Slashdot Mirror


Apple's China-Friendly Censorship Caused An iPhone-Crashing Bug (wired.com)

Security researcher Patrick Wardle helped Apple fix a bug that would crash apps displaying the word "Taiwan" or the Taiwanese flag emoji. Some iPhones could be remotely crashed by something as simple as receiving a text message with the Taiwanese flag. Apple confirmed the fix in a security update Monday. Wired reports: "Basically Apple added some code to iOS with the goal that phones in China wouldn't display a Taiwanese flag," Wardle says, "and there was a bug in that code." Since at least early 2017, iOS has included that Chinese censorship function: Switch your iPhone's location setting to China, and the Taiwanese flag emoji essentially disappears from your phone, evaporating from its library of emojis and appearing as a "missing" emoji in any text that appears on the screen. That code likely represents a favor from Apple to the Chinese government, which for the last 70 years has maintained that Taiwan is a part of China and has no legitimate independent government.

But Wardle found that in some edge cases, a bug in the Taiwan-censorship code meant that instead of treating the Taiwan emoji as missing from the phone's library, it instead considered it an invalid input. That caused phones to crash altogether, resulting in what hackers call a "denial of service" attack that would let anyone crash a vulnerable device on command. Wardle's still not sure how many devices are affected, or what caused that bug to be triggered only in some iOS devices and not others, but he believes it has something to do with the phone's location and language settings.
Wardle has more details of the bug on his blog.

31 of 78 comments (clear)

  1. LOL by Anonymous Coward · · Score: 5, Insightful

    Good one apple. Way to bend over for China. Anything to sell more overpriced toys.

    1. Re:LOL by michelcolman · · Score: 1

      I can kind of understand they had no choice there. It's a pretty big market to just give up for reasons of principle.

      But how can "invalid input" just lead to a crash of the system?! Shouldn't input validation be a solved problem by now?

  2. why not just show the chinese flag emoji? by the_skywise · · Score: 1

    Why go through the hassle of scrubbing the tables and special code hacks - when set for China just use a special emoji page that replaces the Taiwan flag with the China flag.

  3. Why support them? by Anonymous Coward · · Score: 1

    Yay Apple, the 'Anti big brother'.

  4. Step 1 by Anonymous Coward · · Score: 3, Insightful

    Step 1: Make Taiwan's flag disappear in China
    Step 2: Make iPhone act as if it's in China when it's in Taiwan -- pretend Taiwan has disappeared

    It's a small step.

    Then report back to China on everything happening on phone, everywhere -- what electronic boundaries are there for authoritarianism?

  5. Disgusting by hcs_$reboot · · Score: 3, Insightful

    If Apple is keen on implementing that level of censorship [ which has been made public ] who knows what else stagnates in the code ready to break privacy?

    --
    Slashdot, fix the reply notifications... You won't get away with it...
    1. Re:Disgusting by AmiMoJo · · Score: 1

      And how does rendering a character crash the phone? Are they rendering fonts in the kernel?

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  6. Fake Apple Virtue by Anonymous Coward · · Score: 2, Insightful

    Gotta love how Apple pretends to be full of virtue.

    Meanwhile they collaborate with one of the world's most oppressive governments.

    You don't know half of what goes on in China because it is all censored.

    1. Re: Fake Apple Virtue by Anonymous Coward · · Score: 1

      Oh right, I forgot that if you do something bad for money then its all good after all.

      IBM sold 'adding machines' to the Nazis, I wonder what they were counting with such zeal? Who cares, good for business.

  7. 1984 Anyone? by Anonymous Coward · · Score: 1

    Basically Apple added some code to iOS with the goal that phones in China wouldn't display a Taiwanese flag

    If this is true, then NOBODY should be using this product.

    1. Re:1984 Anyone? by OrangeTide · · Score: 1

      Real life Ministry of Truth.

      --
      “Common sense is not so common.” — Voltaire
  8. Think Different by Anonymous Coward · · Score: 2, Insightful

    From Think Different to shareholders whores.

  9. AI by Anonymous Coward · · Score: 1

    Sure. A multi billion dollar company can't keep their phones from crashing due to playing an emoji , but AI is right around the corner right?

    What a fucking joke. Tre iPhone USB riddled with bugs even though it is apples flagship product.

    But yeah, AI is gonna happen real soon now

    1. Re: AI by Anonymous Coward · · Score: 1

      That's like saying back in the late 90s that Linux couldn't possibly exist and be stable because Microsoft is a huge multi-billion-dollar company and their OSes like Windows 95, Windows 98 and Windows ME often crashed unexpectedly.

      Just because Apple might be having some problems with its software doesn't mean that unrelated software from unrelated vendors is having problems too! Lots of companies working on cutting edge technologies are using a modern programming language like Rust, for example. Rust has been designed from the ground up to avoid whole classes of bugs. Rust is quickly becoming the go-to language for important software where safety, security and performance are all mandatory.

      Just because Apple might be using Objective-C or Swift it doesn't mean that other companies aren't using a modern language like Rust that makes it so much harder to write buggy code. Rust is the kind of programming language that's enabling the AI revolution.

    2. Re:AI by CaffeinatedBacon · · Score: 1

      Card can drive themselves (mostly successfully).

      When they can spell check properly we will know they are on the right track.

  10. Re:but apple will not add code to help the FBI! by Desler · · Score: 1

    Word salad ahoy!

  11. there $1.39/hr pay is bigger then free speech by Joe_Dragon · · Score: 1

    there $1.39/hr pay is bigger then free speech

  12. Cupertino city flag by OrangeTide · · Score: 1

    Even the city of Cupertino has their own flag. This does not mean Cupertino is not part of California, nor does California's flag mean it is not part of the US. (I'm sure California's contributions to GDP and federal taxes are appreciate, even if their politics are not welcomed)

    Taiwan can have a flag, and China can claim that Taiwan is part of them. The two positions are no worse than the usual double-think that goes on in the Communist Party of China (CPC). It's kind of sad that freedom-loving American companies have a love for money that overrides principle.

    --
    “Common sense is not so common.” — Voltaire
    1. Re:Cupertino city flag by Actually,+I+do+RTFA · · Score: 4, Informative

      The Taiwanese Flag is also the Chinese National Flag... pre-Communist revolution. The Taiwanese government claims continuity with the pre-Communist government. Hence, to mainland China, it is very much like Delaware wanted to keep flying the Union Jack in 1830.

      --
      Your ad here. Ask me how!
  13. Vulnerability description by Anonymous Coward · · Score: 2, Informative

    Pseudo code for those of you not familiar with Objective C.
    locale currentLocale = CFLocaleCopyCurrent();
    string countryCode = CFLocaleGetValue(currentLocale, kCFLocaleCountryCode);
    if countryCode == "CN" then ...

    If in your phone's configuration no current region is set (region-less configuration) then CFLocaleGetValue will return a null pointer. And thus when the code tries to compare the 'C' with the first character in countryCode, it crashes with a null pointer dereference.

  14. Re: Would using Rust have helped prevent this bug? by Anonymous Coward · · Score: 1

    You can write bad code in any language.

    You C fanatics are really showing your ignorance when you make wrong claims like that. There are certain types of bugs that happen almost naturally within C code but that are pretty much impossible to have happen in languages like Java, Ruby, and especially Rust. Only somebody who is totally ignorant about the last 25 years of programming language development would write something as wrong as what you just wrote.

  15. China vs China by manu0601 · · Score: 3, Informative

    the [People Republic of China] government, which for the last 70 years has maintained that Taiwan is a part of China and has no legitimate independent government.

    And Taiwan's government has the exact same opposite position, maintaining that they are the only legitimate government of China. Both government consider there is only one China, and that its territory contains mainland and Taiwan island.

    1. Re:China vs China by LostInTaiwan · · Score: 4, Informative

      However, Taiwan is a democracy with protection for basic human rights. You can freely fly the Chinese flag and openly advocate Taiwan is a part of China. Try doing the reverse in China will most likely result in imprisonment. That is the biggest difference between Taiwan and China.

      Oh', that China vs China argument is a Chinese construct. The Chinese position is, if Taiwan renounces its Chinese territorial claim then that's justification for invasion; if Taiwan continues its Chinese territorial claim, that too is justification for invasion.

    2. Re:China vs China by manu0601 · · Score: 1

      However, Taiwan is a democracy with protection for basic human rights.

      Sure, but why do you have this urgent need to tell the good and the evil when talking about foreign countries? Have you wondered why you do not feel the same need when talking about public figures, corporations, religions, etc?

      I agree many countries are ruled by evil governments, but it seems we now have a list of countries we must call evil before we are allowed to start a sentence about them. That sounds a lot like war propaganda.

  16. Human rights vs. profit by myid · · Score: 1

    Apple works to protect the environment and gay rights, and tries not to use raw materials supplied by child labor. That's good.

    I hope some day Apple will also care some day about human rights, like free speech.

    At an Apple shareholder's meeting:

    "When we work on making our devices accessible by the blind, I don’t consider the bloody ROI," Cook said, adding that the same sentiment applied to environmental and health and safety issues.

    Ok, when will Apple apply the "I don’t consider the bloody ROI" philosophy, when it comes to selling Apple devices in China?

  17. NSA, GCHQ, China... by AHuxley · · Score: 1

    Who else can ask for a real time look in?
    Thats some great customer support to support nations with their user problems.

    --
    Domestic spying is now "Benign Information Gathering"
  18. I am in Xiamen now... by LynnwoodRooster · · Score: 2

    Let me open my browser (Chrome, Samsung Galaxy Note 8), pop open Bing, type in Taiwan. Works fine here! Same with texting the word to my wife. Even downloaded a picture of the Taiwanese flag. Yep - seems to work on Android at least. I guess Google doesn't want to bow so deeply to Beijing!

    --
    Browsing at +1 - no ACs, I ignore their posts. So refreshing!
    1. Re:I am in Xiamen now... by thegarbz · · Score: 1

      Yeah and Tianamen Square results in nothing but pictures of beautiful flowers.

  19. Shame on you Apple by foobar2015 · · Score: 1

    Kneeling before Chinese coomunist and taking away our freedom of speech. Shame on you, rotten Apple

  20. [Pushes glasses up to brow] by Immerial · · Score: 1

    Technically, that works for iPhones too... if you don't set your location to China. Honestly curious, change your location to China on your Android phones and try again. Also what Android versions are you running? This looks like a very recent change in the code base (latest version of iOS). I wonder if China has added some new requirements to phones operating in China and the next version of Android might have this 'requirement' too.

    1. Re:[Pushes glasses up to brow] by LynnwoodRooster · · Score: 1

      Nothing about location setting at all... This is using China Mobile. There are no "location specific" settings for Chrome or Android that would change how search returns work. Bing returns Tianamen Square on Wikipedia, Taiwan, and others. Android isn't censoring things...

      --
      Browsing at +1 - no ACs, I ignore their posts. So refreshing!