As disclosed recently, Apple has fixed some serious security issues with the release of iOS 12.3 a couple of months ago. These security flaws could allow an attacker to brick iPhones via malicious iMessages. The only way out for the user to handle the situation would be to wipe the phone and lose all data.
Malicious iMessages Could Crash iPhones
According to a blog post by a Google Project Zero researcher Natalie Silvanovich, there existed serious security threat to iPhone users. Due to some security flaws, it became possible for a potential attacker to trigger system crashes by sending malicious iMessages.
Describing the problem, the researcher stated,
The method -[IMBalloonPluginDataSource individualPreviewSummary] in IMCore can throw an NSException due to a malformed message containing a property with key IMExtensionPayloadLocalizedDescriptionTextKey with a value that is not a NSString. This method calls [IMBalloonPluginDataSource _summaryText] which returns the property assuming it is a string, but this is not checked. The calling method then calls -[IMBalloonPluginDataSource _replaceHandleWithContactNameInString:] which calls im_handleIdentifiers on the ‘NSString’ which is really an NSNumber, which throws an exception as the selector does not exist in that class.
Consequently, this could cause the Springboard (the app handling the iOS home screen) to ‘crash and respawn repeatedly’. The UI would not respond and the user would only see a blank home screen.
The researcher stated that the only option left for the user to relive the device was to wipe the device. However, this would cause data loss to the user. The other viable option was to restart the device in recovery mode and restore (if a back file should be available.)
Fixes Released With iOS 12.3
The researcher spotted the issues in April 2019. Fortunately, before public disclosure, Apple rolled-out fixes for the vulnerabilities with the release of iOS 12.3. Apple identified the problems as two security bugs that could cause a denial of service. These include CVE-2019-8573 and CVE-2019-8664. Both of these were input validation issues arising while processing maliciously crafted messages.
Take your time to comment on this article.