34

WARNING: DON'T VISIT THE LINK BELOW ON AN IPHONE

A colleague of mine, who works in the technology field, told me that there is a specific text string that can crash any iPhone (specifically iOS 6) which tries to display it.

He alleges that the string will crash Safari if it's on a web page. But of greater impact, if it is messaged to an iPhone it will cause the messaging app to crash every time it's opened.

He also sent me a link that is supposed to make iPhones crash.

The colleague who told me about this is a reasonably smart guy, with a degree in computer science specialising in security (among other things), so I consider him a trustworthy source.

Does this string in the above link crash iPhones?

ike
  • 4,950
  • 1
  • 20
  • 52
Coomie
  • 8,509
  • 12
  • 46
  • 79
  • 3
    I've tested that on my colleagues (sorry guys). https://twitter.com/var_tec/status/373377397795479553/photo/1 – vartec Aug 30 '13 at 10:21
  • Same, I managed to crash my parents' iPhones >.> – Publius Aug 31 '13 at 00:48
  • 2
    This question appears to be off-topic because it is not about a notable claim, but just an attack on a rendering engine in iOS. The details are widely researched, repoorted and discussed on various forums and sites (including security.stackexchange.com) - it's just another attack. Nothing to be skeptical about. – Rory Alsop Sep 02 '13 at 09:09
  • 3
    @vartec - your colleagues are iPhones? – user5341 Sep 04 '13 at 18:42
  • 2
    [_Information Security StackExchange: How is it possible that a text message can reboot an Apple device?_](http://security.stackexchange.com/q/90216/38377) – IQAndreas May 28 '15 at 06:31

2 Answers2

36

Yes, but this is a newly reported bug on OS X 10.8.4 and iOS 6.1.3 that affects CoreText API so it will likely be fixed in the near future. The text linked to is the same as appears in a screen shot on the Ars Technica article:

Arabic unicode string that causes CoreText API to crash

The article then goes on to explain the following:

There's a new bug in town, and it's here to crash your Mac and iPhone applications. Posters in a HackerNews thread from late yesterday have discovered that it's possible to crash Web browsers and other apps running on current versions of iOS and OS X by making them render a specific, nonsensical string of Arabic characters. The title of the HackerNews thread implies that the issue is with the WebKit browser engine, but it actually affects any browser or application that uses Apple's CoreText API to render text. Ars Microsoft Editor Peter Bright has taken great pleasure in sending the text string to his co-workers, which has crashed the Limechat IRC client and Adium chat client, among other programs.

The article also mentions that iMessage uses the CoreText API so it is also affected by the bug. MacLife also reported on the problem and mentions that this error also affects the system when Wi-Fi hotspot names are displayed as well.

rjzii
  • 16,884
  • 4
  • 92
  • 102
  • 2
    Allegedly it also crashes OSX/iPhone if you set it as WiFi SSID. If you could confirm/deny that it'd be great. – vartec Aug 30 '13 at 10:22
  • 1
    @vartec I'm keep an on the tech sites to see if there are any updates. Pure speculation, but that would work if the user loaded up an application that displays the SSID and is using CoreText API under the hood. From what I've read *anything* that uses the CoreText API is subject to the bug. – rjzii Aug 30 '13 at 13:24
  • Right, I've seen the SSID vector rumored, but no real confirmation anywhere. – vartec Aug 30 '13 at 13:29
6

There has been a new iOS bug lets anyone crash your iPhone with a text message; theguardian.com reported on May 27, 2015:

A bug in Apple’s iOS means that anyone can crash an iPhone by simply sending it a certain string of characters in a message.

It required sending an SMS to the victim, not him opening an link:

The text string is very specific and is therefore highly unlikely to be replicated by accident. Those worried about being attacked can protect their iPhone from the bug by disabling notification banners.

The bug was discovered by a reddit member here:

If you send the following:
effective.
Power
لُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ
冗
Send that to someone with an iPhone it turns their phone off To an iphone, it restarts their phone.

Apple has provided a brief official statement to iMore:

We are aware of an iMessage issue caused by a specific series of unicode characters and we will make a fix available in a software update

George Chalhoub
  • 30,246
  • 14
  • 129
  • 136