Feeds

Nokia 'Curse of Silence' SMS exploit uncovered

Old bug, new tricks

Using blade systems to cut costs and sharpen efficiencies

Mobile phone security vendors were rejoicing last night when it emerged that an obscure bug in an old version of the Symbian OS could allow an attacker to crash a target's mobile phone with a specially-formatted text message.

The attack has been rather dramatically branded the "Curse of Silence", and is a genuine bug that prevents incoming SMS messages being received once a specially-formatted text has been sent to the target as, demonstrated by Tobias Engel. Phones running Nokia's S60 interface, versions 2.6 to 3.1, can be attacked in this way, and some models need a hard reset to recover.

The bug comes courtesy of the way that SMS was designed to integrate with internet email services: no one really understood what the relationship between email and SMS would eventually be, and in the early days there were many email-to-SMS gateway services. Short messaging was seen as the ideal way of delivering email alerts, but the combination of price and increasing spam levels paid to most of them, especially as spam filtering was unknown at the time.

But not before the 3GPP, the standards-setting body for the cellular industry, had stated that messages could be identified as "Internet Electronic Mail", and should be displayed as such when received. Prior to version 2.6 the S60 messaging client made no attempt to display such messages properly, but with 2.6 the messages got broken into "sender" and "message body", and (it turns out) if the "sender" field is more than 32 characters then the messaging client falls down.

Security vendors have been looking for something against which to protect mobile-phone users for a while; mobile phone viruses are little more than proof-of-concept experiments, and when a real security issue comes up it's on embedded platforms that the security firms can't protect anyway. So F-Secure proudly states that its customers are protected from the "Curse of Silence", though even Vice President Samu Konttinen admits that at worst "there is a risk of it becoming a nuisance".

Recent handsets, such as the N85, N96, 6650, are using S60 Feature Pack 2 and are therefore immune. However, if you've got one of the earlier models and tech-literate enemies who know your number and enjoy irritating you, then you could be at risk. ®

HP ProLiant Gen8: Integrated lifecycle automation

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Auntie remains MYSTIFIED by that weekend BBC iPlayer and website outage
Still doing 'forensics' on the caching layer – Beeb digi wonk
Major problems beset UK ISP filth filters: But it's OK, nobody uses them
It's almost as though pr0n was actually rather popular
Microsoft unsheathes cheap Android-killer: Behold, the Lumia 530
Say it with us: I'm King of the Landfill-ill-ill-ill
All those new '5G standards'? Here's the science they rely on
Radio professor tells us how wireless will get faster in the real world
Apple orders huge MOUNTAIN of 80 MILLION 'Air' iPhone 6s
Bigger, harder trouser bulges foretold for fanbois
US freemium mobile network eyes up Europe
FreedomPop touts 'free' calls, texts and data
'Two-speed internet' storm turns FCC.gov into zero-speed website
Deadline for comments on net neutrality shake-up extended to Friday
Oh girl, you jus' didn't: Level 3 slaps Verizon in Netflix throttle blowup
Just hook us up to more 10Gbps ports, backbone biz yells in tit-for-tat spat
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.