Feed: Slashdot
Feed Link: https://slashdot.org/
---

Title: Why the iPhone's Messages App Refuses Audio Messages That Mention
'Dave & Buster's'

Link: https://apple.slashdot.org/story/25/05/26/015...

Earlier this month app developer Guilherme Rambo had a warning for iPhone
users: If you try to send an audio message using the Messages app to someone
who's also using the Messages app, and that message happens to include the
name "Dave and Buster's", the message will never be received. In case you're
wondering, "Dave and Buster's" is the name of a sports bar and restaurant in
the United States... [T]he recipient will only see the "dot dot dot"
animation for several seconds, and it will then eventually disappear. They
will never get the audio message. "The issue was first spotted on the podcast
Search Engine..." according to an article in Fortune: Rambo's explanation of
the curiosity goes like this. "When you send an audio message using the
Messages app, the message includes a transcription of the audio. If you
happen to pronounce the name 'Dave and Buster's' as someone would normally
pronounce it, almost like it's a single word, the transcription engine on iOS
will recognize the brand name and correctly write it as 'Dave & Buster's'
(with an ampersand)," he begins. So far, so good." [But ampersands have
special meaning in HTML/XHTML...] And, as MacRumors puts it: "The parsing
error triggers Apple's BlastDoor Messages feature that protects users from
malicious messages that might rely on problematic parsing, so ultimately, the
audio message fails to send." To solve the mystery, Rambo "plugged the
recipient device into my Mac and captured the logs right after the device
received the problematic message." Their final thoughts... Since BlastDoor
was designed to thwart hacking attempts, which frequently rely on faulty data
parsing, it immediately stops what it's doing and just fails. That's what
causes the message to get stuck in the "dot dot dot" state, which eventually
times out, and the message just disappears. On the surface, this does sound
like it could be used to "hack" someone's iPhone via a bad audio message
transcription, but in reality what this bug demonstrates is that Apple's
BlastDoor mechanism is working as designed. Many bad parsers would probably
accept the incorrectly-formatted XHTML, but that sort of leniency when
parsing data formats is often what ends up causing security issues. By being
pedantic about the formatting, BlastDoor is protecting the recipient from an
exploit that would abuse that type of issue.

Read more of this story at Slashdot.

---
VRSS v2.1.180528