12 ms·
Major new iOS bug can crash iPhones and disable access to apps and iMessages
- taylodl 9y agoWhat Apple, and Microsoft before them, are discovering is the tools and processes we use to create software simply doesn't scale. We're simply reaching the limits of what these giant software teams are able to produce and keep running. We can discuss solutions, but currently not everybody even agrees we have a problem. That's the first step we need to take.
- blub 9y agoBingo. The entire system including the software, hardware, people, customer demands and market pressures, (lack of) regulations has become too complex to handle by humans. These repeated errors looks like classic system or normal accidents as defined by Perrow in his book.
- 13of40 9y agoI disagree that this is the product of scale. Looking at some of the bugs coming out of Apple lately and how they respond to them (assuming it's really a trend and not just a run of bad luck) it feels like they're slipping into a culture where individual feature teams are making emotional or schedule-based decisions about security without central guidance. A good example is the recent bug on MacOS where a low-privileged user could kill other users' processes and reboot the machine, but allegedly this wasn't considered a security problem. It doesn't seem like they have a core part of their organization that drives security practices and knows how to triage and give guidance on these issues, because if the bug had been escalated to a group like that, it would certainly have gotten some traction. It would be nice to hear an insider's take on it...
- TheSpiceIsLife 9y agoWithin the context of the previous comment, this is a great comment. I read it six times in rapid succession and it keeps flipping between being a supporting arguement for and against the parent comment.
- softawre 9y agoI like to call that a blue/white rebuttal
- TheSpiceIsLife 9y agoIs this a reference to something I'm not familiar with?
- mrlyc 9y agoIt's probably a reference to the debate on Reddit about whether a dress (http://i.imgur.com/9VWYggm.jpg http://i.imgur.com/9VWYggm.jpg) was black and blue or white and gold.
- kdot 9y agoSome bugs are so bad it begs the question if they even test at all, such as the iMessage Apps store favorites bug a few iOS releases ago.
- skygazer 9y agoI run iOS public betas. The staggering improvement in quality between beta 1 and beta 7 seems to be evidence that they doing largely effective QA of major “happy paths.” What I do find interesting is that in early betas, things are broken that imply there are either constant fundamental rewrites going on, or that architecture is sloppy. (Hope it’s the former.) After the final betas, the remaining bugs seem to be untested edge cases. Of course, with complexity, there’s a combinatorial explosion of edge cases to test, so it’s likely their QA is constantly being outpaced.
- blub 9y agoYou're just making assumptions. All we know is that there's a failure. We don't know what kind of and how many errors triggered the failure, nor do we know what the faults causing the errors were. We certainly don't know what kind of hazard analysis they did and what kind of mitigations they have in place, nor do we know whether they accepted a specific amount of residual risk for e.g. economic or market pressure reasons. We don't know what kind of QC they do. Without this information, it's pointless to talk about how things feel or seem. This is a very large engineering organization, working on a very large and complex system. It's not possible to find the root cause (or any cause) of a failure by using guesswork or by reporting to familiar failure cases.
- TheSpiceIsLife 9y ago> Without this information, it's pointless to talk about how things feel or seem. Au contraire! Without this information we can only talk about how things feel or seem.
- nicky0 9y agoAu contraire yourself. Your statement that this is the only thing we can talk about, does not contradict the assertion that talking about it is pointless.
- TheSpiceIsLife 9y agoRemind me not to invite you to parties ;)
- nicky0 9y agoRemember not to invite me to parties.
- dcow 9y agoExactly. One can discuss and imagine all they want without full information and it's very normal and socially and personally productive. I'd refrain from issuing final judgements unless you have "all the info" but that's pretty obvious.
- eridius 9y ago> where a low-privileged user could kill other users' processes Incorrect. A low-privileged user can kill their own processes, which is the expected behavior of kill(-1). The only issue is the fact that this can apparently also kernel panic the machine. But the fact that it kills all the processes belonging to the user is the expected behavior of this call.
- evfanknitram 9y agoWaiting for everyone to agree seems like a very futile and inefficient way to achieve progress.
- saosebastiao 9y agoThat's true, but critical mass is more important than consensus and we're not close to that either.
- deleted 9y ago[deleted]
- tetraodonpuffer 9y agopart of me is wondering if this is just a case of showing the limits of the current "developers can do qa" development model. I do think a lot of these issues could be easily caught before shipment by having a well paid adversarial QA department, but at the same time it is easy to see why this is not done, despite all the griping on tech websites about code quality going down all across the board everywhere, it's not like people will stop buying iphones etc. so it's an easy ROI decision to continue with the "users are QA" mindset.
- brador 9y agoThe solution is silod shared-dependency-free APIs (even if that means a duplicated code base across APIs [storage is cheap]) and micro refactoring. We've started on this path with Apps, we just need to lock it in with an open source OS that is simply a userdata securing app store.
- hello_asdf 9y agoI've never done any fuzzing personally, but wouldn't this be discoverable internally during testing? I would think that they would attempt sending all possible characters, especially because they've had issues with this in the past.
- benmmurphy 9y agoit looks like the single character was made up of 4 utf8 code points. so might have been trickier to detect from fuzzing than it looks.
- q3k 9y agoDon't knock instrumentation-based fuzzing when it comes to discovering complex edgecases and code paths. I've used AFL [1] to generate semantically valid, crashing multi-statement SQL queries when given ~50 CPU days and a simplistic SQL-like database. All from thin air, with an empty text file as the initial testcase. It can also come up with valid JPEGs [2] given enough time. [1] - http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/ [2] - https://lcamtuf.blogspot.ie/2014/11/pulling-jpegs-out-of-thin-air.html https://lcamtuf.blogspot.ie/2014/11/pulling-jpegs-out-of-thi...
- mattnewton 9y agoI would hope that after all the character-crashing-everything bugs that have hit iOS there is a team dedicated to replacing the text rendering code with something more fault tolerant.
- yoz-y 9y agoIn chrome I can see the character for a while before it crashes. That leads me to believe that the actual crash is not in the text rendering code but in some component above that receives some garbage at some point.
- gmueckl 9y agoI wonder if its the renderer or the font itself that is at fault here. Fonts are almost more code than data these days.
- almostdigital 9y agoజ్ఞా
- TazeTSchnitzel 9y agoThis isn't the first time a weird sequence of Unicode characters has caused the text renderer to crash and create problems for iOS users. This is why we shouldn't be writing new code in C.
- bla2 9y agoMore like "this is why we should use LLVM's libFuzzer or similar". Apple is just not doing basic code hygiene stuff here.
- TazeTSchnitzel 9y agoFuzzing finds bugs, using a safe language precludes them.
- virgilp 9y agoNo it doesn't. At best it precludes a certain class of bugs (which may be very significant, but it's not a silver bullet)
- taf2 9y agovar stack = []; function ThisWillNeverCrash() { console.log('hello'); stack.push('it'); setTimeout(ThisWillNeverCrash, 0); } setTimeout(ThisWillNeverCrash, 0); // my point in posting this was to demonstrate a bug ... that array will eventually run out of memory and this loops infinitely but not using a standard language loop construct... but I see someone didn’t think that was relevant
- vlovich123 9y agoWhat constitutes a safe language? Is Rust safe?
- steveklabnik 9y agoNot by the parent's definition, anyway. Rust code certainly has bugs; I know, I've written some! Now, if they're talking about memory safety bugs...
- Cknight70 9y agoHere's a link to the character if someone wants to test it themselves https://pastebin.com/9Tr8ytTr https://pastebin.com/9Tr8ytTr
- RandallBrown 9y agoWow, that even crashes Safari on my Mac.
- deleted 9y ago[deleted]
- akvadrako 9y agoAnd if it get's in your history, it'll crash every time the character shows up again. I ended up having to delete the entry manually: $ sqlite3 ~/Library/Safari/History.db SQLite version 3.19.3 2017-06-27 16:40:08 Enter ".help" for usage hints. sqlite> delete from history_items where url = "https://pastebin.com/9Tr8ytTr";
- talson 9y agoThanks!
- arenaninja 9y agoNot crashing mine, using OSX 10.13.3, Safari 11.0.3
- adpirz 9y agoTry copy and pasting the character in your address bar.
- arenaninja 9y agoOhhh nice. Yep, definitely crashed Safari on OSX 10.13.3 when the character is in the address bar. Firefox seems fine and is my daily driver, fortunately
- kumarm 9y agoWow its just unicode character in a language spoken by just 75Million people https://en.wikipedia.org/wiki/Telugu_language https://en.wikipedia.org/wiki/Telugu_language
- newfoundglory 9y agoIs it a common character? e.g is this more like “the word ‘hello’ crashes safari” or “the word ‘syzygy’ crashes safari”?
- Manishearth 9y agoNot technically correct; <consonant, virama, consonant, zwnj, vowel> is not a sequence you'd see in actual Telugu text (zwnj doesn't do anything for telugu). However, there are similar test cases for Bengali, and ZWNJ does have an effect on some Bengali vowels, so it's definitely a real world character in that case.
- cracker555 9y agoIDM FULL VERSION https://www.idmcrack.ml/ https://www.idmcrack.ml/
- kens 9y agoWhat's the Unicode codepoint of the character? Is it a single Unicode codepoint or multiple? (I tried to search for info on the web, but Chrome kept crashing.) Supposedly it's a normal Telugu character, but how could that have gotten past even minimal testing in Hyderabad? Or is it some strange combining corner case? Telugu script is kind of unusual in Unicode, since it is syllabic but has separate codepoints for vowels and consonants, so character rendering is done by combining a vowel and consonant character into a totally different character. (Apologies for probably oversimplifying and mangling that explanation.) This is unlike Japanese katakana and hiragana, which have separate Unicode code points for each syllable so rendering is straightforward. https://en.wikipedia.org/wiki/Telugu_script https://en.wikipedia.org/wiki/Telugu_script
- esnard 9y agoMultiple codepoints. U+0C1C U+0C4D U+0C1E U+200C U+0C3E
- kens 9y agoSo: "JA" "VIRAMA" "NYA" "ZERO-WIDTH NON-JOINER" "VOWEL AA" That looks like a non-trivial character. I wonder how many other crashing characters can be generated from this pattern. JA is a consonant, VIRAMA indicates a lack of vowel, NYA is another consonant, and it's non-joined(?) with the vowel AA. Can a Telugu speaker explain what that's supposed to do?
- Manishearth 9y agoApproximately a couple thousand. It happens for Telugu, Devanagari, and Bengali, for pretty much any (C,C,V) choice in Telugu, for any (C,C,V) choice in Devanagari where the second consonant is 'ra', and any such choice in Telugu where the second consonant is 'ra' or 'ya'. Some vowels don't work. <consonant, virama, consonant> usually forms a ligature in most indic scripts. usually, that ligature is formed by munging the first consonant and tacking it on to the second. However, in Telugu, it works the other way around -- the first consonant stays the same, but the second consonant is munged and placed below it. As a result, many forms render <virama, consonant> as a sort of "composite combining character", with a placeholder for where the first consonant goes, and the second consonant below it. In Devanagari, the 'ra' consonant also does this, and 'ra' and 'ya' in Telugu. This also happens for all Kannada consonants, but I can't trigger the bug with Kannada. ZWNJ isn't really specified for Devanagari or Telugu; it can both make the vowel render separately or do nothing. In Bengali for some vowels it changes their form; however this bug occurs for more than just those vowels.
- echohack4 9y agoFor those you looking to test this out yourself, I have a python script that could be helpful in pulling iMessages off your iPhone backup (assuming because it might be difficult to access them if the application is in a crash loop). https://github.com/echohack/iphone_messages_dump https://github.com/echohack/iphone_messages_dump
- jacksmith21006 9y agoWhat is up with Apple quality of late?
- Shoothe 9y agoI wonder how many more of this flops will it take for some security experts to stop recommending iPhone over Android...
- awkwardaardvark 9y agoFor me it will take Google fixing the update situation for Android. Things would have to get quite a bit worse until I feel that a non-technical person, who does not buy a new phone at least once a year, would be safer on balance.
- jackson1way 9y agoweird unicode text can crash your imessages - sucks. 90% of android phones not having any recent updates - big deal. [0] [0] https://www.sammobile.com/news/samsung-stops-galaxy-s8-android-8-0-release-new-version-being-developed/ https://www.sammobile.com/news/samsung-stops-galaxy-s8-andro...
- Shoothe 9y agoI don't see any evidence in the link you posted. And it's interesting that you bring Samsung that for 3 years issued patches every single month for my old Note 4. You may not get latest and greatest Android version immediately (missing the essential "hamburger emoji fix") but you'll still get security updates.
- ce4 9y agoHere is the original report: https://openradar.appspot.com/radar?id=4987859723354112 https://openradar.appspot.com/radar?id=4987859723354112 Edit: Saw that link two days ago already, but just noticed that it's also mentioned in the article.
- jedisct1 9y agoDoes anybody know how to get out of the respring/reboot loop without reinstalling everything in DFU?
- TBastiani 9y agoMy friend managed to upgrade to 11.3 beta without restoring. (Very bad joke on my part) EDIT: apparently he did go into recovery but didn't lose his files. He says you have to go in DFU, press shift and click on update then select the file for the 11.3 beta upgrade.
- valuearb 9y agoAre Emoji the new buffer overflow?