Malicious iMessages Could Brick iPhones Owing To iOS Vulnerabilities

As disclosed recently, Apple has fixed some serious security issues with the release of iOS 12.3 a couple of months ago. These security flaws could allow an attacker to brick iPhones via malicious iMessages. The only way out for the user to handle the situation would be to wipe the phone and lose all data.

Malicious iMessages Could Crash iPhones

According to a blog post by a Google Project Zero researcher Natalie Silvanovich, there existed serious security threat to iPhone users. Due to some security flaws, it became possible for a potential attacker to trigger system crashes by sending malicious iMessages.

Describing the problem, the researcher stated,

The method -[IMBalloonPluginDataSource individualPreviewSummary] in IMCore can throw an NSException due to a malformed message containing a property with key IMExtensionPayloadLocalizedDescriptionTextKey with a value that is not a NSString. This method calls [IMBalloonPluginDataSource _summaryText] which returns the property assuming it is a string, but this is not checked. The calling method then calls -[IMBalloonPluginDataSource _replaceHandleWithContactNameInString:] which calls im_handleIdentifiers on the ‘NSString’ which is really an NSNumber, which throws an exception as the selector does not exist in that class.

Consequently, this could cause the Springboard (the app handling the iOS home screen) to ‘crash and respawn repeatedly’. The UI would not respond and the user would only see a blank home screen.

The researcher stated that the only option left for the user to relive the device was to wipe the device. However, this would cause  data loss to the user. The other viable option was to restart the device in recovery mode and restore (if a back file should be available.)

Fixes Released With iOS 12.3

The researcher spotted the issues in April 2019. Fortunately, before public disclosure, Apple rolled-out fixes for the vulnerabilities with the release of iOS 12.3. Apple identified the problems as two security bugs that could cause a denial of service. These include CVE-2019-8573 and CVE-2019-8664. Both of these were input validation issues arising while processing maliciously crafted messages.

Take your time to comment on this article.

The following two tabs change content below.

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Related

Comments are closed.