Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
New iOS Bug Crashing iPhones Simply by Receiving a Text Message [Includes Fix]
- Thread starter MacRumors
- Start date
- Sort by reaction score
Surely if it was just unicode then any message with unicode would crash it not only this specific combination?
although a hacker could spend his time looking for character strings like this, the usual case would not occur like that.
the case above, and in a similar OS X / iOS August 2013 reported bug (also affecting Arabic) is much more likely to be found by users themselves.
its actually quite complex. i'm surprised it doesn't happen more often.
there are 2 basic things that make this unicode rendering problematical:
1 in most cases there are just non-sensical character strings that might be input at random. (this case this time is such a case: the dotted circles indicate that a character would be there and the lower part is either a vowel or other modifier of that character but that character is simply not there. its missing.)
2 there are extensions to unicode sets appearing regularly to most writing systems, complicating app/keyboard/display coordination.
apple has opened up its Keyboard input system to 3rd party developers.
there was a rush during the past 12 months for 3rd party input keyboard developers to market their apps in the iTunes store. most of them are NOT 100% unicode compliant however. and, problematically, the keyboard / the specific unicode character set / and combination of these that the iOS system version is expecting causes these types of app crashes most frequently.
Intellij is also crashing on OS X
So while testing this by sending iMessages to my phone, I ended miscopying some code I wanted to move in Intellij, and still had the code that crashes the Springboard on the iPhone: Intellij immediately crashed. I've since tried copy+pasting the text to other applications, including Eclipse (another IDE running on java) and nothing else seems to crash.
So while testing this by sending iMessages to my phone, I ended miscopying some code I wanted to move in Intellij, and still had the code that crashes the Springboard on the iPhone: Intellij immediately crashed. I've since tried copy+pasting the text to other applications, including Eclipse (another IDE running on java) and nothing else seems to crash.
What was supposed to be a funny prank from me to my younger sister, resulted in a big family argument and my dad calling me an a--hole.
That will teach you. Send the same message to someone outside your family, and they might press criminal charges. And rightfully so.
Where can i copy this string so i can "Test" it out
Keep the above in mind. Sending a message with that text meets any definition of criminal hacking.
OS X also affected with shorter variant
Just tested that this shorter variant also crashes some OS X applications:
It seems that applications using Core Text API are affected.
This includes OS X Terminal application. The shell filters characters from command line so to test you need to open nano or similar or output a file containing the characters.
I was also able to generate a text file that when displayed crashes the console and apps affected. This can have "interesting" implications for sysadmins and (unfortunately) malware developers. At least this can easily be used to block users access to terminal console without any admin privileges.
Just copy-paste to your favorite app to test.
Some of the Apple's own OS X apps are affected and many more 3rd party apps.
Just tested that this shorter variant also crashes some OS X applications:
Code:
رً ॣ ॣ ॣIt seems that applications using Core Text API are affected.
This includes OS X Terminal application. The shell filters characters from command line so to test you need to open nano or similar or output a file containing the characters.
I was also able to generate a text file that when displayed crashes the console and apps affected. This can have "interesting" implications for sysadmins and (unfortunately) malware developers. At least this can easily be used to block users access to terminal console without any admin privileges.
Just copy-paste to your favorite app to test.
Some of the Apple's own OS X apps are affected and many more 3rd party apps.
I sended this to some of my friends.
Some of them still can't open the Messages App after sending their self a picture or something. Some can open the Messages App but as soon as they're trying to delete the chat or scroll down in the app, it crashes?
Any solution?
Some of them still can't open the Messages App after sending their self a picture or something. Some can open the Messages App but as soon as they're trying to delete the chat or scroll down in the app, it crashes?
Any solution?
Sometimes I have a different (but similar) problem.
If I receive a text from someone I haven't texted for a long time (I think this started when iOS 7 or 8 came out), the messages app will crash whenever I attempt to view that conversation.
To fix it, I have to send myself a text (or wait for another text) so that I can open the messages app in a different view, then I can delete the misbehaving conversation. I can then start a new conversation and text that person without any problems.
Does anyone else have the same issue?
If I receive a text from someone I haven't texted for a long time (I think this started when iOS 7 or 8 came out), the messages app will crash whenever I attempt to view that conversation.
To fix it, I have to send myself a text (or wait for another text) so that I can open the messages app in a different view, then I can delete the misbehaving conversation. I can then start a new conversation and text that person without any problems.
Does anyone else have the same issue?
I'm not so sure about that.
A lot of people here seem to assume this is a text rendering bug someone discovered by trying random characters. I don't think it's the case.
The weird arabic characters we're seeing are just the UTF-8 representation of some binary code. Said binary code was likely chosen specifically to exploit a found vulnerability, regardless of how it would look once interpreted as a UTF-8 string.
I'm pretty sure it's just a crash and nobody could send actual commands through messages, but I think there's something going wrong at the binary level (e.g. an overflow) rather than an the rendering level.
Last edited:
I did I a bunch of times last night but can't seem to get it to happen this morning. Is anyone still getting it to work?
What was supposed to be a funny prank from me to my younger sister, resulted in a big family argument and my dad calling me an a--hole.
If you sent that message to someone and crashed their phone then you are a complete and utter moron.
This one is proving much more interesting so far:
رً ॣ ॣ ॣ
Does the same SMS and imessage crashing but has so far also crashed WiFi settings if it is the hotspot name on another device, crashed safari and chrome as well. More testing to come
رً ॣ ॣ ॣ
Does the same SMS and imessage crashing but has so far also crashed WiFi settings if it is the hotspot name on another device, crashed safari and chrome as well. More testing to come
