Oh no, you're thinking, yet another cookie pop-up. Well, sorry, it's the law. We measure how many people read us, and ensure you see relevant ads, by storing cookies on your device. If you're cool with that, hit “Accept all Cookies”. For more info and to customise your settings, hit “Customise Settings”.

Review and manage your consent

Here's an overview of our use of cookies, similar technologies and how to manage them. You can also change your choices at any time, by hitting the “Your Consent Options” link on the site's footer.

Manage Cookie Preferences

  • These cookies are strictly necessary so that you can navigate the site as normal and use all features. Without these cookies we cannot provide you with the service that you expect.

  • These cookies are used to make advertising messages more relevant to you. They perform functions like preventing the same ad from continuously reappearing, ensuring that ads are properly displayed for advertisers, and in some cases selecting advertisements that are based on your interests.

  • These cookies collect information in aggregate form to help us understand how our websites are being used. They allow us to count visits and traffic sources so that we can measure and improve the performance of our sites. If people say no to these cookies, we do not know how many people have visited and we cannot monitor performance.

See also our Cookie policy and Privacy policy.
Sign in

How to crash a phone by SMS

Broken message, frozen phone

John Leyden Wed 28 Nov 2001 // 21:52 UTC

Black Hat Europe So now you can send an SMS and crash a mobile phone, so that the user is locked out.

Job de Haas, a security researcher at ITSX, has adapted a program called sms_client, which sends an SMS message from an Internet-connected PC, in which the User Data Header is broken.

During a presentation during the Black Hat conference last week, he demonstrated how a malformed message crashes a Nokia 6210 phone on its receipt. Once the message is received it is impossible to turn on an infected phone again.

The vulnerability is tied to the software used by a phone. The flaw affects Nokia 6210, 3310 and 3330 phones, de Haas has discovered, but not a Siemens phone he tried. Phones from other manufacturers are yet to be tested.

To fix the problem users have to put a SIM card into a phone without the bug. Alternatively if the SMS message is registered in a user's In-box this could be deleted with a SMS management tool on a PC.

To repeat the exploit requires knowledge of SS7 signalling and telco protocols to adapt sms_client into an attack tool. But given the power of the attack security through obscurity doesn't appeal. The kicker is that the modified sms_client makes it trivial to spoof the source of any attack.

Nokia told us that sending a message which freezes a phone is "something it encountered" before. The company is unfamiliar with the exploit uncovered by ITSX, which comes as a new twist even to clued-up Black Hat attendees. It promises to get us a more detailed technical response, and we'll update you when this becomes available. ®

Related stories:
Nokia 7650: smart phone, shame about the price
Nokia 3330
Microsoft and Vodafone launch mobile Outlook app
SMS pumps up Vodafone sales

Business drives the Wireless Web
GSM Association launches new standard for next-gen mobiles
SMS in action: road killer and life saver
SMS Me (email is Pants!)

Other stories you might like

  • AI surveillance software increasingly used to make sure contract lawyers are doing their jobs at home

    Plus: GPT-3 is now generally available and one man goes undercover in Amazon to live under AI
    Katyanna Quach Sat 20 Nov 2021 // 11:01 UTC

    In brief Contract lawyers are increasingly working under the thumb of facial-recognition software as they continue to work from home during the COVID-19 pandemic.

    The technology is hit-and-miss, judging from interviews with more than two dozen American attorneys conducted by the Washington Post. To make sure these contract lawyers, who take on short term-gigs, are working as expected and are handling sensitive information appropriately, their every move is followed by webcams.

    The monitoring software is mandated by their employers, and is used to control access to the legal documents that need to be reviewed. If the system thinks someone else is looking at the files on the computer, or equipment has been set up to record information from the screen, the user is booted out.

    Continue reading

  • Lawsuit accusing Robinhood and Citadel Securities of colluding to stop GameStop shares from skyrocketing thrown out by judge

    There's not enough evidence, judge ruled
    Katyanna Quach Fri 19 Nov 2021 // 23:28 UTC

    A federal judge dismissed the proposed class-action lawsuit accusing retail brokerage biz Robinhood of colluding with trading firm Citadel Securities to prevent people from purchasing GameStop and other so-called meme stocks, earlier this year.

    Share prices from the likes of GameStop, AMC Entertainment Holdings, BlackBerry, and Nokia Oyj skyrocketed in January. Internet traders swiping on the Robinhood app inflated prices in an attempt to push back on Wall Street finance houses shorting the securities.

    Robinhood users started furiously buying the stocks and as the prices climbed higher and higher, the company suddenly blocked customers from purchasing more shares on its app. Users were only allowed to sell and as a result, GameStop and other companies' market value began to plummet.

    Continue reading

  • Friday FOSS fest: Franz, RamBox, Pidgin and more

    And lo, it was foretold, punter shall speak unto punter from a single app
    Liam Proven in Prague Fri 19 Nov 2021 // 23:11 UTC

    Most modern chat systems are entirely proprietary: proprietary clients, talking proprietary protocols to proprietary servers. There's no need for this: there are free open standards for one-to-one and one-to-many comms for precisely this sort of system, and some venerable clients are still a lot more capable than you might remember.

    But as it is today, if you need to be on more than one chat system at once, the official way is to install their client app, meaning multiple clients – or at best, multiple tabs open in your web browsers. Most of these "clients" are JavaScript web apps anyway, running inside Electron – an embedded Chromium-based single-site browser. Which is fine, but Chrome is famously memory-hungry.

    There is a brute-force way round this: have one app that embeds lots of separate Electron instances in tabs. There are a few of these around – first came RamBox, followed by Franz. Both use the "freemium" model: there's a completely functional free client, plus subscriptions for extra features. If you prefer to avoid such things, both services have no-cost forks: Ferdi from Franz and Hamsket from RamBox. A newer rival still is Station.

    Continue reading

Biting the hand that feeds IT © 1998–2021

Your Consent Options Cookies Privacy Ts&Cs