Google reveals fistful of flaws in Apple's iMessage app

Image caption, Apple's iMessage service allows users to send texts, photos and videos to each other
  • Author, Leo Kelion
  • Role, Technology desk editor

A team of bug-hunters at Google have shared details of five flaws in Apple's iMessage software that could make its devices vulnerable to attack.

In one case, the researchers said the vulnerability was so severe that the only way to rescue a targeted iPhone .

Another example, they said, could be used to copy files off a device without requiring the owner .

Apple released fixes last week.

But the researchers said they had also flagged a sixth problem to Apple, which had not been rectified in the update to its mobile operating system.

Skip Twitter content
Allow Twitter content?

This article contains content provided by Twitter. We ask for your permission before anything is loaded, as they may be using cookies and other technologies. You may want to read Twitter and before accepting. To view this content choose 'accept and continue'.

Warning: Third party content may contain adverts

End of Twitter content

"That's quite unusual," commented Prof Alan Woodward, a cyber-security expert at the University of Surrey.

"The reputation of the Google Zero team is such that it is worth taking notice of."

The Project Zero team was established in July 2014 to . It has previously alerted Microsoft, Facebook and Samsung, among others, to problems with their code.

Urgent update

Apple's could give hackers a means to crash an app or execute commands of their own on recent iPhones, iPads and iPod Touches if they were able to discover it.

Apple has not commented on this specific issue, but has urged users to install the new version of iOS, which addresses Google's other discoveries as well as a further range of glitches and threats.

"Keeping your software up to date is one of the most important things you can do to maintain your Apple product's security," it said in a statement.

News site ZDnet - - noted that the level of detail shared by Google about the other bugs could be enough to let bad actors craft exploits to take advantage of them. Users should download iOS 12.4 "with no further delay," it added.

One of the two Google researchers involved - Natalie Silvanovich - intends to share more details of her findings at .

The synopsis of her talk also promises it will cover potential vulnerabilities in Apple's Visual Voicemail service - which allows users to select specific recordings - and its Mail app.

One of Apple's own security chiefs will also be attending the conference to give a separate presentation, which promises to go "behind the scenes of iOS and Mac security".