7 ms·

This brings back old memories from hardening the sms/text parsers of feature phones of yesteryear. There it wasn’t entirely uncommon that when you sent a malfo

by rixrax 7y ago

This brings back old memories from hardening the sms/text parsers of feature phones of yesteryear. There it wasn’t entirely uncommon that when you sent a malformed sms-deliver PDU (e.g. text message) to the phone and crashed parser that tried to decode it, it took also the phone down before it could ack the message back to SMSC. Which of course meant that as soon as phone was turned on and it registered to network, that same message was redelivered (crashing it again) for as far as the network was concerned, it was never received by the mobile. Until the time that message either expired in the SMSC in few days, or you switched you sim to a non-vulnerable mobile to receive the message. Good times.

askl 7y ago
There was a nice talk about this a few years ago at the CCC congress. https://media.ccc.de/v/27c3-4060-en-attacking_mobile_phones https://media.ccc.de/v/27c3-4060-en-attacking_mobile_phones http://www.ngolde.de/sms/smsodeath_mulliner_golde_cansecwest2011.pdf http://www.ngolde.de/sms/smsodeath_mulliner_golde_cansecwest...
- tambre 7y ago
  > [...] at the CCC congress Your "congress" is redundant because CCC=Chaos Communication Congress.
  - nathancahill 7y ago
    ATM machine
  - Natanael_L 7y ago
    CCC = chaos computer club. They might also use it for other meanings, but referring to the actual original name makes absolute sense.
pcdoodle 7y ago
Back in the day AOL parsed HTML for it's instant messages, a <font size=9999999999999999999999> would blue screen any client running windows. It was quite easy to empty chat room(s) using this.
- pts_ 7y ago
  Hahaha on Yahoo we called it booting.
  - yjftsjthsd-h 7y ago
    Doesn't that date back to IRC?
    - iamtheworstdev 7y ago
      irc has kicking / banning and kickbanning.. not necessarily booting (unless you used it as lingo) and certainly not HTML parsing.
      - papageek 7y ago
        /ping +++ATH0
        kabdib 7y ago
        There's supposed to be a delay in the Hayes protocol to prevent this kind of thing, but many "Hayes compatible" implementations didn't implement that part (through ignorance? working around a patent?), so this trick would work pretty well . . .
        LocalH 7y ago
        Patent issues. https://en.wikipedia.org/wiki/Time_Independent_Escape_Sequence https://en.wikipedia.org/wiki/Time_Independent_Escape_Sequen... Hayes themselves would even insert the sequence in press releases posted to Usenet. https://groups.google.com/forum/#!topic/comp.dcom.modems/Vr2aXl8jU6g https://groups.google.com/forum/#!topic/comp.dcom.modems/Vr2...
      - danielhlockard 7y ago
        IRC totally did have "booters" back in the old day, that would cause mass disconnects.
waterhouse 7y ago
Fascinating problem. Since I have Faraday cages on the mind today (not that I know much more than ~10 minutes of reading)... simply isolating the phone from all signals would block both the message and any software update, so that doesn't work. But what if you attached it to wifi but not to the cell network? Either have the wifi router (itself having a wired connection) and the phone in the same shield; or, I guess, people say Faraday cages target certain wavelengths, so if wifi and cell tower are sufficiently different, maybe you could have a selectively blocking Faraday cage. Would that have been workable? (non-EE here)
- gbrown 7y ago
  To answer your question about selectively blocking, just put the wifi router inside the cage. To the point though, feature phones didn't have WiFi generally. I'm also not sure how doing so would fix the issue, unless you could block the number perhaps.
  - sorenjan 7y ago
    Feature phones also didn't have OTA updates. I remember taking my phones to service centers to get the latest software flashed. Later on you could flash it yourself with a cable to your PC, browsing esato.com for new versions.
baybal2 7y ago
Yes, Sony Ericsson A200 had a bug in SMS picture decoding (old, monochorme, pre-MMS one) which was easily craftable into an exploit if carriers were allowing multipart SMS. Guess what cell carriers did back then? Yes, they disabled multipart SMS
- egorfine 7y ago
  What else could they do?
  - kortilla 7y ago
    Filter. Spam detection wasn’t exactly a novel idea back then either.
    - rayiner 7y ago
      With what? Especially back then, I wouldn’t assume there is anything with a programmable CPU in the data path that can inspect and filter things at line rate.
      - itsokandmay 7y ago
        If payload "d3structiv3bytes" else approve.
      - pjmlp 7y ago
        SMS are sent between devices via a message gateway server.
jimktrains2 7y ago
> This brings back old memories from hardening the sms/text parsers of feature phones of yesteryear. > There it wasn’t entirely uncommon that when you sent a malformed sms-deliver PDU (e.g. text message) to the phone and crashed parser that tried to decode it, it took also the phone down before it could ack the message back to SMSC. By yesteryear do you mean the present and feature phones do you mean current android phones? Some models are still vulnerable to a text-of-death. https://poetengineer.postach.io/post/deleting-the-text-of-death-on-android https://poetengineer.postach.io/post/deleting-the-text-of-de... not my blog, but the same problem happened with my mother in law's phone. The phone becomes unusable because of a stream of org.android.phone application has stopped messages and the only thing to do is use adb to delete all texts, until it comes in again. I was never able to pin down the exact problem. Edit: Sorry, I didn't mean to come off as snarky, but I just wanted to 1) point out that there are still issues with decoding SMS and MMS messages, even in some modern phones and 2) provide a link to anyone who encounter the same issue as it was very frustrating for my MiL and very frustrating until I figured out I could just wipe all SMSes with adb.
stcredzero 7y ago
This brings back old memories from hardening the sms/text parsers of feature phones of yesteryear. They were indeed hardened? Do tell. I've suggested that the iPhone be hardened against rendering crashes, here on HN. The immediate reaction is to downvote me, then reply, "undefined behavior must crash the process." That's pretty glib and shortsighted, however. It took me just a few seconds to think of a solution. Have one process write the messages in a log file. This process also supervises the second process. The 2nd process renders the messages. If the 2nd process keeps crashing on the same message, the 1st process marks that message as a problem, and the user can be prompted to send the hex dump of the message for diagnostic purposes. (So if it's spicy, they can say no.) The fact that such a basic function of the iPhone can be remotely vanished, requiring a reboot, is a pretty glaring hole. What's even worse, is that highly paid SV programmers would shrug their shoulders so easily.

by rixrax 7y ago

askl 7y ago

There was a nice talk about this a few years ago at the CCC congress. https://media.ccc.de/v/27c3-4060-en-attacking_mobile_phones https://media.ccc.de/v/27c3-4060-en-attacking_mobile_phones http://www.ngolde.de/sms/smsodeath_mulliner_golde_cansecwest2011.pdf http://www.ngolde.de/sms/smsodeath_mulliner_golde_cansecwest...

tambre 7y ago
> [...] at the CCC congress Your "congress" is redundant because CCC=Chaos Communication Congress.
- nathancahill 7y ago
  ATM machine
- Natanael_L 7y ago
  CCC = chaos computer club. They might also use it for other meanings, but referring to the actual original name makes absolute sense.

pcdoodle 7y ago

Back in the day AOL parsed HTML for it's instant messages, a <font size=9999999999999999999999> would blue screen any client running windows. It was quite easy to empty chat room(s) using this.

pts_ 7y ago
Hahaha on Yahoo we called it booting.
- yjftsjthsd-h 7y ago
  Doesn't that date back to IRC?
  - iamtheworstdev 7y ago
    irc has kicking / banning and kickbanning.. not necessarily booting (unless you used it as lingo) and certainly not HTML parsing.
    - papageek 7y ago
      /ping +++ATH0
      - kabdib 7y ago
        There's supposed to be a delay in the Hayes protocol to prevent this kind of thing, but many "Hayes compatible" implementations didn't implement that part (through ignorance? working around a patent?), so this trick would work pretty well . . .
        LocalH 7y ago
        Patent issues. https://en.wikipedia.org/wiki/Time_Independent_Escape_Sequence https://en.wikipedia.org/wiki/Time_Independent_Escape_Sequen... Hayes themselves would even insert the sequence in press releases posted to Usenet. https://groups.google.com/forum/#!topic/comp.dcom.modems/Vr2aXl8jU6g https://groups.google.com/forum/#!topic/comp.dcom.modems/Vr2...
    - danielhlockard 7y ago
      IRC totally did have "booters" back in the old day, that would cause mass disconnects.

waterhouse 7y ago

Fascinating problem. Since I have Faraday cages on the mind today (not that I know much more than ~10 minutes of reading)... simply isolating the phone from all signals would block both the message and any software update, so that doesn't work. But what if you attached it to wifi but not to the cell network? Either have the wifi router (itself having a wired connection) and the phone in the same shield; or, I guess, people say Faraday cages target certain wavelengths, so if wifi and cell tower are sufficiently different, maybe you could have a selectively blocking Faraday cage. Would that have been workable? (non-EE here)

gbrown 7y ago
To answer your question about selectively blocking, just put the wifi router inside the cage. To the point though, feature phones didn't have WiFi generally. I'm also not sure how doing so would fix the issue, unless you could block the number perhaps.
- sorenjan 7y ago
  Feature phones also didn't have OTA updates. I remember taking my phones to service centers to get the latest software flashed. Later on you could flash it yourself with a cable to your PC, browsing esato.com for new versions.

baybal2 7y ago

Yes, Sony Ericsson A200 had a bug in SMS picture decoding (old, monochorme, pre-MMS one) which was easily craftable into an exploit if carriers were allowing multipart SMS. Guess what cell carriers did back then? Yes, they disabled multipart SMS

egorfine 7y ago
What else could they do?
- kortilla 7y ago
  Filter. Spam detection wasn’t exactly a novel idea back then either.
  - rayiner 7y ago
    With what? Especially back then, I wouldn’t assume there is anything with a programmable CPU in the data path that can inspect and filter things at line rate.
    - itsokandmay 7y ago
      If payload "d3structiv3bytes" else approve.
    - pjmlp 7y ago
      SMS are sent between devices via a message gateway server.

jimktrains2 7y ago

> This brings back old memories from hardening the sms/text parsers of feature phones of yesteryear. > There it wasn’t entirely uncommon that when you sent a malformed sms-deliver PDU (e.g. text message) to the phone and crashed parser that tried to decode it, it took also the phone down before it could ack the message back to SMSC. By yesteryear do you mean the present and feature phones do you mean current android phones? Some models are still vulnerable to a text-of-death. https://poetengineer.postach.io/post/deleting-the-text-of-death-on-android https://poetengineer.postach.io/post/deleting-the-text-of-de... not my blog, but the same problem happened with my mother in law's phone. The phone becomes unusable because of a stream of org.android.phone application has stopped messages and the only thing to do is use adb to delete all texts, until it comes in again. I was never able to pin down the exact problem. Edit: Sorry, I didn't mean to come off as snarky, but I just wanted to 1) point out that there are still issues with decoding SMS and MMS messages, even in some modern phones and 2) provide a link to anyone who encounter the same issue as it was very frustrating for my MiL and very frustrating until I figured out I could just wipe all SMSes with adb.

stcredzero 7y ago

This brings back old memories from hardening the sms/text parsers of feature phones of yesteryear. They were indeed hardened? Do tell. I've suggested that the iPhone be hardened against rendering crashes, here on HN. The immediate reaction is to downvote me, then reply, "undefined behavior must crash the process." That's pretty glib and shortsighted, however. It took me just a few seconds to think of a solution. Have one process write the messages in a log file. This process also supervises the second process. The 2nd process renders the messages. If the 2nd process keeps crashing on the same message, the 1st process marks that message as a problem, and the user can be prompted to send the hex dump of the message for diagnostic purposes. (So if it's spicy, they can say no.) The fact that such a basic function of the iPhone can be remotely vanished, requiring a reboot, is a pretty glaring hole. What's even worse, is that highly paid SV programmers would shrug their shoulders so easily.