agreed, we should all use gopher and block all web traffic, go back to text based systems, use single threaded operating systems and use token ring NIC's
Ah before www, gopher was used to try arrange information, similar to this page. Prior to that there were bbs’s where you dialed up to another computer.
Well, to be fair, you don't know it is until after you've gotten there. But also to be fair the other way, you can just click the close tab and move on with your life. But again to the other side, it sucks when N% of HN articles end up being closed within 2 seconds as you realize the author spent about 4 seconds writing a prompt and is now asking you to spend 5 minutes reading what they likely didn't even review themselves before hitting publish.
A bit like the postal system. Yes, it's meant to send physical letters and what not to my home, but it still sucks when I get ads that just goes straight into the trash. Yes, you're using the system as intended, but I still consider your business slop if you send ads to me this way.
WAP Push is a specially formatted SMS that triggers your phone to download a URL. Unfortunately the vuln here appears to hit at the SMS parsing phase, which I don't think can be turned off easily.
The "if" is doing a lot of heavy lifting. Can it do what it claims to do? LLMs are always hallucinating that they've found the most severe bug in software history.
> LLMs are always hallucinating that they've found the most severe bug in software history.
That is a function of the training data, like many of AI's problems. This doesn't stop it being a problem of course, but it shouldn't be a surprise. Big bugs, like heartbleed over the years have had breathy websites going over how serious the problem is because the problem was that serious, the models think that is how bugs should be reported. Less serious bugs don't get the same excited treatment repeated in many many places, so more measured descriptions figure in the training data relatively less.
They do accept/forward messages without checking if they are special carrier-only ones. ~10 years ago I had some fun sending a "voicemail received" message to people, which caused android phones to display a notification which couldn't ever be dismissed. IIRC it only worked on HTC phones and required root/xposed. SS7 in general is built with total trust in connected systems.
I've sent weird SMS messages through my (rooted) phone before. Silent SMS messages (useful for police trying to activate your phone for triangulation) still returned delivery reports a year or two ago, allowing someone to find out if someone else's phone is on without the target ever noticing.
I think Android removed the ability to send more annoying messages through its normal APIs (like flash SMS messages) but if you have access to any modem (either a smartphone or a full ESP32 dev board costing <50 bucks on AliExpress for 4G LTE), you can bypass any such restriction.
Carrier firewalls will probably filter these messages out but I wouldn't rely on it.
Omfg I am interested in this, I'm interested in wtf a WAP push is, but all I'm getting on this website is Claude-speak "not this, but that" and tables of irrelevant numbers, because Claude fucking loves a table.
Look at this Claude shit:
> Zero-click. The victim does nothing. No tap, no open, no notification.
> Silent. Nothing appears in Messages; the attacker's number is never shown.
Congrats, now you sound like every other AI on the web.
OP, please, if you think you have important information, please write it up yourself, I am so sick and tired of being sent LLM generated Markdown files with zero human input, and now you're just publishing that on a website.
>...which is the exact shape of a "Destructive Remote DoS" in the VRP's own rules.
The trend of Claude referring to everything as having a "shape" irrationally annoys the hell out of me. What an absolutely idiotic way to say "X is like Y."
This trend upsets me so much, because my brain actually does work like that, concepts and ideas exist in 3d space and have likenesses to each other.
I used to write like this, but I can't anymore. (I suspect enough people did in the training set that that's why it ended up being part of the vernacular.)
I just wanted a home for it to share, llm just polished it up.
the message is silent, no notification notifying of the attackers origin, doesn't matter if it's locked, or connected to mobile data, so i stand by what is written.
I don't care about the credit, i have enough CVE's under my belt which are higher severity, none which have dedicated write-ups. i care that this gets fixed and give answers to those who are experiencing their phones constantly disconnecting from carrier.
The Google Issue Tracker link [0] on the site shows access denied for me. Not sure if this is due to it being reappraised or because I specifically don't have access
If it was filed as a security issue, most well-set-up projects with public issue trackers would keep it closed off only to a reporter and internal security audit team.
Perhaps it was never really declassified in the tracker.
You can't access issues that are not assigned to you. I remember reporting a bug via VRP once, and it was marked as duplicated with another id, that I cannot access and see the original report.
No, talking to other humans is over and if it's not a technological solution with zero human feedback, it's not a solution I could build a VC-funded startup on, so obviously not a solution in real-life.
The issue seems serious but the part about Australia and 000 that would ban an attacked device seems the typical LLM-being-too-anal paragraph, and completely lacking common sense.
Maybe I'm wrong and naive but given that the AU law was done to force people move forward from 3G only phones because the network was being shutdown and 000 moved to 5G (I believe), it's a law for operator to contact their customers still using an old phone and migrate them to a newer one.
I doubt they will block automatically the number if you are under that DOS for a few days in a row.
It didn't. The 3g network was shut down. There were several older devices that were 4g but still used 3g to call 000, so they had to be blocked from connecting.
Australia has laws that require companies that provide a cellular service to follow, not fixing such a exploit would breach these laws. Under no circumstance can a telco, phone manufacturer or intermediary restrict or knowingly allow the restriction of access to Emergency Services. Google in this case would be considered as knowningly allowing the restriction as they're refusing the acknowledge this as an issue, something I'm sure ACMA could act upon or compel Google into fixing.
You read the whole issue wrong, the SQLite corruption is result of the recieving device not returning the telco a "message recieved", this causes the telco to retry (depending on the carrier configuration) which eventually results in the SQLite DB getting corrupted.
Google has clearly flagged this as "not a security issue", repeatedly. It's a weird bug for sure, but what's the scenario here?
Correct me if I'm wrong, but the carrier configuration messages can normally only come from carriers. The demo APK sends a message to the phone itself, but sending SMS messages requires special confirmation.
It seems to me that the scenario is that someone spoofing a cell tower can disable your phone practically forever and recovery requires expert interference. Maybe I'm mistaken, though, it's not clear from the description whether a spoofed cell tower would suffice and whether it needs to remain in the vicinity to repeat the attack often enough or whether sending 200 corrupt SMS messages in one go would suffice.
Where does it say that it's carrier configuration? Looking through the page it mentions WAP and PDU, seems PDU from my skimming is just a part of encoding WAP messages, so basically anyone being able to send WAP messages onto the network will have the carrier happily retransmitting it unless carriers starts blocking them/filtering these incorrect ones?
> The demo APK sends a message to the phone itself
That's not what the readme on the repo says.
"Install on a sender device, enter (or auto-fill from an active SIM) the target number, pick the sending SIM, and tap SEND CRASH SMS. Observe on the target..."
It's not clear, which makes me skeptical that this is all that serious of an issue.
I'd like to know - can any devices actually put such a malformed message onto the carrier network? It probably requires at least a custom app that would never be allowed on an app store, if it's possible at all. And do any carriers actually let it go through their network and to a device like a normal message? It's entirely possible the malformed message would crash some software in the carrier's processing stack first and so never be delivered. And if it doesn't, they could easily add a check to block such messages. It's difficult to believe they don't already have some sort of protection against spamming tons of messages to any device. It's also entirely possible it works differently on different carriers, and some but not others might add blocks for this but not make a press release about it or anything.
This seems more like meh, minor bug, fix it quietly in the next Android release, not OMG the world is on fire to me.
Is this AI security slop or a real issue? Can the phone actually receive these kind of messages from the network?
Also, I don't understand Googles position here. On android the phone ia not part of the OS and can be updated via an app or framework update. Why not just fix this as a functional bug?
We really need to stop encouraging this kind of clickbait garbage.
If it is a serious vulnerability write a report. If the reporter cannot demonstrate their own understanding of the issue then I don’t see why they should get the benefit of doubt.
The page mentions that an adb command is required to recover the device, but I can't find details on what exact adb this is.
Overall a bit frustrating to have such a fancy webpage with a dedicated address, but then no description on how to actually #1 identify and #2 recover an affected device...
> "Once the database is corrupt, com.android.phone no longer needs a fresh message to fail: it crashes immediately on every boot as it reads the damaged store [..] a factory reset only helps temporarily"
Can't I delete the storage of com.android.phone instead of a full factory-reset?
Networks still send WAP pushes but you can't just send randomly formatted WAP pushes to your friends. You can, however, use a stingray to MITM your friend's Android phone and send whatever you want to them, because now there is no network firewall to protect them. The combination of MITM and a bug like this could be pretty devastating.
84 comments
[ 7.5 ms ] story [ 78.3 ms ] threadBefore this practice in general you simply released the exploit and see if enough chaos triggers a fix.
A bit like the postal system. Yes, it's meant to send physical letters and what not to my home, but it still sucks when I get ads that just goes straight into the trash. Yes, you're using the system as intended, but I still consider your business slop if you send ads to me this way.
Thanks to some genius at Samsung who thinks this is a good idea.
I'm not familiar with WAP Push and how it works, but is it possible to disable it or block that port on a non-rooted phone?
That is a function of the training data, like many of AI's problems. This doesn't stop it being a problem of course, but it shouldn't be a surprise. Big bugs, like heartbleed over the years have had breathy websites going over how serious the problem is because the problem was that serious, the models think that is how bugs should be reported. Less serious bugs don't get the same excited treatment repeated in many many places, so more measured descriptions figure in the training data relatively less.
err, how can I send an SMS like this? Would a mobile network even accept/forward such an SMS?
Little hard reading through the vibe slop here
But not all SMS are text messages for the user.
My provider had given me a remotely managed router. It was trivial to change the configuration and have it work normally.
I think Android removed the ability to send more annoying messages through its normal APIs (like flash SMS messages) but if you have access to any modem (either a smartphone or a full ESP32 dev board costing <50 bucks on AliExpress for 4G LTE), you can bypass any such restriction.
Carrier firewalls will probably filter these messages out but I wouldn't rely on it.
Those APIs are probably still online, and still require to nail your ass to the contract, but technically I would assume it's possible.
Look at this Claude shit:
> Zero-click. The victim does nothing. No tap, no open, no notification.
> Silent. Nothing appears in Messages; the attacker's number is never shown.
Congrats, now you sound like every other AI on the web.
OP, please, if you think you have important information, please write it up yourself, I am so sick and tired of being sent LLM generated Markdown files with zero human input, and now you're just publishing that on a website.
FFS.
Oh you had Claude publish your name.
Mark Blaszczyk, please do better.
The trend of Claude referring to everything as having a "shape" irrationally annoys the hell out of me. What an absolutely idiotic way to say "X is like Y."
I used to write like this, but I can't anymore. (I suspect enough people did in the training set that that's why it ended up being part of the vernacular.)
the message is silent, no notification notifying of the attackers origin, doesn't matter if it's locked, or connected to mobile data, so i stand by what is written.
I don't care about the credit, i have enough CVE's under my belt which are higher severity, none which have dedicated write-ups. i care that this gets fixed and give answers to those who are experiencing their phones constantly disconnecting from carrier.
[0] https://issuetracker.google.com/issues/509520497
Perhaps it was never really declassified in the tracker.
:grimace:
Maybe I'm wrong and naive but given that the AU law was done to force people move forward from 3G only phones because the network was being shutdown and 000 moved to 5G (I believe), it's a law for operator to contact their customers still using an old phone and migrate them to a newer one. I doubt they will block automatically the number if you are under that DOS for a few days in a row.
You doubt correctly. The law is about blocking IMEI numbers of phones that use the 3g network to dial 000 despite being 4g devices.
Correct me if I'm wrong, but the carrier configuration messages can normally only come from carriers. The demo APK sends a message to the phone itself, but sending SMS messages requires special confirmation.
Practically speaking, what's the risk?
perhaps even a rogue employee
For the lulz.
That's not what the readme on the repo says.
"Install on a sender device, enter (or auto-fill from an active SIM) the target number, pick the sending SIM, and tap SEND CRASH SMS. Observe on the target..."
I'd like to know - can any devices actually put such a malformed message onto the carrier network? It probably requires at least a custom app that would never be allowed on an app store, if it's possible at all. And do any carriers actually let it go through their network and to a device like a normal message? It's entirely possible the malformed message would crash some software in the carrier's processing stack first and so never be delivered. And if it doesn't, they could easily add a check to block such messages. It's difficult to believe they don't already have some sort of protection against spamming tons of messages to any device. It's also entirely possible it works differently on different carriers, and some but not others might add blocks for this but not make a press release about it or anything.
This seems more like meh, minor bug, fix it quietly in the next Android release, not OMG the world is on fire to me.
Also, I don't understand Googles position here. On android the phone ia not part of the OS and can be updated via an app or framework update. Why not just fix this as a functional bug?
Google are rather vague in their triage, they just said temporary DoS does not qualify, then rejected to investigate further.
We really need to stop encouraging this kind of clickbait garbage.
If it is a serious vulnerability write a report. If the reporter cannot demonstrate their own understanding of the issue then I don’t see why they should get the benefit of doubt.
Overall a bit frustrating to have such a fancy webpage with a dedicated address, but then no description on how to actually #1 identify and #2 recover an affected device...
> "Once the database is corrupt, com.android.phone no longer needs a fresh message to fail: it crashes immediately on every boot as it reads the damaged store [..] a factory reset only helps temporarily"
Can't I delete the storage of com.android.phone instead of a full factory-reset?