Industrious Users Performing iMessage Denial-of-Service Attacks

Here's the good news: Performing a denial-of-service attack on a person's iMessage account doesn't seem to be a widespread issue at this point. The bad news, however, is that it's certainly possible. Just ask some of the iOS developers who, for reasons unknown, have had their iMessage apps spammed with messages and notifications as of late.

According to a report by The Next Web's Matthew Panzarino, an individual (or likely group of individuals) appear to have gotten their hands on the various bits of information needed to send iMessages to the affected users' personal accounts — likely, the email addresses or phone numbers associated with their Apple IDs.

From there, it's apparently not all that difficult to code up an AppleScript that can absolutely bombard a victim's iMessage account with message, after message, after message – a kind-of smartphone variant of the fabled email bomb from years ago. Since Apple doesn't allow users to block individual email addresses or phone numbers from sending iMessages, there's no way to prevent the onslaught.

"So apparently iMessage DDoS spam is a thing? This is the kind of thing that could be a serious problem since Apple have no blacklisting," tweeted iOS developer Steve Troughton-Smith.

But, to borrow the words of late Apple co-founder Steve Jobs, there's just one more thing.

A more insidious version of the attack blasts victims with enormous blocks of Unicode text that completely crash iMessage when it attempts to render the messages. This effectively locks a person out of the iMessage app unless he or she employs some creative workarounds to delete the message thread.

From there, users don't have much recourse aside from disassociating their email address from iMessage entirely if they want to avoid future spam attacks. Good luck if an attacker has the victim's phone number instead: Until Apple offers some kind of solution for the spam, disabling iMessage entirely seems to be the best – and only – way to effectively stop the denial-of-service attacks in that case.