5 ms·

This is probably a dumb question, but is it possible that a malicious update to Bouncer could allow a bad actor to intercept my texts and ship them to a remote

This is probably a dumb question, but is it possible that a malicious update to Bouncer could allow a bad actor to intercept my texts and ship them to a remote server?

Traubenfuchs 4y ago
I would like to extend this question to iOS adblockers.
- sgerenser 4y ago
  What I said applies to iOS ad blockers as well, at least the ones that use Apple’s content blocking API (which is the only one that works in Safari). If it uses a loopback VPN then it has more free reign but I think Apple is trying to crack down on those.
sgerenser 4y ago
No, Apple has a content blocking API. The only thing the app can do is tell iOS something along the lines of “scan incoming SMS for this regex, if it matches, throw it in junk.” The blocker app never actually sees the messages.
- gondo 4y ago
  This message displayed before allowing app access contradicts your statement: "The developer of Bouncer will receive the text, attachments and sender information in SMS and MMS messages from senders not in your Contacts. Messages may include personal or sensitive information like bank verifications codes."
  - cmer 4y ago
    I uninstalled it immediately when I saw that. Having control of this data is way better than SIM swapping. This seems like a terribly risky thing to install, security-wise.
    - pensatoio 4y ago
      All spam filtering apps for iOS have this permission though, right? That’s just how it works. The permission is just very blunt to make it clear.
- vengefulduck 4y ago
  I’m not so sure that’s true reading through the privacy notice when enabling SMS filtering it reads “You can install and use third-party SMS filters. If you do, the filter provider can access all of the text and content included in incoming SMS and MMS messages that you receive from unknown senders.” That doesn’t sound like the same thing as the content blocker api it sounds like it provides plaintext access to sms messages. And it’s enough of a risk that I decided not to install it.
  - crooked-v 4y ago
    The SMS content blocker API gives that plaintext access. It doesn't work like the browser content blocking API.
- kemayo 4y ago
  You're thinking of the way web content blocking works. This is a SMS filter, which is given actual access to the message contents. However, the extension isn't allowed to make network requests while it's doing that, and has to pass off a request to contact a server to an iOS service than handles this outside of the extension's control. (I'm not actually sure what restrictions are involved on what Apple will send to your own server, admittedly.)
kemayo 4y ago
Sort of. So, first of all, it'd only ever be shown texts (not iMessage messages) from people who aren't in your contacts. But that probably includes things like 2fa codes, so that's not necessarily comforting. The app registers an ILMessageFilterExtension. This is run (if you enable it) when you receive a SMS and is given the sender and contents of the message and asked whether it should be blocked or categorized. However, it's sandboxed away from the main app you install and isn't allowed to store data for later access or send network requests. It is allowed to tell iOS that it needs to contact a server to work out whether the message should be blocked, and then an iOS system-service will contact a URL associated with the app with the data about the message... (I don't know whether Apple proxies these requests to avoid the server being able to correlate by your IP address.) The theory is that since the system is handling contacting the server, it can avoid sending any extraneous data that would let the text be tied to you by anything more than its actual contents (so e.g. it might have a 2fa code, but it wouldn't know what your email address is). But it'd still be sent all the actual contents of your non-contacts texts. https://developer.apple.com/documentation/sms_and_call_reporting/sms_and_mms_message_filtering https://developer.apple.com/documentation/sms_and_call_repor...
- latchkey 4y ago
  I am hoping that people don't use SMS for 2FA codes... We all know that isn't true, but that's a huge issue given the amount of simjacking that goes on.
  - linux2647 4y ago
    Sometimes we don’t have a choice, e.g. many American banks use SMS as the only 2FA
    - latchkey 4y ago
      The choice could be to use another bank.
      - Firmwarrior 4y ago
rhexs 4y ago
If the actor deployed a 0-day through the update, yes, absolutely, but that goes for any app.

This is probably a dumb question, but is it possible that a malicious update to Bouncer could allow a bad actor to intercept my texts and ship them to a remote server?

Traubenfuchs 4y ago

I would like to extend this question to iOS adblockers.

sgerenser 4y ago
What I said applies to iOS ad blockers as well, at least the ones that use Apple’s content blocking API (which is the only one that works in Safari). If it uses a loopback VPN then it has more free reign but I think Apple is trying to crack down on those.

sgerenser 4y ago

No, Apple has a content blocking API. The only thing the app can do is tell iOS something along the lines of “scan incoming SMS for this regex, if it matches, throw it in junk.” The blocker app never actually sees the messages.

gondo 4y ago
This message displayed before allowing app access contradicts your statement: "The developer of Bouncer will receive the text, attachments and sender information in SMS and MMS messages from senders not in your Contacts. Messages may include personal or sensitive information like bank verifications codes."
- cmer 4y ago
  I uninstalled it immediately when I saw that. Having control of this data is way better than SIM swapping. This seems like a terribly risky thing to install, security-wise.
  - pensatoio 4y ago
    All spam filtering apps for iOS have this permission though, right? That’s just how it works. The permission is just very blunt to make it clear.
vengefulduck 4y ago
I’m not so sure that’s true reading through the privacy notice when enabling SMS filtering it reads “You can install and use third-party SMS filters. If you do, the filter provider can access all of the text and content included in incoming SMS and MMS messages that you receive from unknown senders.” That doesn’t sound like the same thing as the content blocker api it sounds like it provides plaintext access to sms messages. And it’s enough of a risk that I decided not to install it.
- crooked-v 4y ago
  The SMS content blocker API gives that plaintext access. It doesn't work like the browser content blocking API.
kemayo 4y ago
You're thinking of the way web content blocking works. This is a SMS filter, which is given actual access to the message contents. However, the extension isn't allowed to make network requests while it's doing that, and has to pass off a request to contact a server to an iOS service than handles this outside of the extension's control. (I'm not actually sure what restrictions are involved on what Apple will send to your own server, admittedly.)

kemayo 4y ago

Sort of. So, first of all, it'd only ever be shown texts (not iMessage messages) from people who aren't in your contacts. But that probably includes things like 2fa codes, so that's not necessarily comforting. The app registers an ILMessageFilterExtension. This is run (if you enable it) when you receive a SMS and is given the sender and contents of the message and asked whether it should be blocked or categorized. However, it's sandboxed away from the main app you install and isn't allowed to store data for later access or send network requests. It is allowed to tell iOS that it needs to contact a server to work out whether the message should be blocked, and then an iOS system-service will contact a URL associated with the app with the data about the message... (I don't know whether Apple proxies these requests to avoid the server being able to correlate by your IP address.) The theory is that since the system is handling contacting the server, it can avoid sending any extraneous data that would let the text be tied to you by anything more than its actual contents (so e.g. it might have a 2fa code, but it wouldn't know what your email address is). But it'd still be sent all the actual contents of your non-contacts texts. https://developer.apple.com/documentation/sms_and_call_reporting/sms_and_mms_message_filtering https://developer.apple.com/documentation/sms_and_call_repor...

latchkey 4y ago
I am hoping that people don't use SMS for 2FA codes... We all know that isn't true, but that's a huge issue given the amount of simjacking that goes on.
- linux2647 4y ago
  Sometimes we don’t have a choice, e.g. many American banks use SMS as the only 2FA
  - latchkey 4y ago
    The choice could be to use another bank.
    - Firmwarrior 4y ago

rhexs 4y ago

If the actor deployed a 0-day through the update, yes, absolutely, but that goes for any app.