4 ms·

The worst experience I’ve had on iOS, fairly recently, was clicking on a search result and being redirected to a dodgy website which displayed a “your phone has

The worst experience I’ve had on iOS, fairly recently, was clicking on a search result and being redirected to a dodgy website which displayed a “your phone has a virus!” pop up, started attempting to call a phone number repeatedly, and somehow corrupted the OS to where I saw a distorted version of the left-hand slide menu from the home screen, could not go to the home screen, close the app or reboot. I managed to reboot through a different method but it’s made me very wary of going to random websites on my phone.

r00fus 4y ago
I've never had this kind of experience for the past 14 years on iOS. How could a website get access to call numbers without interaction?
- Operyl 4y ago
  It's spamming the modal asking if you want to call x phone number, probably.
  - code_duck 4y ago
    The corruption of the interface was the most disturbing thing. It was showing the left-hand slide home screen menu offset, overlapping with other elements, without any ability to interact with it. It must be some sort of memory corruption vulnerability, I assume. Apple did an update a week or two later which addressed some sort of zero day… So clearly I was wondering exactly how hacked my phone might have been. I was able to reboot and it has seems OK, but who knows.
    - Operyl 4y ago
      Apple addresses zero days and security related bugs every single update, I wouldn't get paranoid about a visual glitch on its own honestly.
      - code_duck 4y ago
        It prevented me from launching, switching or killing any apps or rebooting the phone. The phone was entirely unusable until I figured out how to reboot. That's more than visual. My impression is that is was memory only, but it was extremely suspicious. It’s quite possible that data was exfiltrated.
        Operyl 4y ago
        Simply locking up Springboard with a DoS doesn't necessarily mean your were breached on the device. It's more likely that nothing came of it, exfiltrating data would involve breaching a lot of sandboxing and we'd be seeing a lot more chatter about that honestly.
        code_duck 4y ago
        Sure, there’s been no evidence of anything wrong since then, either with my phone or related accounts. Apple did fix a couple 0 days with more serious implications shortly after this, but it’s not as if I or a random search result website would be worth someone using a 0 day.
- code_duck 4y ago
  I have encountered websites attempting to call a number, but not repeatedly prior to that. I assume it’s through JavaScript, of course. It pops up an interface on the lower side of the screen asking “do you want to dial this number?” or something like that. This seems to be the relevant doc: https://developer.apple.com/library/archive/featuredarticles/iPhoneURLScheme_Reference/PhoneLinks/PhoneLinks.html https://developer.apple.com/library/archive/featuredarticles...

r00fus 4y ago

I've never had this kind of experience for the past 14 years on iOS. How could a website get access to call numbers without interaction?

Operyl 4y ago
It's spamming the modal asking if you want to call x phone number, probably.
- code_duck 4y ago
  The corruption of the interface was the most disturbing thing. It was showing the left-hand slide home screen menu offset, overlapping with other elements, without any ability to interact with it. It must be some sort of memory corruption vulnerability, I assume. Apple did an update a week or two later which addressed some sort of zero day… So clearly I was wondering exactly how hacked my phone might have been. I was able to reboot and it has seems OK, but who knows.
  - Operyl 4y ago
    Apple addresses zero days and security related bugs every single update, I wouldn't get paranoid about a visual glitch on its own honestly.
    - code_duck 4y ago
      It prevented me from launching, switching or killing any apps or rebooting the phone. The phone was entirely unusable until I figured out how to reboot. That's more than visual. My impression is that is was memory only, but it was extremely suspicious. It’s quite possible that data was exfiltrated.
      - Operyl 4y ago
        Simply locking up Springboard with a DoS doesn't necessarily mean your were breached on the device. It's more likely that nothing came of it, exfiltrating data would involve breaching a lot of sandboxing and we'd be seeing a lot more chatter about that honestly.
        code_duck 4y ago
        Sure, there’s been no evidence of anything wrong since then, either with my phone or related accounts. Apple did fix a couple 0 days with more serious implications shortly after this, but it’s not as if I or a random search result website would be worth someone using a 0 day.
code_duck 4y ago
I have encountered websites attempting to call a number, but not repeatedly prior to that. I assume it’s through JavaScript, of course. It pops up an interface on the lower side of the screen asking “do you want to dial this number?” or something like that. This seems to be the relevant doc: https://developer.apple.com/library/archive/featuredarticles/iPhoneURLScheme_Reference/PhoneLinks/PhoneLinks.html https://developer.apple.com/library/archive/featuredarticles...