Ask HN: What if I open on a malicious PDF AirDropped to my iPhone by a stranger?

1•scripper1•6mo ago

The title says it all. I made a mistake. I opened my iPhone to receive AirDrop photos from a stranger. I later found a PDF in Files and tried to open (after disconnecting from the internet), but Files crashed and the file disappeared. I was on 18.4. Do you think it's possible that there's a PDF exploit I've been victim to?

Comments

SilentTiger•6mo ago

Receiving data from strangers is dangerous. While we generally consider iOS to be secure, but you know that there are numerous zero-day vulnerabilities. Who knows if this PDF file might contain a script that exploits one? Therefore, avoid accepting data from strangers and, ideally, change your AirDrop settings to "Contacts Only."

scripper1•6mo ago

Yeah, that's about what I was thinking, that a zero-day would do it. Thank you. Fingers crossed.

bell-cot•6mo ago

Possible? Yes.

How valuable a target were you, vs. how valuable would an AirDrop'ed PDF exploit against 18.4 have been when this happened? High-value exploits are reserved for high-value targets.

I'd go further than SilentTiger's advice - if you're not actively using AirDrop, then turn it completely off.

scripper1•6mo ago

I’m a rando. This was on a street in New York. There’s a chance he was just spraying and praying he’d find someone who hadn’t updated iOS, but I guess I can’t know for sure. Would you know if it’s possible to check how any info has left my phone? My email, text, and iCloud look OK, and I’ve changed my passwords, but I’m not sure if it’s possible to wipe records here or communicate otherwise.

lhmiles•6mo ago

An exploit is the most likely explanation for the events you described. You could probably swap your phone for an identical model at a phone store pretty cheap

scripper1•6mo ago

Thanks. I rebooted it. For previous exploits, do you think that would be enough?

lhmiles•6mo ago

All the iOS malware I am aware of is persistent

scripper1•6mo ago

Yeesh. Thanks. I guess that makes swapping for a used phone not an option.

Show HN: A unique twist on Tetris and block puzzle

The logs I never read

How to use AI with expressive writing without generating AI slop

Show HN: LinkScope – Real-Time UART Analyzer Using ESP32-S3 and PC GUI

Cppsp v1.4.5–custom pattern-driven, nested, namespace-scoped templates

The next frontier in weight-loss drugs: one-time gene therapy

At Age 25, Wikipedia Refuses to Evolve

Show HN: ReviewReact – AI review responses inside Google Maps ($19/mo)

Why AlphaTensor Failed at 3x3 Matrix Multiplication: The Anchor Barrier

Ask HN: How much of your token use is fixing the bugs Claude Code causes?

Show HN: Agents – Sync MCP Configs Across Claude, Cursor, Codex Automatically

Hello

FSD helped save my father's life during a heart attack

Show HN: Writtte – Draft and publish articles without reformatting, anywhere

Portuguese icon (FROM A CAN) makes a simple meal (Canned Fish Files) [video]

Brookhaven Lab's RHIC Concludes 25-Year Run with Final Collisions

Transcribe your aunts post cards with Gemini 3 Pro

.72% Variance Lance

ReKindle – web-based operating system designed specifically for E-ink devices

Encrypt It

NextMatch – 5-minute video speed dating to reduce ghosting

Personalizing esketamine treatment in TRD and TRBD

SpaceKit.xyz – a browser‑native VM for decentralized compute

NotebookLM: The AI that only learns from you

Show HN: An open-source starter kit for developing with Postgres and ClickHouse

Game Boy Advance d-pad capacitor measurements

South Korean crypto firm accidentally sends $44B in bitcoins to users

Apache Poison Fountain

Web.whatsapp.com appears to be having issues syncing and sending messages

Google in Your Terminal

Show HN: A unique twist on Tetris and block puzzle

The logs I never read

How to use AI with expressive writing without generating AI slop

Show HN: LinkScope – Real-Time UART Analyzer Using ESP32-S3 and PC GUI

Cppsp v1.4.5–custom pattern-driven, nested, namespace-scoped templates

The next frontier in weight-loss drugs: one-time gene therapy

At Age 25, Wikipedia Refuses to Evolve

Show HN: ReviewReact – AI review responses inside Google Maps ($19/mo)

Why AlphaTensor Failed at 3x3 Matrix Multiplication: The Anchor Barrier

Ask HN: How much of your token use is fixing the bugs Claude Code causes?

Show HN: Agents – Sync MCP Configs Across Claude, Cursor, Codex Automatically

Hello

FSD helped save my father's life during a heart attack

Show HN: Writtte – Draft and publish articles without reformatting, anywhere

Portuguese icon (FROM A CAN) makes a simple meal (Canned Fish Files) [video]

Brookhaven Lab's RHIC Concludes 25-Year Run with Final Collisions

Transcribe your aunts post cards with Gemini 3 Pro

.72% Variance Lance

ReKindle – web-based operating system designed specifically for E-ink devices

Encrypt It

NextMatch – 5-minute video speed dating to reduce ghosting

Personalizing esketamine treatment in TRD and TRBD

SpaceKit.xyz – a browser‑native VM for decentralized compute

NotebookLM: The AI that only learns from you

Show HN: An open-source starter kit for developing with Postgres and ClickHouse

Game Boy Advance d-pad capacitor measurements

South Korean crypto firm accidentally sends $44B in bitcoins to users

Apache Poison Fountain

Web.whatsapp.com appears to be having issues syncing and sending messages

Google in Your Terminal

Ask HN: What if I open on a malicious PDF AirDropped to my iPhone by a stranger?

Comments