Update, October 2024: This flaw still hasn’t been fixed as of the 2024 U.S. presidential election cycle; see our latest article about this story:
Apple still hasn’t fixed 6-year-old “fake headlines” flaw exploitable for election interference
For nearly two years, Apple has neglected to fix a bug that enables anyone to create fake news headlines that appear to come from credible sources.
Although we covered the flaw nearly two years ago, it’s worth questioning why Apple still has not fixed it. This is especially concerning given that we’re in the final days leading up to the 2020 U.S. presidential election.
Other “Big Tech” companies (in particular Twitter, Facebook, and Google) have recently been accused of engaging in or enabling election interference. Perhaps Apple’s neglect should be examined in this context as well.
The issue comes from the way Safari handles selected text when sharing a link through Messages. On iPhone, iPad, and iPod touch, Safari lets users highlight text on a web page before tapping Share. When the link is sent through Messages, that selected text can appear in the preview, making it look like a quoted excerpt from the page.
The problem is that Safari doesn’t restrict that preview text to content that actually came from the website. A user could type their own text into a search box or another field on the page, highlight that text, and then share the page through Messages. The text they typed could then appear in the iMessage preview as though it were part of the original page.
That means someone could create a misleading preview by adding a fake headline, claim, or quote to a page before sharing it. The original website doesn’t need to contain that wording, but the Messages preview may still make it look legitimate.
Messages on macOS can also display these misleading previews if they were created and sent from Safari on an iPhone or iPad.
When MacRumors editors originally discovered this, they called the flaw “fun” and noted that it could easily be exploited for harmless pranks. However, as we pointed out in February 2019, we feel that all iMessage users should take caution, as the flaw could also potentially be used in more sinister attacks.
We warned last year that this could be exploited as a means to try to get financial investors to buy or sell stocks in a panic based on false headlines, for example.
The flaw has evidently been present in iOS for years; today we tested devices running the final version of iOS 12 (12.4.8), the current version of iOS (14.1), and even the most recent beta version of iOS (14.2 beta 4 — Update: We also tested iOS 14.2 RC). All of these versions of iOS—and corresponding versions of iPadOS—can be used to spread fake news headlines.
Since it seems like this would be an easy thing for Apple to fix (by simply disallowing user input to be part of a link preview), it’s difficult to imagine why Apple has ignored the flaw for nearly two years.
We invited Apple to comment on this story, but company representatives had not responded by publication time. If Apple provides a statement, we will update this article.
Alarmingly, the majority of news sites we tested were vulnerable to this attack.
We found that it was possible to send fake headlines that appear to be from Donald Trump’s and Joe Biden’s official campaign sites as well.
Following are screenshots showing, as a demonstration, example fake headlines that could be sent from the ABC News, CNN, Fox News, Los Angeles Times, MSNBC, and New York Times homepages.
Although most of these example headlines are a bit silly and unrealistic, one can imagine much more subtle and deceptive headlines that could influence people into changing how they might vote on election day.
Exploit demo; not seen in the wild. Watermarked to prevent abuse.
A few sites we tested, such as the the main homepages of CBS News and Forbes, seem to be resistant to the bug. More research needs to be done to determine why some sites are resistant while most are not.
It is impossible to know with any degree of certainty whether this bug has been exploited to spread misinformation to Apple users about this (or any other) election.
Although we have not yet been made aware of any real-world abuse of this exploit, we do know that this bug has been widely known for 20 months, and Apple has chosen not to do anything about it. Apple’s neglect has left ample opportunity for domestic or foreign threat actors to engage in targeted campaigns to deceive individuals in specific communities or demographics, including in swing states.
If you hear of any abuse of this bug for any unethical purposes, whether election interference or stock manipulation or otherwise, please report it to the FBI’s Internet Crime Complaint Center (IC3), and consider leaving a detailed comment on this article. You can also contact the author of this article via Twitter direct message.
You can find our original coverage of this Safari bug, from February 2019, here:
Subscribe to our e-mail newsletter and keep an eye here on The Mac Security Blog for updates to this story and all the latest Apple security news.
Follow Intego on your favorite social and media channels: Facebook, Instagram, Twitter, and YouTube (click the 
