Risk
12/31/2008
12:57 PM
Connect Directly
RSS
E-Mail
50%
50%

'Curse Of Silence' Exploit Found For Nokia Handsets

A single malformed SMS message can prevent some handsets from sending and receiving further SMS and MMS messages, security researchers warn.

Security researchers made public an exploit for many Nokia S60 handsets that enables remote attackers to disable the ability to send and receive text messages.

Research group F-Secure said the exploit, dubbed the "Curse of Silence," is a denial-of-service attack that can crash the targeted phone's SMS system, but the phone retains other functionality. The exploit was found by researcher Tobias Engel, and it was made public at the Chaos Communication Congress event Monday.

"Performing the attack does not require technical expertise, and due to this, there is a risk of it becoming a nuisance," said Samu Konttinen, VP of F-Secure's mobile business unit, in a statement. "We have already provided a security update to this threat to our F-Secure Mobile Security customers."

The group said attackers can specially format an e-mail to be sent as an SMS by setting the message's Protocol Identifier to "Internet Electronic Mail." If the message contains more than 32 characters, certain S60 devices will not be able to receive other SMS or MMS messages. Depending on the handset, the exploit can damage the targeted device with a single message, F-Secure said.

The exploit can potentially affect millions of handsets, including UIQ devices and handsets running S60 2nd Edition Feature Packs 2 and 3, S60 3rd Edition, and 3rd Edition Feature Pack 1. The malicious message can be sent from almost any device capable of sending SMS as "Internet Electronic Mail."

Once infected, the phone has to be factory-reset to restore text message capabilities. F-Secure does sell mobile security products that can protect customers from this, but the company said it made Nokia and multiple GSM carriers aware of the exploit long before it was publicly disclosed.

Nokia has not responded to inquiries as of press time, but this exploit could possibly receive a patch through an over-the-air firmware update. Additionally, the exploit could be spotted and stopped at the carrier level by blocking messages with the malicious formatting.

The video below also explains the exploit.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-5142
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.

CVE-2010-5302
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb before 1.15 as of 20100908 (r88), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.

CVE-2010-5303
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in the displayError function in timthumb.php in TimThumb before 1.15 (r85), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to $errorString.

CVE-2014-0965
Published: 2014-08-21
IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted SOAP response.

CVE-2014-3022
Published: 2014-08-21
IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted URL that triggers an error condition.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.