Sunbird has relaunched its iMessage app for Android users nearly three years after security issues forced the company to pause the service in 2023.
The app is now available on the Google Play Store and allows Android users to access iMessage conversations, including blue-bubble messages and group chats with iPhone users. Sunbird has also combined iMessage with Google Messages, RCS and SMS/MMS in the same application.
The company says the new version has been rebuilt with changes to how messages, Apple ID credentials and media are handled. Sunbird claims messages are encrypted on the Android device before they leave it, protected while travelling through its infrastructure and encrypted at rest using AES-256. It also says Apple ID passwords are used once to establish an iMessage session and then deleted.
The relaunch comes after researchers identified serious security problems in Sunbird's earlier implementation, including the transmission of Apple ID credentials over an unencrypted HTTP connection and access to messages and media stored through Firebase. Those findings led to the removal of Nothing Chats, an iMessage app developed by Nothing using Sunbird's technology, and Sunbird subsequently paused its own service.
Sunbird returns to the Google Play Store
Sunbird Messaging announced on August 5 that its Android application was open to all users through Google Play following an early-access period. The company said more than 181,000 people had signed up before the public launch.
The application is designed to allow Android users to participate in iMessage conversations without owning an iPhone, Mac or another Apple device. Sunbird says users can appear in blue-bubble conversations on iPhones and participate in iMessage group chats through the Android application.
The new app also acts as a unified messaging platform. Instead of limiting the application to iMessage, Sunbird has brought iMessage, Google Messages through RCS and SMS/MMS into one inbox.
The application now includes a Primary and Secondary inbox. Sunbird says the Primary section is intended for important conversations, while less important messages can be placed in Secondary. Users can control how their conversations are organised.
The company has also said it plans to add WhatsApp and Facebook Messenger support later in 2026.
The service is available with a 14-day free trial, after which Sunbird charges $2.99 per month or $24.99 annually.
What happened to Sunbird in 2023
Sunbird's return follows a security incident that brought its earlier service offline in November 2023.
The issue became widely known after Nothing announced Nothing Chats, an Android application that used Sunbird's technology to provide iMessage functionality on the Nothing Phone (2). Users were required to provide their Apple ID credentials to connect the service to iMessage.
Security researchers then examined the application and identified several problems with how the service handled authentication and user data.
One of the issues involved Apple ID credentials being transmitted to Sunbird's servers over HTTP. Because HTTP does not encrypt the connection, the credentials could potentially be intercepted while being transmitted.
Researchers also found that messages and other user data were being sent to and stored through Firebase without encryption. An investigation by 9to5Google found that researchers could use insecurely transmitted JSON Web Tokens to access Sunbird's Firebase database and view messages and files belonging to users.
The exposed information was not limited to text messages.
Researchers reported that the database contained media files including images, videos, PDFs and audio files. More than 630,000 media files were reportedly stored through Sunbird's Firebase infrastructure at the time. Researchers also found vCards containing information such as names, phone numbers and email addresses.
The problem also involved Sentry, an error-monitoring service. Researchers reported that messages and attachments were being sent to Sentry in plaintext, meaning information intended to be part of private conversations could appear in an error-reporting system.
These findings conflicted with Sunbird and Nothing's earlier statements about encryption. The companies had presented the service as providing end-to-end encryption, but researchers found that data could be accessed through the systems supporting the application.
Nothing removed Nothing Chats from the Google Play Store less than 24 hours after its launch. The company said it was delaying the application while working with Sunbird to address the security problems. Sunbird also paused its own service shortly afterward.
Sunbird says the new architecture handles data differently
For the relaunched application, Sunbird says it has changed how messages and authentication information are processed.
According to the company's security documentation, messages are encrypted on the user's phone before they leave the device. The data is then
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: