Nokia 'curse Of Silence' Sms Exploit Uncovered

[Peaches]

Nokia 'Curse of Silence' SMS exploit uncovered

Old bug, new tricks

By Bill Ray •

2nd January 2009 11:08 GMT

Mobile phone security vendors were rejoicing last night when it emerged that an obscure bug in an old version of the Symbian OS could allow an attacker to crash a target's mobile phone with a specially-formatted text message.

The attack has been rather dramatically branded the "Curse of Silence", and is a genuine bug that prevents incoming SMS messages being received once a specially-formatted text has been sent to the target as, demonstrated by Tobias Engel. Phones running Nokia's S60 interface, versions 2.6 to 3.1, can be attacked in this way, and some models need a hard reset to recover.

The bug comes courtesy of the way that SMS was designed to integrate with internet email services: no one really understood what the relationship between email and SMS would eventually be, and in the early days there were many email-to-SMS gateway services. Short messaging was seen as the ideal way of delivering email alerts, but the combination of price and increasing spam levels paid to most of them, especially as spam filtering was unknown at the time.

But not before the 3GPP, the standards-setting body for the cellular industry, had stated that messages could be identified as "Internet Electronic Mail", and should be displayed as such when received. Prior to version 2.6 the S60 messaging client made no attempt to display such messages properly, but with 2.6 the messages got broken into "sender" and "message body", and (it turns out) if the "sender" field is more than 32 characters then the messaging client falls down.

The Register - http://www.theregister.co.uk/2009/01/02/nokia_security/