WORLDTECHInvisible 'SMS of Death' can crash Android calls, even emergency calls
A vulnerability dubbed the 'SMS of Death' lets a remote attacker disrupt phone service on Android smartphones with a single hidden message, and it can even interrupt calls to emergency services. The flaw has drawn renewed attention to the security of the messaging system used on Android devices.
How one manipulated message knocks out calls
A specially manipulated SMS is enough to crash the phone service on Android, interrupting ongoing calls and temporarily leaving the smartphone unusable.
The issue was documented by independent researcher Mark Blaszczyk, who found that a remote attacker can trigger the disruption by sending one specially crafted WAP Push message.
What a WAP Push message is
Wireless Application Protocol Push, or WAP Push, is a message carried over the mobile network, usually as a binary SMS. It contains structured data that the smartphone processes automatically, without any action from the user.
Unlike an ordinary text message, a WAP Push can carry notifications, links to internet resources and configurations for mobile services. Because the phone handles this content on its own, the operating system can be made to crash the process responsible for phone functionality.
A zero-click attack with no warning
The most worrying aspect is the method of execution. The attack is zero-click: the recipient does not have to open the message, select a link or authorise anything.
According to the report, the attack can also compromise the ability to contact emergency services, which makes the flaw more serious than a simple nuisance.
Open questions
- Which Android versions and devices are affected by the vulnerability?
- Has Google or the device makers released a fix?