iOS 27: “Malicious link blocked” for legitimate call forwarding codes

Privacy & Security General
Guglio95 OP
Created
Replies 5
Boosts 2
Views 2.0k
Participants 4

Hello!

I develop a voicemail app service and I use MMI codes to let users enable/disable call forwarding to their voicemail number.

For example, the app opens the Phone app with a code such as:

**21*<phone number>#

This is expected behavior and is required for the service to work.

However on iOS 27, those links are now blocked with a “Malicious link blocked” warning, saying that the link may forward incoming calls/messages.

Is there any supported way for apps with a legitimate use case like this to request an exemption, or otherwise avoid this warning?

Answered by DTS Engineer in 907730022

This issue should now be addressed.

Please try this against on iOS 27.1 and, if you're still having problems, file a new bug and then post that bug number back here.

__
Kevin Elliott
DTS Engineer, CoreOS/Hardware

Replies  5
Boosts 2
Views  2.0k
Participants  4
DTS Engineer OP
Apple
the app opens the Phone app with a code such as

Just to be clear, you open the Phone app by opening a tel URL, right?

If so, I’m not surprised by this change. Documentation on the tel URL scheme — well, on Apple’s support for the tel URL scheme — is thin on the ground, but I believe that Apple URL Scheme Reference > Phone Links is still the most up-to-date thing. And that doc says:

To prevent users from maliciously redirecting phone calls or changing the behavior of a phone or account, the Phone app supports most, but not all, of the special characters in the tel scheme. Specifically, if a URL contains the * or # characters, the Phone app does not attempt to dial the corresponding phone number.

Now, that’s a pretty hard-line stance, and the actual implementation has bounced around a bit over the years, but I’ve seen numerous problems in this space over the years.

those links are now blocked with a “Malicious link blocked” warning

So, completely blocked? That is, the user has no option to acknowledge this warning and continue anyway?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
Guglio95 OP

Screenshot attached, there's no option to acknowledge and continue anyway

DTS Engineer OP
Apple

there doesn’t seem to be any option for the user to acknowledge the warning and continue

OK.

Sadly, I don’t have any good answers for you. My only suggestion is that you file a bug about this. Make sure to give a high-level explanation of what your product does, and then explain the impact of this change of behaviour.

Please post your bug number, just for the record.

ps As you’ve learnt, it’s better to reply as a reply, rather than in the comments. See Quinn’s Top Ten DevForums Tips for more about that, and for a bunch of other titbits.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

DTS Engineer OP
Apple
Recommended

This issue should now be addressed.

Please try this against on iOS 27.1 and, if you're still having problems, file a new bug and then post that bug number back here.

__
Kevin Elliott
DTS Engineer, CoreOS/Hardware
arho OP

Hello, we see the same on our app. We develop an accessibility app that captions phone calls and we noticed the same "Malicious Link Blocked" popup when iOS 27 first rolled out.

Now on iOS 27.1 we noticed the popup has changed to "Call Forwarding Link Blocked" but the core of the issue remains the same, call forwarding is prevented through our app. I've filed bug FB25102183 - we hope this issue gets resolved quickly, as it creates a lot of friction between users and our accessibility tools.