Symbian DoS attack revealed - bit-tech.net Forums

CardJoe · 5th Jan 2009, 14:17

http://www.bit-tech.net/news/2009/01...ack-revealed/1

A security researcher has unveiled a simple attack that leaves Symbian S60 smartphone handsets unable to receive SMS or MMS messages until factory reset

n3mo · 5th Jan 2009, 15:36

First things first - 3rd FP2 are vulnerable too, it just takes 11 of those messages to "silence" them.

And the second - as much as I support free access to information, I think that publishing such info is not so good. The main problem is that this vulnerability is extremely easy to exploit, such message can be easily sent from any Nokia phone (probably other manufacturers too), without any modification or even deeper knowledge. Two minutes after publishing it, every kid in the world will be sending those like mad. And despite what Nokia says, none of the operators in Europe implemented any filter as for now.

And the only known remedy is formatting phone memory (a.k.a. factory reset)

wuyanxu · 5th Jan 2009, 15:56

ok, tell me what message to type in my iPhone and i'll send it all my friends

raGe82 · 5th Jan 2009, 19:09

Quote:

Originally Posted by n3mo

And the second - as much as I support free access to information, I think that publishing such info is not so good. The main problem is that this vulnerability is extremely easy to exploit, such message can be easily sent from any Nokia phone (probably other manufacturers too), without any modification or even deeper knowledge. Two minutes after publishing it, every kid in the world will be sending those like mad. And despite what Nokia says, none of the operators in Europe implemented any filter as for now.

Ok, so you say, that BT shouldn't publish such information. But I see that beside this you already do the same thing - no operator in Europe uses such filter as for now. Right...

bahgger · 5th Jan 2009, 19:16

Quote:

Originally Posted by wuyanxu

ok, tell me what message to type in my iPhone and i'll send it all my friends

I'm not too sure of the iPhone phrase, but you should type reboot on your G1 to get te message to your friends for epic lulz!

widmod · 5th Jan 2009, 20:17

I'm just glad my N95 is uanaffected by this attack

wuyanxu · 5th Jan 2009, 22:00

Quote:

Originally Posted by bahgger

I'm not too sure of the iPhone phrase, but you should type reboot on your G1 to get te message to your friends for epic lulz!

nice try, we all know that little trick with the Android platform.

Vigilante · 6th Jan 2009, 03:09

I work for Vodafone UK and any S60 handset owners on our network don't need to worry about this. We recieved advanced notification of this issue from Nokia and Symbian 3 weeks ago, and the network level filtering was implemented on the 28th.

Not that I'm suggesting anyone should get complacent with updating their phone software, that should still be done as soon as there is an update to address this issue. But at least you don't have to worry in the meantime.

Quote:

Originally Posted by n3mo

And despite what Nokia says, none of the operators in Europe implemented any filter as for now.

As to the above poster, just because networks haven't told anyone they have implemented this filter yet, does not mean they haven't. Case in point, Vodafone UK.

n3mo · 6th Jan 2009, 17:17

Quote:

Originally Posted by Vigilante

As to the above poster, just because networks haven't told anyone they have implemented this filter yet, does not mean they haven't. Case in point, Vodafone UK.

I happen to own my old, but still active british Orange sim, and the exploit still works. O2 also (didn't confirm myself, but my friend says that it worked yesterday).
Bear in mind that UK is just a small country in a big Europe.

Quote:

Originally Posted by widmod

I'm just glad my N95 is uanaffected by this attack

It is, it just takes 11 of those messages to silence it.

@raGe82
BT should by all means publish such info. But first give Nokia some time to ready updates and operators to ready filters. We all know that such information is gold for stupid kids (or stupid adults for that matter), and it's not just a case of resetting your phone - if you make a backup of phone memory than after formatting and using backup your phone is still silenced. Only option is to format without using backup, which of course leads to losing lots of important data. Well, you can still recover it, but most people wouldn't know how.
And once the information about the possibility of silencing a s60 phone is known, it's just a case of a minute with Google to find any info you would want about it - complete with a list of all European operators filtering it (currently 1, plus Vodafone UK from what Vigilante says).

5th Jan 2009, 14:17	#1
CardJoe Player Character bit-tech Staff Join Date: Apr 2007 Posts: 7,940	Symbian DoS attack revealed http://www.bit-tech.net/news/2009/01...ack-revealed/1 A security researcher has unveiled a simple attack that leaves Symbian S60 smartphone handsets unable to receive SMS or MMS messages until factory reset __________________ this is joe's non-bit-tech blog

5th Jan 2009, 15:56	#3
wuyanxu quad fuelled, GTX200 powered Join Date: Aug 2007 Location: in a room near Soton Uni. UK Posts: 3,938	ok, tell me what message to type in my iPhone and i'll send it all my friends __________________ Death to consolification !!!Core i7 860 @ 4Ghz Cooled by Corsair H50 // Asus P7P55D Deluxe // 8GB of Corsair Dominators @ 1528Mhz 8-8-8-24 // BFG gtx260+ OC2 MaxCore 216SP 896MB // Samsung 64GB SSD // WD Raptor 74GB + Black 1TB + Green 1TB // Corsair Hx620w // Antec p182 // Samsung 24" T240

5th Jan 2009, 20:17	#6
widmod Stopp the Relix guy Join Date: Oct 2006 Location: AUSTRIA Posts: 382	I'm just glad my N95 is uanaffected by this attack __________________ Gaffa-Tape is a very simple modding device <sings>I'm from AUSTRIA</sings>and NO we have no kangaroos Microsoft NEVER stopped the beta phase of any of its operating systems i will not apologize for my language skills

5th Jan 2009, 15:36	#2
n3mo Multimodder Join Date: Oct 2007 Posts: 184	First things first - 3rd FP2 are vulnerable too, it just takes 11 of those messages to "silence" them. And the second - as much as I support free access to information, I think that publishing such info is not so good. The main problem is that this vulnerability is extremely easy to exploit, such message can be easily sent from any Nokia phone (probably other manufacturers too), without any modification or even deeper knowledge. Two minutes after publishing it, every kid in the world will be sending those like mad. And despite what Nokia says, none of the operators in Europe implemented any filter as for now. And the only known remedy is formatting phone memory (a.k.a. factory reset)