Original URL: https://www.theregister.com/2011/03/21/sms_of_death_explained/
How to slay a cellphone with a single text
SMS of Death explained
Posted in Security, 21st March 2011 04:00 GMT
Attacks that crash most older cellphones are frequently compounded by carrier networks that send booby-trapped text messages to the target handset over and over. In other cases, they're aided by a “watchdog” feature embedded in the phone, which takes it offline after receiving just three of the malformed messages.
The so-called SMS of death attacks were unveiled late last year at a hacker conference in Berlin. They use special binary characters and overflowed headers to temporarily crash most older models made by manufacturers including Nokia, Samsung, Sony Ericsson, LG, Motorola, and Micromax. Carrier networks often aggravate the attacks by bombarding the target with the same malicious message, making them an inexpensive way to take a phone completely offline.
“With this bug, you can basically shut down a phone with one SMS and let the network do the retransmission all the time,” Collin Mulliner, a Ph.D. candidate at the Berlin Institute of Technology, told The Reg recently. “For very cheap, you can have the network attack the phone for you.”
The retransmission happens as a result of the way most carrier networks are designed. When they send SMS, or short message service, texts, they cache the message until the phone responds with an acknowledgment indicating it has been properly received. If the answer isn't transmitted, the network will resend the message for hours or days at a time, disabling the phone in the process.
Even in cases when the messages aren't resent, Nokia phones come equipped with a feature dubbed the Watchdog, which is designed to protect a phone by shutting it down after receiving three malformed messages. The SMS causes the Nokia screen to go white and then reboots the phone, causing it to disconnect from the network. Sending the message while a call is in progress will terminate the conversation.
Sending the message three times in close succession invokes the Watchdog to shut down the device. The bug affects virtually all feature phones shipped by Nokia prior to 2010, said Mulliner, who presented updated findings earlier this month at the CanSecWest security conference along with Nico Golde, a Berlin Institute of Technology student who worked on the project for his Master's thesis.
The SMS used to crash Nokia phones was described as an 8-bit class 0 (Flash SMS) with certain TP-UD payload. Messages with different specifications can be used to take out handsets made by other manufacturers.
Feature phones may have lost much of their cachet to smartphones over the past few years, but they are still relied upon by almost 80 percent of the world's mobile phone users, the researchers said.
The attacks could be used in targeted attacks against social enemies and business rivals, but the researchers say there's also the potential for the vulnerabilities to be exploited in a more widespread fashion by using bulk SMS services, smartphone-based botnets, or SS7, a series of telephony signaling protocols the researchers said are becoming increasingly accessible to companies and individuals.
Feature phone fuzzer
There's virtually no software for performing vulnerability analysis on feature phones, so the researchers created a crude fuzzer of sorts for monitoring the effect various SMS messages had on each handset model. They ordered dozens of used phones on eBay and connected them to their own 2G network that cost them about €3,000. To avoid running afoul of any laws, they isolated the network inside a faraday cage.
The researchers then subjected the phones to no fewer than 120,000 different variations of SMS messages and logged each response, which usually was limited to an acknowledgment, an error message or no response at all.
“If it doesn't arrive, we knew that something really went wrong, because there should be either an acknowledgment or an error.” Golde said.
They quickly built up a war chest of SMS texts that caused problems and did further analysis to isolate the ones that caused the handsets to crash.
Many of the SMS death messages contain special binary characters, while others have header information that is longer than specifications allow. In still other cases, the malicious messages had faulty information indicating they had been broken up into 10 pieces when in fact there were only seven, five, or some different number of pieces.
The worst of the malicious texts had the effect of creating disruptions that were hard or impossible to recover from. In some cases, the only way to break out of a repeated crash cycle was to remove the phone's SIM card and put it in a handset that wasn't vulnerable to the attack. In the most extreme cases, the attacked phones could no longer be reflashed and had to be put out to pasture.
None of the smartphones the researchers tested were susceptible to the messages. It turns out the common weakness among the less advanced phones was their simplicity.
“Feature phones normally run on just one chip, which runs all the radio communications and the built-in applications,” Mulliner explained. “So if we get just one small part of the phone to misbehave or crash or do something strange, probably the whole phone is going to be crashing, rebooting or doing weird things. Just by finding small bugs, you probably have a large impact.” ®