New iOS Bug Crashing iPhones Simply by Receiving a Text Message [Includes Fix]

[Traverse]

That would be 'fun' to someone under the age of 17. For everybody else, it's a dick move.

I know I'd be extremely annoyed.

----------

i have not tried this yet. however i can see the fun in this if u were to mass send this to everyone in your contact with iPhones.

How would that be fun? They'd hate you. It's not just one crash, it's repeated crashing until they work some extended workaround that most users probably would need help with.

You probably wouldn't have any "contacts" after that

 

[C DM]

I'm amazed Apple hasn't pushed an emergency patch for this. What the hell are they doing?

Yeah, because they have a fix in less than a day and one that they actually tested, let alone tested well, right? Things like that are all just magic anyway: you just think of it and it all happens and it all just works.

 

[Adam-Jobs]

Found a fix. Not sure if mentioned. Do as suggested. Create a note. Sending to yourself did not work for me. It continued to crash. Send the note to the person who sent the message.

 

[class77]

What was supposed to be a funny prank from me to my younger sister, resulted in a big family argument and my dad calling me an a--hole.

I'm with your dad. Nothing funny about sending this to someone

 

[C DM]

Found a fix. Not sure if mentioned. Do as suggested. Create a note. Sending to yourself did not work for me. It continued to crash. Send the note to the person who sent the message.

Yeah, it seems to be more about sending it to whomever sent you the badly formatted message so that that message doesn't try to be rendered by notifications or within the preview in the Message app.

 

[Steve121178]

Yeah, because they have a fix in less than a day and one that they actually tested, let alone tested well, right? Things like that are all just magic anyway: you just think of it and it all happens and it all just works.

Microsoft, Symantec/Norton, McAfee etc respond in hours to critical issues. With a user base in the 100s of millions Apple ought to respond within hours by releasing an update.

You seem happy to accept a lax attitude to security. Do you work for Apple?

 

[sualpine]

Microsoft, Symantec/Norton, McAfee etc respond in hours to critical issues. With a user base in the 100s of millions Apple ought to respond within hours by releasing an update.

You seem happy to accept a lax attitude to security. Do you work for Apple?

This is not a 0day. There is no security issue.

 

[C DM]

Microsoft, Symantec/Norton, McAfee etc respond in hours to critical issues. With a user base in the 100s of millions Apple ought to respond within hours by releasing an update.

You seem happy to accept a lax attitude to security. Do you work for Apple?

Really? Microsoft releases patches on a schedule once a month, and rarely does something outside of that (and practically never within hours or even a day). Even with some actual security exploits they often stick to the monthly release cycle, and this bug doesn't even come close to something like that.

Symantec/Norton or McAfee might release something quicker, but then they don't have a whole OS to support and just their own software. And given how many issues their software has had in the past, and still often does, I'm not sure they are anything to compare to.

You seem to have a distorted view of things and basically reality, which kind of makes the whole line of outrage and questioning pretty much moot given that reality is conveniently being ignored or even rewritten as desired.

 

[Steve121178]

This is not a 0day. There is no security issue.

People are spreading the message around and its knocking out iMessage and rebooting phones.

It's a massive security issue as people can force a reboot of another persons phone with ease.

 

[jedifaka]

Are you sure?

It's a classic behavior for malware to stimulate a crash and then to exploit that crash for some other purpose. How certain can you be there's no security issue?

This is not a 0day. There is no security issue.

 

[C DM]

It's a classic behavior for malware to stimulate a crash and then to exploit that crash for some other purpose. How certain can you be there's no security issue?

There might be one, but until there's evidence of one there's no indication to say that that aspect of it is something to worry about. To be aware of the possibility, and to keep up with developments, yes, but nothing really beyond that until there's something to indicate otherwise.

 

[Steve121178]

Really? Microsoft releases patches on a schedule once a month, and rarely does something outside of that (and practically never within hours or even a day). Even with some actual security exploits they often stick to the monthly release cycle, and this bug doesn't even come close to something like that.

Symantec/Norton or McAfee might release something quicker, but then they don't have a whole OS to support and just their own software. And given how many issues their software has had in the past, and still often does, I'm not sure they are anything to compare to.

You seem to have a distorted view of things and basically reality, which kind of makes the whole line of outrage and questioning somewhat moot given that reality is conveniently being simply ignored.

I'm right in believing this should be addressed as a matter or urgency and you are simply wrong.

The companies I mentioned as an example have had to release emergency updates numerous times. AV companies have often pushed out a faulty .DAT files or definitions which has killed PC's renderings en unusable. I've had the misfortune to be working at companies that were hit and worked directory with the vendors to assist in them issuing a patch/update. It happens. Sadly, Apple never seem to be in much of a hurry.

 

[C DM]

I'm right in believing this should be addressed as a matter or urgency and you are simply wrong.

The companies I mentioned as an example have had to release emergency updates numerous times. AV companies have often pushed out a faulty .DAT files or definitions which has killed PC's renderings en unusable. I've had the misfortune to be working at companies that were hit and worked directory with the vendors to assist in them issuing a patch/update. It happens. Sadly, Apple never seem to be in much of a hurry.

Everyone is right about believing that this should be addressed as a matter of urgency. Where it falls flat is to be outraged that it hasn't been addressed yet, less than a day after it was discovered.

If you are trying to compare releasing an updated .DAT file to anything even close to what an OS fix of this nature would entail, then that certainly would cover the the discrepancy of expectations. And as already been shown with the Microsoft example you yourself used, when it comes to large OSs and companies responsible for them, everyone takes their time to make sure they deal with the issue properly.

 

[Steve121178]

Everyone is right about believing that this should be addressed as a matter of urgency. Where it falls flat is to be outraged that it hasn't been addressed yet, less than a day after it was discovered.

Should have been patched within 8-12 hours. Anything more is unacceptable.

 

[bawbac]

Yeah, because they have a fix in less than a day and one that they actually tested, let alone tested well, right? Things like that are all just magic anyway: you just think of it and it all happens and it all just works.

If this was an Android phone/issues, I'm sure it would be considered disastrous by iPhone users. They would probably laugh too because an update won't be coming anytime soon.

This is a trivial patch.
No reason not to expedited a patch release.

 

[C DM]

Should have been patched within 8-12 hours. Anything more is unacceptable.

You are certainly welcome to your opinion. Reality can certainly show it to be otherwise.

----------

If this was an Android phone/issues, I'm sure it would be considered disastrous by iPhone users. They would probably laugh too because an update won't be coming anytime soon.

Perhaps some might, which would be unrelated to and wouldn't change the reality of it all.

If this was an Android phone/issues, I'm sure it would be considered disastrous by iPhone users. They would probably laugh too because an update won't be coming anytime soon.

This is a trivial patch.
No reason not to expedited a patch release.

The issue itself might be trivial in nature, but the fix might not be, and might be more widespread than just that particular case. And whether or not it's a more general (larger) fix or a more specific (smaller) one, there still better be a fair amount of testing on different devices and under different conditions that should happen. To expect all of that to happen within hours is quite unrealistic--it might certainly be desirable and and all that, but that doesn't change the inherent reality of it.

 

[s1m]

Lol, just ****ed up a lot of phones of class mates and their family. They could Fix this by sending them self a message. But now my iPad won't open iMessage anymore and sending myself a message won't fix it! anyone has an idea on how to fix this?

I really hope you didn't get this fixed and no-one tried to help you.

 

[seatton]

This is a cut and paste of my Apple post on the topic:

Settings -> Notifications -> Messages -> Show Previews -> OFF (gray switch, NOT green).

Alert style when unlocked set to "none"..

iIf what has been reported on Reddit is true and it is the text string being fed to banners that is crashing the phones, these are the settings I've had on my phone that kept it from effecting me when my son tested it on my phone.

Do the above and the malicious text string can not crash your phone.

I read somewhere this AM about this and I tried it. It is the only fix that worked for my phone.

 

[Jeff89179]

In case the "Fixes" dont work, here is another workaround...

If you find that you cannot access your Messages app and it keeps crashing back to the home screen when you try to open it...

1. Hold the home button to bring up Siri.
2. Ask Siri to read back your messages to identify who sent you the message that is causing this issue.
3. Ask Siri to respond something back to that person like "ok" or "screw you" or whatever.

This should allow you to open the Messages app again and delete the problem message thread.

Please let me know who else this works for.

 

[tennisproha]

Easy, iMessage is running the text message through an algorithm looking for whatever the programmer is looking for. Searching a text for certain keywords like grabbing metadata from phone calls/emails, etc. The scanning algorithm/code boo boo.

If any text is not scanned/messed with, this shouldn't happen.

Also might be decryption, sending doesn't affect the sender. Only when receiving and it's being decrypted on the receiver side. After you fix it by sending a new text, you create a new message that is scanned but the old one that boo boo iMessage doesn't need to be decrypted/scanned again. It gets moved down the memory slot.

If you're asking how they found this particular line of text to break it you have to ask the person who found it, decompiling, monitoring packets, cat walking on keyboard and sent a iMessage, etc...

Very sloppy answer, hope it helps.

Well idk who boo boo is lol

----------

Your phone wouldn't crash because of it?

Yeah its superior to those european ones.

 

[PaulB183]

This PREVENTS the problem in the first place:

This is a bump to keep it where folks can see it while this is still fresh:

The resolution to the problem, until Apple comes up with a fix, is to turn off Preview and Banners in Messages,

Go to Settings > Notifications > Messages

set "Alert Style" to "none' and turn off the switch for "Show Previews".

This will prevent the malicious text from being sent to the screen, which then fails to be able to complete the subroutine, causing a respring that then causes the iPhone to reboot and occasionally crash Messages.

You will still know when you are getting an incoming text from the "ding" [or what ever other noise you have assigned it} and the icon badge showing a new text message has come in... you just won't see a preview of it.

When Apple gets the fix distributed you can turn the setting back on.

If you have already been hit the fixes listed here do work, and then doing the above will keep it from happening again.

 

[EthanLMT]

This happens because the text is formatted weird. Part of it goes from left to right and part of it is right to left. In the little notification window on the front page of messages and in the banners that pop up when you get a message it doesn't know how to present it. So it crashes.

To fix this(after the reboot) you just have to make it so that it doesn't appear in the little messages window. This can be done 3 ways:

1. Delete the message (this is probably the most complicated of the options), you can do this by waiting for it to be deleted automatically(you can change the automatic delete period in the messages setting of settings).

2.Overwrite it (replace the little window with the newest message) yourself. You can do this by sending the person who sent you the message a message using either the share sheet or Siri.

3.Overwrite it (replace the little window with the newest message) by having the person that sent you the message a new message.

Once one of these is completed you will be able to go back into your messages because the app will no longer be trying to process the message in the little window.

Hope this helped. Reply to this if you have any questions. Apple will probably release an OTA update in the next 24 hours.

 

[Traverse]

This is not a 0day. There is no security issue.

That we're aware of. We don't know the potential vulnerability that's present.

----------

Should have been patched within 8-12 hours. Anything more is unacceptable.

It'll be patched with iOS 8.4 in June. :roll eyes:

Apple rarely sends out emergency updates. iOS 8.0.2 was an necessary exception.

 

[C DM]

This is a bump to keep it where folks can see it while this is still fresh:

The resolution to the problem, until Apple comes up with a fix, is to turn off Preview and Banners in Messages,

Go to Settings > Notifications > Messages

set "Alert Style" to "none' and turn off the switch for "Show Previews".

This will prevent the malicious text from being sent to the screen, which then fails to be able to complete the subroutine, causing a respring that then causes the iPhone to reboot and occasionally crash Messages.

You will still know when you are getting an incoming text from the "ding" [or what ever other noise you have assigned it} and the icon badge showing a new text message has come in... you just won't see a preview of it.

When Apple gets the fix distributed you can turn the setting back on.

If you have already been hit the fixes listed here do work, and then doing the above will keep it from happening again.

From what I've read if you go to the main screen of the Messages app where all the conversations are listed with a preview of the latest messages, if one of those has that badly formatted message as its latest message then the issue will arise there when the Messages app is trying to load the preview of that message.

So while disabling the notification preview (not even sure if alert style needs to be disabled) would address the main avenue of this affecting users, there's still a path for users to be affected nonetheless.

----------

That we're aware of. We don't know the potential vulnerability that's present.

----------



It'll be patched with iOS 8.4 in June. :roll eyes:

Apple rarely sends out emergency updates. iOS 8.0.2 was an necessary exception.

They have done patch releases for security fixes. They are pretty close to releasing 8.4 most likely, so they might not do it, but it's possible they could release 8.3.1 to address this, or push up 8.4 a little to address it sooner (once they make the fix itself).

 

[tagy]

Given that all iMessages go through Apple's servers I wonder if they can do anything server side to strip out this string. Maybe not, all messages are encrypted?

And whether or not it's a more general (larger) fix or a more specific one, there still better be a fair amount of testing on different devices and under different conditions that should happen. To expect that to happen within hours is quite unrealistic--it might certainly be desirable and and all that, but that doesn't change the inherent reality of it.

Tend to agree, I don't think 8 hours is a realistic time for an OS update to this type of problem.