Apple, what did you do?
“Alright, keep moving, keep buying, nothing to see here”… is what Apple would have been saying before it patched an iMessage bug that left iOS devices vulnerable to being bricked if an attacker crafted a message with special characters that causes the targeted iOS device to convulse – no different from being purged of demons, no?. This was reported by ThreatPost and the credit is to a researcher, one Natalie Silvanovich from Google’s Project Zero which is meant to be Google’s super-duper secret team of cyber-security researchers.
ZDNet also shed light on the matter reporting that; The researcher showed in a technical blog post that SpringBoard and soagent -which are core-system apps handling the iOS homescreen in iPhones and Macs respectively- crashes if a malformed message is received; “receiving this message will cause SpringBoard to crash and re-spawn repeatedly, causing the UI to not be displayed and the phone to stop responding to input.” said the researcher. The post continues “This condition survives a hard reset, and causes the phone to be unusable as soon as it is unlocked”, with a concluding assessment stating that “the only way i could find to fix the phone is to reboot into recovery mode and do a restore”…
The suggestion will result in loss of data which is expected and also pointed out in the researcher’s blog post. This is not the end of everything because Apple has already released a patch in its iOS 12.3 update in the 2nd week of May, 2019. Conversely, according to StatCounter -an iOS version tracking company-, as at June 2019, about 47% of iOS devices globally were vulnerable due to running the affected versions of iOS i.e. version 12.2 and below. The solution is straight-forward, save those priceless tears and update that slab to iOS 12.3 or above.
The only way i could find to fix the phone is to reboot into recovery mode and do a restore – Silvanovich
Amazon admits that…
Apparently, those secrets, orders and wishes uttered within ‘ear-shot’ of Amazon’s voice assistant Alexa are not going anywhere even though a customer out-rightly deletes voice command history, thanks to some deft legal acrobatics, feel free to read the letter confirming this. Anyways, ThreatPost correctly points out some discrepancies in the fact that Amazon retains user voice data far longer than necessary in the name of processing a request. For clarity, the device maintains a passive state waiting for its activation phrase “Alexa” after which the user request is recorded and parsed on Amazon’s servers before the request is completed; this could be anything from “Alexa!…who am i?” to “Alexa…please, take care of my life”.
The point is that there is some conflict with Article 5 of the GDPR which sets the guidelines for data retention, and being able to keep customer information indefinitely even if said customer deletes this info is definitely raising eyebrows, hence the legalese letter from God which again deftly defines the spaghetti slim chance of a situation when Amazon can keep data obtained from Alexa-based requests forever. One simply has to observe how this turns out as this case isn’t too different from Amazon’s ‘random audio files‘ debacle which was dubbed a ‘mishap’…so…, no biggie, right?