345

macrumors 604
Aug 20, 2015
6,862
11,205
Maybe an easier solution: Delete the actual message from Messages on your Mac.
Until we get iMessage in the cloud, deleting a conversation on one device leaves it intact on the others.
[doublepost=1525888172][/doublepost]
Better solution = use signal and delete any non-private messaging app
You do realize that iMessage has end-to-end encryption, right?
 

C DM

macrumors Sandy Bridge
Oct 17, 2011
51,390
19,458
Hangouts, at least on Android, has never been affected by these frequent iMessage vulnerabilities. You'd think people would stop using iMessage and switch to something else after the first infection or first few infections like with STDs.
Alternative facts and sensationalism, as they say.

https://www.androidpolice.com/2013/...oid-app-google-is-aware-and-working-on-a-fix/

(That's even putting aside other messengers and OS's often being affected by those or similar things as well.)
[doublepost=1525888411][/doublepost]
...and another issue with iOS 11!

This is getting a little ridiculous. We will have another patch coming up in the next couple days probably and then next week most likely iOS 11.4. Obviously they might just combine the patch into iOS 11.4, but still...this is getting crazy.

:apple:
It's crazy how iOS 11 even affects Android.
 
Last edited:

TimUSCA

macrumors 6502a
Mar 17, 2006
701
1,539
Aiken, SC
Yeah, that’s what they tell you. (Facebook tells us the same thing about WhatsApp btw, now would you trust them?) It’s closed sourced so no one knows what’s in the code. Signal on the other hand though is open source and anyone can check exactly how it works.
Oh, give me a break... if we're just going to say "well I don't believe them" then this entire conversation is pointless. Until Apple shows me otherwise, I believe them when they say it's tokenized. They have never given me any reason to assume otherwise, especially when they don't make their money on data mining. Facebook, on the other hand, has given us a LOT of reasons to distrust them and makes all of their money on data mining.
 
  • Like
Reactions: chucker23n1

rjohnstone

macrumors 68040
Dec 28, 2007
3,896
4,493
PHX, AZ.
According to the artice it affects Android as well.

Maybe we shall throw all smartphones out the window? ;)
It doesn't affect stock messaging apps or Google messaging apps on Android (I just tried it on my Note 8), only WhatsApp appears to be impacted on Android at this point.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.