Subscribe

Viral shortlink crashes Apple devices

Michelle Avenant
By Michelle Avenant, portals journalist.
Johannesburg, 26 Jan 2016
Mischievous Twitter users are click-baiting their followers into opening shortlinks to crashsafari.com.
Mischievous Twitter users are click-baiting their followers into opening shortlinks to crashsafari.com.

Mischievous social network users are passing around a Web site link that crashes users' Apple devices.

Crashsafari.com, it is speculated, runs javascript code that overloads the user's address bar with an infinite, self-generating string of numbers and text, forcing iPhones and iPads to reboot after about 20 seconds, as they struggle to handle the site's code.

Although users of Apple's mobile devices and its Safari browser appear to be the worst-affected by the bug, its havoc is not limited to these groups. The bug also causes Safari to freeze or crash on Mac desktops, and Chrome on PCs and Android devices to crash or slow down significantly.

While the Safari-crashing Web site's name is an obvious giveaway, the link can be simply disguised with a URL shortener, to the delight of social network pranksters who use click-baiting tweets or posts to lure unsuspecting users into crashing their devices. "Don't be trolled by this iPhone-crashing link meme... or you may suffer a fate worse thank rickrolling," warns Wired.

While the bug can annoy users by wasting a minute or so of their time, it does not pose any long-term harm, as it is a superficial "denial of service" attack and cannot be used to run commands on users' machines.

Chrome or desktop users can stop the bug by forcibly shutting down their browsers. iPhone and iPad users may have a slightly bigger challenge on their hands, as they may have to switch their devices onto flight mode as soon as they start up again, to kill the malicious page before Safari reloads it.

Wired reports the bug was developed by 22-year-old Matthew Bryant, a San Francisco resident who works in the application security industry. Bryant says he stumbled upon the bug independently while testing how browsers handle "odd code that gets thrown at them".

Share