The iOS 11.4.1 update Apple released Monday was most notable for making it harder for law enforcement to access locked iPhones. On Tuesday, security researcher Patrick Wardle illuminated another fix. He said his fix addressed code Apple added likely to appease the Chinese government; this is the code that caused crashes on certain iDevices when users typed the word Taiwan or received messages containing a Taiwanese flag emoji.

“Though its impact was limited to a denial of service (NULL-pointer dereference), it made for an interesting case study of analyzing iOS code,” Wardle, a former hacker for the National Security Agency, wrote in a blog post. “And if Apple hadn’t tried to appease the Chinese government in the first place, there would be no bug!”

Wardle, who is now a macOS and iOS security expert at Digital Security, said he was perplexed when a friend first reported her fully patched, non-jailbroken device crashed every time she typed Taiwan or received a message with a Taiwanese flag. He had no trouble reproducing the remotely triggerable bug, which crashed any iOS application that processed remote messages, including iMessage, Facebook Messenger, and WhatsApp. Wardle did, however, find that only devices with certain region-specific configurations were affected.

The iPhone’s notorious closed nature made analyzing the bug challenging. It helped to isolating the memory locations that stored a dereferenced null pointer and a faulty instruction that caused it. Wardle also relied on the iPhone’s restore image to pull some of the code libraries. He eventually found that the crashes were being caused by code that classified messages based on emojis they contained. He also noticed that the error seemed to be triggered when iOS had country codes that included China or language settings including Chinese (his friend’s phone specified the region as the US and the language as English, followed by Chinese.)

Source: arstechnica