“Text bomb” scare

iPhone-crashing ChaiOS bug disclosed... but still only potential, for now

Hard on the heels of recent Apple security scares comes a new bug called a “text bomb,” an iMessage that can crash your iPhone, even if you don’t tap the link it contains.

The problem was disclosed by software developer Abraham Masri, who discovered that embedding a particular link in an iMessage can cause an iPhone to crash, or in some cases restart, apparently because it tries to auto-load the linked content, which overloads it.

This bug is said to affect Safari/ WebKit on the Mac as well as iOS, but there are no reports of actual exploits yet. (There may well be some to come — Masri posted the code that performs this trick on the developer site GitHub, and although he’s since removed it, it’s not impossible that some malicious individual might get hold of it and implement it.)

Apple is reported as saying a forthcoming security update will address the problem soon. In the meantime, security expert Graham Cluley has said that the bug, even if it appears in the wild, is not anything to be particularly worried about: “Something about the so-called ChaiOS bug’s code gives your Apple device a brainstorm. Ashamed about the mess it gets itself in, Messages decides the least embarrassing thing to do is to crash. Nasty. But, thankfully, more of a nuisance than something that will lead to data being stolen from your computer or a malicious hacker being able to access your files.”

The ChaiOS code does no lasting harm, and in Messages, once you’ve restarted at any rate, the fix would seem to be straightforward: delete the offending message without opening it. (To do this, swipe left on the relevant conversation on the main Messages screen, then tap the red Delete button.)

It’s not yet clear how to remedy a similar problem in macOS if someone were to exploit it. For now, since Apple seems to be on top of the situation, installing the latest security updates looks to be your best protection.