A recent spate of prank texts sent to a group of iOS developers has revealed a limitation in how Apple handles data sent through its iMessage service, which in some cases can crash the app if the incoming message is too long or contains overly complex characters.
As reported to The Next Web, iOS app developers iH8sn0w, well known for his jailbreak tool, and Grant Paul were among those targeted by a type of denial of service (DoS) attack that overwhelmed their respective Messages inboxes with a load of automatically-generated transmissions.
The two devs believe the messages to have been sent one after another from the Messages app on OS X, with a simple AppleScript effecting the barrage that prompts a victim to constantly clear notifications and text.
âWhatâs happening is a simple flood: Apple doesnât seem to limit how fast messages can be sent, so the attacker is able to send thousands of messages very quickly,â Paul said.
iH8sn0w mocked up a proof-of-concept AppleScript to demonstrate how such an attack may work. If Apple doesn't limit the influx of messages, a user's app will quickly become filled with what amounts to piles of spam.
As vexing as a continuous string of nonsense can be, a real issue arises when extraordinarily long or complex messages are received. This can cause Messages on iOS to crash because it can't process and display the massive amount of data correctly. According to the developers, the app will force itself to close and won't be able to re-open because it can't properly render the text.
While no surefire solution has been found to remedy a crashed Messages app, the publication suggests "playing around with sending a regular message, then locking the phone and activating the message notification until youâre able to time it right to delete the message thread thatâs causing the problem." Paul effectively employed this method to delete the offending text and regain control of the app.
It should be noted that if an attacker gets ahold of a user's iMessage handle, the only option may be to disable that account temporarily. If a user's phone number is compromised, iMessage itself might have to be turned off.
The attacker's identity is unknown at this time, but the messages appear to have originated from a Twitter account used to sell UDIDs and provisioning profiles. Disposable email accounts were being used to send the spam, making it difficult to simply block the culprit as they can simply open another and continue the assault.
Apple has yet to issue a response to the recent development.
23 Comments
GREAT, now an update will probably change that for all instances instead of just stopping things like this. I like not being forced to wait to send messages.
There could be a limit like .1 seconds, and then a per-minute limit that no legitimate sender would ever exceed. Doesn't mean we'll be forced to wait. P.S. Finally, some spam in the proper original (computing) sense of the word! It didn't start out meaning "junk mail," or "ads," it meant overloading someone's inbox--cramming it like spam in a can. But the term got away from its denial-of-service meaning somehow. Which doesn't make sense: what does spam in a can have to do with ads or unwanted messages per se? (At least the original meaning has been retained in multiplayer gaming: there, spamming still isn't about unwanted contacts, but about overload.)
There could be a limit like .1 seconds, and then a per-minute limit that no legitimate sender would ever exceed. Doesn't mean we'll be forced to wait.
P.S. Finally, some spam in the proper original (computing) sense of the word! It didn't start out meaning "junk mail," or "ads," it meant overloading someone's inbox--cramming it like spam in a can. But the term got away from its denial-of-service meaning somehow. Which doesn't make sense: what does spam in a can have to do with ads or unwanted messages per se? (At least the original meaning has been retained in multiplayer gaming: there, spamming still isn't about unwanted contacts, but about overload.)
Please refer to Spam:
4.2 Etymology
from Wikipedia. It might be different than your definition of the origin of the word. Good read nevertheless.
And that's not the biggest problem with iMessage. The biggest problem is that you can't block people from sending you iMessages. A girl I know kept receiving harassing iMessages from her ex-boyfriend for months. No way to block his incoming iMessages.
Basic fixes really and Apple should have implemented these: - have a blacklist to block unwanted iMessage users - limit the number of consecutive messages - limit message size to 2000 characters or something It doesn't have to limit reply time at all. It can just limit consecutive messages from the sender to e.g 5 within 5 minutes. This stops harassment. If both users are sending, there is no need to limit anything.