WTF

Why iMessage swallows voice messages with Ben & Jerry's

Apple's pedantic spyware protection apparently leads to iPhones not displaying some audio messages.

listen Print view
Messages app on the iPhone

(Image: oasisamuel / Shutterstock.com)

3 min. read

If you ask for an ice cream from Ben & Jerry's via iMessage, you may be left empty-handed. An obscure iPhone bug can ensure that some audio messages remain completely hidden from the recipient. At the same time, the sender receives no indication that his message has not been received. The podcast Search Engine drew attention to this seemingly bizarre bug in the latest episode after listeners pointed out the problem.

Ben & Jerry's did not end up on a blacklist, but all iMessage audio messages in which a product name or manufacturer is mentioned with an ampersand (ampersand) seem to be lost. In the USA in particular, there are several well-known candidates — from gun manufacturer Smith & Wesson to bookseller Barnes & Noble and restaurant chain Dave & Buster's. In Europe, this includes Villeroy & Boch, but for many other companies the & is only used in the long form, which is probably only rarely mentioned in voice messages.

Videos by heise

The error apparently occurs entirely on the recipient's iPhone: The voice message is received properly there, but is not displayed. Mac & i was also able to reproduce the behavior on one device – at least sometimes.

The problem is apparently that Apple's automatic transcription of the voice message inserts an ampersand into the text without masking it correctly for HTML/XHTML. As soon as Apple's “MessagesBlastDoorService” tries to parse the transcript, an error occurs because it only contains & and not &, according to an analysis by developer Guilherme Rambo.

“Blast Door” is a protection function retrofitted by Apple to make targeted spyware attacks via text message more difficult. The anti-spyware system then aborts the process, the audio message is therefore not displayed and remains hidden from the recipient.

This ultimately shows that Blast Door is working correctly, notes Rambo, as the protection system is designed precisely to prevent incorrectly formatted messages from being displayed in the first place. Bad parsers would probably still accept the incorrectly formatted XHTML, writes the developer – but it is precisely this kind of “leniency when processing data formats” that leads to security problems. It remains to be seen when Apple will improve the transcription of such brand names with commercial and, in any case, the bug still seems to exist in iOS 18.5.

Empfohlener redaktioneller Inhalt

Mit Ihrer Zustimmung wird hier ein externer Preisvergleich (heise Preisvergleich) geladen.

Ich bin damit einverstanden, dass mir externe Inhalte angezeigt werden. Damit können personenbezogene Daten an Drittplattformen (heise Preisvergleich) übermittelt werden. Mehr dazu in unserer Datenschutzerklärung.

(lbe)

Don't miss any news – follow us on Facebook, LinkedIn or Mastodon.

This article was originally published in German. It was translated with technical assistance and editorially reviewed before publication.