Feeds

The SMS of DEATH - Can it crash your phone?

Bog standard mobes menaced by evil txt

Security and trust: The backbone of doing business over the internet

Many mainstream mobiles can be crashed after opening a maliciously constructed SMS message.

The so-called 'SMS of death' attacks affects mobiles from Samsung, Sony Ericsson, Motorola and LG, among others. Details of the attack, a variant of earlier attacks along the same lines, were outlined by security researchers Collin Mulliner and Nico Golde during a presentation at the Chaos Communication Congress (27C3) in Berlin.

Mulliner and Golde tested a range of feature phone for bugs in supported Java apps used to display business cards, support longer texts sent in one than one part or other features. Crashing any particular application on a phone tends to crash the phone or force its disconnection from a mobile network. The researchers set up a test bed before sending thousands of malformed messages to each device and recording the effects, if any.

Golde said that Samsung mobiles were particularly vulnerable to multi-part text messages, for example. LG phones were often bowled over by maliciously constructed MMS messages. Nokia and Sony Ericsson phones often crashed before confirming the receipt of a rogue text. This means that the network attempts to resend a killer text after a user reboots a crashed mobile. Restoring normality involves transferring a SIM card onto a non-vulnerable phone and deleting the poison pill text message.

The range of flaws ought to concern network operators as well as handset manufacturers. Mulliner said that by sending a range of attacks a miscreant might create a situation where thousands of users attempt to reconnect with the network at around the same time, straining network infrastructure and possibly causing secondary (possibly cascading) problems. Targeting attacks against a particular individual - providing it was known which model of phone he was using - might also be possible.

A lot of effort in security circles over recent months has gone into discovering flaws in Android, iPhone and other smartphones by 84 per cent of phone in use are less advanced feature phones. The two security researchers hope their research will help address this knowledge imbalance.

Both researchers called for suppliers to increase the frequency of security updates as well as making updates easier to apply. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Brit telcos warn Scots that voting Yes could lead to HEFTY bills
BT and Co: Independence vote likely to mean 'increased costs'
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Turnbull: NBN won't turn your town into Silicon Valley
'People have been brainwashed to believe that their world will be changed forever if they get FTTP'
Blockbuster book lays out the first 20 years of the Smartphone Wars
Symbian's David Wood bares all. Not for the faint hearted
Bonking with Apple has POUNDED mobe operators' wallets
... into submission. Weve squeals, ditches payment plans
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.