This 'Shrug Bug' On iOS Signal Messaging App Multiplies Messages Uncontrollably

iOS 14, Signal app 'Shrug bug'

Messaging apps must work on the many languages users speak, and must work even when users use strings or unique characters.

But software bugs in general can go unnoticed for quite some times before the public spotted them. And when that happens, some can cause a stir, or even create an annoying 'Easter Egg'.

An example of this is shown by security researcher Arrigo Triulzi.

In a bug report he filed on GitHub, Triulzi noted that sending a 'shrug' using the ¯\_(ツ)_/¯ symbol can make the message it is contained, to multiply uncontrollably.

The bug that was found on the Signal app on older iPhones, can cause text messages to repeat four times.

And if the chat window is closed to then reopened, the message could again multiply its content four times. Doing this many times would make the message grow longer and longer, causing older iPhones to slow down.

Making things worse, if the message that has the shrug symbol is pasted in a group conversation, the multiplication effect is much faster, as it appears that the symbol is replicated 4x per member of the group.

And if both the sender and the recipient are on a vulnerable iPhone, the shrug symbol will also multiply faster, because the symbol appears to multiply on both the sender's and the recipient's iPhone,

Eventually, too many ¯\_(ツ)_/¯ symbol symbols would create a local denial of service condition, because the bug simply depletes the iPhone's memory.

Triulzi said that the shrug bug affects iPhones 6S, 7, 8 and 8 Plus running iOS 14

Newer iPhones such as iPhone 11 lineup and the 2020 iPhone SE are not affected, Triulzi wrote.

Triulzi said that the shrug bug appears to be related to a particular set of the Unicode character encoding standard, possibly linked to the parenthesis in ¯\_(ツ)_/¯‬. This is because deleting the message with ¯\_(ツ)_/¯‬ immediately stops the replication of the string.

It should be noted though, that not all older iPhones running iOS 14 are affected.

In tests by others, the results were somewhat mixed.

For example, there is a case where the ¯\_(ツ)_/¯‬ symbol did not repeat, nor on the receiving iPhone initially.

There is also a case where using the Signal desktop app on macOS to respond with a ¯\_(ツ)_/¯‬ to the messages sent to iOS, can cause the text to repeat itself on iPhone 11, but not on the iPhone 8.

While the ¯\_(ツ)_/¯‬ text showed up in the conversation on the iOS app, the string can cause the text entry field in the macOS Signal desktop app to disappear. Restarting the desktop app can bring back the entry filed, and fixed the issue.

Signal app on iOS 14, shrug bug
The 'shrug bug' on the Signal app on iOS 14 could repeat shrugs multiple times until denial of service. (Credit: Nvidia)

This case isn't the first that involves characters or strings that crash Apple devices.

The most recent this 2020, would be “text bomb” on iOS.

Before patched, the bug could be triggered using a specific character in Sindhi, the official language spoken by the Sindhi people in the Pakistani province of Sindh.

At that time, iPhone users could have their mobile devices crash when receiving notification that have the Sindhi character.

And before that, was the Telugu character that crashed iPhones.

The bug crashed all apps from Messages, Safari web browser, to third-party apps like Facebook Messenger and WhatsApp. when the character in the language in question was received in a message, encountered in a document, or pasted into a text field.

Published: 
10/10/2020