Sunbird, an app that’s designed to ship iMessages to Android units, has been quickly shut down because of safety issues. Sunbird this week despatched out a notification to customers letting them know in regards to the shutdown (by way of 9to5Google).
Sunbird stated that it was investigating safety points that had been raised by the Nothing Chats iMessage app, and shortly after, advised customers that Sunbird utilization had been paused. “We are going to replace you once we are able to proceed,” learn the notification.
The Sunbird app was first launched in late 2022, and it has been restricted to clients that signed up for the waitlist. The Sunbird web site describes the app as unifying “the world’s hottest messaging apps” right into a single app, with help for iMessage, SMS/MMS, Fb Messenger, and WhatsApp.
Utilizing Sunbird on an Android gadget allowed Android customers to ship messages to iPhone customers that have been delivered as iMessage “blue bubbles” moderately than inexperienced textual content messages. The app claimed to have end-to-end encryption and confidential messaging for these Android to iPhone conversations, however these claims have been in query, resulting in the pause in service.
Final week, Sunbird teamed up with smartphone producer Nothing to launch “Nothing Chats,” a messaging app that promised iMessage compatibility. The high-profile announcement led to a deep dive into how Nothing Chats labored and the way Sunbird, because the spine for the function, functioned.
The Nothing Chats app required customers to log in with their Apple ID, certainly one of many purple flags raised over Sunbird’s safety. Textual content.com appeared into how Sunbird works, and located that it’s sending a person’s Apple ID credentials to a Sunbird server, the place these credentials are authenticated utilizing a digital machine operating macOS. Apple ID credentials have been being despatched over HTTP, which is unencrypted.
Nothing ended up pulling the Nothing Chats app from the Google Play Retailer lower than 24 hours after it was introduced, however Sunbird insisted that its service was safe and that Apple ID credentials and messages have been “encrypted always.” This turned out to be inaccurate, and there are vulnerabilities that would permit an attacker to intercept all Sunbird messages and media attachments. Sunbird workers additionally had direct entry to a platform that saved message contents, contact info, and attachment URLs. 9to5Google found that Sunbird is storing greater than 630,000 media information like photos, movies, and PDFs from its customers.
Texts.com ended up releasing a proof-of-concept app demonstrating how simple it was for iMessage conversations despatched by way of Sunbird and Nothing Chats to be intercepted and seen as a result of the content material was being despatched in plain textual content.
Nothing stated that the Nothing Chats app has been pulled “till additional discover” as it really works with Sunbird to “repair a number of bugs,” however Sunbird has been quiet in regards to the state of affairs other than the notification despatched out to customers. As Ars Technica factors out, Sunbird’s preliminary response to the safety issues doesn’t appear to have come from “a reliable developer,” elevating questions on Sunbird’s skill to deal with the safety issues.
Present Sunbird and Nothing Chats customers are suggested to vary their Apple ID passwords, take away the apps, and comply with further steps to take away their information. If the apps are reinstated, it is suggested that customers don’t obtain them.