Slashdot Log In
Crashing A Nokia Phone Via SMS
Posted by
Hemos
on Fri Nov 30, 2001 03:42 PM
from the doesn't-matter-to-me dept.
from the doesn't-matter-to-me dept.
Atryn writes "An article at the Register reports that a recent Black Hat conference presenter demonstrated how to crash Nokia cell phones using malformed headers in SMS messaging protocols. Though the SIM card can be recovered by moving to a new phone, this is perhaps an interesting preview of security issues as data goes wireless." Of course, when you live in the US, where your wireless services are about eight years behind the curve, this is less of an issue. *grin*
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Nostalgia (Score:3, Funny)
Re:Nostalgia (Score:4, Funny)
Nostalgia was better when I was young too, I might add.
Old news? (Score:2, Flamebait)
swell (Score:1, Redundant)
Now the *truly* malicious can set out to infect 911 with a virus that attacks the phone of callers . . .
hawk, who now sees that touch-tone was a slippery slope and should have been stopped
firewalls for phones (Score:3, Funny)
Only eight years? (Score:5, Insightful)
This talks about crashing a phone via SMS, but what about devices on CDPD or GPRS like those road signs or weather telemetry, or even electric meters in some locales. That's not only on the wireless network but on the IP network. Has anyone tried to muck with those devices yet? On most CDPD and GPRS plans the customer pays for each byte transmitted, what if someone just streams data towards a customer to run up their bill?
SMS proxy? (Score:4, Interesting)
Re:SMS proxy? (Score:5, Funny)
It's time to code firewalls
Wireless devices had had this stuff for years, except they're called "concretewalls".
8 years behind??? (Score:4, Funny)
Re:8 years behind??? (Score:4, Interesting)
Seriously. I have Voicestream GSM service & a tri-band phone, and have mediocre coverage in Washington, D.C., but last week had awesome coverage throughout Scotland and northern England (I'm talking small towns, not just cities like Edinburgh, etc.). Even got encrypted transmission service in Iceland. But in the U.S.? Nuthin' but crap.
Maybe cell phones are more like fashion than technology: we American's like it 2 years after it's popular in London.
Worms (Score:5, Funny)
And for the first time... (Score:3, Interesting)
The good news is that if terrorists intend to use such "crash" attempts to crash cars or other vehicles, we at least have new legislation to stop them [ins.gov].
Yep, not being first can have it's advantages (Score:2)
Those who implement later can implement newer standards w/out obsoleting(and thus pissing off) all the existing users of the cellphone network.
Why go through all that...... (Score:2)
We may be years behind (Score:1)
Anyone remember reading about the test of this little "technology" in Boulder CO (of all places)? The advertiser was "very pleased" with the number of people who READ the ad.
Great, so they can trace who read the &^$%*& things as well. I think my Sprint phone gets 100 free text messages before I have to start _paying_. Which is great - the recipient gets to pay to be spammed...
Security through... (Score:4, Interesting)
Security through Inertia. Hmm...
Bound to happen... (Score:3, Funny)
Btw, if you actually want this logo, go here [windowsxp.nu].
Who cares? (Score:1)
If I could get one of those big old 80s-early 90s cell phones (like the one that kid had in saved by the bell), I would use it. I don't need no stinkin' text-messaging WAP shit on my phone.
Re:Who cares? (Score:5, Insightful)
Personally, I find SMS messages extremely convenient in very much the same way as email is convenient. It's a lot less intrusive than a phone call since it doesn't demand the receivers attention RIGHT NOW. It's quiet and more private, you can write and read SMS's anywhere without disturbing other people or other people disturbing you. You can use it for services. Send "FIND Joe Sixpack" to number 400 and you get the address and phone number of Joe Sixpack in return. Send "WEATHER Helsinki" and you get the latest weather forecast for the Helsinki area.
I worked in Singapore for six weeks last summer and it was extremely convenient to just bring my normal cell phone with me from Finland and everything working without any reconfiguration. Phone book entries, caller id, text messages, data. I used the phone to check my email with my Palm Pilot, Finnish news, Forumla 1 results riding home from work in a cab in the night etc.
I'm not saying that everything should be crammed into a cellular phone. Some things work better in a laptop or a PDA if you want it mobile. The point is that things like SMS and WAP, which are totally basic features of GSM phones, are quite useful and have their own place. Instead of silly "I don't need no stinkin' text messaging WAP shit on my phone" outbursts, you might want to try it out. You just might discover how nice it is and how well it works!
New Slashdot reporting template (Score:5, Funny)
We here at Slashdot would like to advise you to use the following format when submitting bug-related stories.
"Crashing a [product] with [method used to crash it]"
"An article at [source] reports that [security expert] demonstrated how to crash [product] using [Pick one: buffer overflow; malformed headers; Javascript]." [insert wizened statement about how this will affect future direction of products in this category] [attach silly remarks by Slashdot writer like "Well, that's why I use [competing product]!"]
Also, please use the following template when replying:
"Those @(#&@! bastards! Who do they think they are, making [product] so buggy! Why do they have to include [useless feature that no one wants/uses anyway]?? I'll never use a [company] [product] again! Please, fellow Slashdotters, I urge you to boycott [company]!"
This will save us a lot of time and moderation points.
Thank you,
The Slashdot Team
Thank god MS didn't write the messaging software (Score:3, Funny)
Though my grandma might like to receive 'How are you sexy legs?', I'm not sure my boss would be quite as accepting.. (and if he is, I should quit)
anyone know where... (Score:1)
Web on Cell (Score:1)
Yes, I'll be one of the first to admit that cell phones are wonderfull. But I use mine as a phone. Not a game consol, not as a web browser, or day planner... And yes, I think PDA's are good for a day planner, and even limited web browsing and gaming. But really, do we need to be playing Doom, or the latest, greatest, Quake game on our cell phones? Do you really need to use Yahoo! after getting talking with your mother from the bus?
For me, there is such a thing as too many features. Web browsers on cell phones is one such case.
I can see it now... (Score:5, Funny)
Hahahahahaha...{sniff}....hehehe.
What is with the Grey screen of death comment being modded as overrated?
Geez, you'd think you would have to be rated first.
Maybe that should be submitted as a bug?
You can't fix the moderators who do that kind of stuff (maybe spayed or neutered) but can you fix the system?
Oh, well, don't worry, be happy..la la laaa
Yes, bugs, virus, scams and spam going into mobile (Score:1)
I think some bugs are inevitable but I hope the developers will pay more attention to the the sofware they design than Bill Gates did in the early PC years - and even in the not early years ! And those new combined phone/pockeptPC will be fun to hack I bet.
But I don't think the users are ready to accept too many bugs in a mobile phone/pda like they did with the windows OS.
Responsability is not only on the shoulders of developers. A friend of mine crashed his visor and lost all the data he had difficultly typed in. He had no backup ! So there will be a lot of work to make the users more aware of security concerns about the digital tools.
I hope the laws will also be appropriate to this new digital era. No way am I gonna tolerate sms spam !
The nokia 3210 bug :
When you type a message, then want to send it but go back to the typing screen before entering the phone number of the recipient, the T9 completion system is messed up : if you want to change a word, it doesn't use the one you have selected.
how lame (Score:1)
Once the message is received it is impossible to turn on an infected phone again.
what kind of design went into this product? is there no way to force a hard-reboot of the phone or something similar, to reset it? what about detaching the battery briefly, etc??
it would really suck to have this happen while on a business trip or something and have to run by the nearest Nokia store to exchange your phone for another, or have it unfrozen or whatnot. and i'm sure Nokia would just exchange/fix the phone for free (not)... they'd probably require that you mail it in to them and wait 4-6 weeks to get it back, finally fixed.
--w
It's times like this ... (Score:1)
BOYCOTT NOKIA (Score:1, Funny)
There are lots of DoS attacks against phones (Score:1)
Interestingly enough I have found the Microsoft browser to be less prone to crash than all the others I've tried. (But no, I still don't know why anyone would want a web browser on a (2G) cellphone.)
Ha, make fun of my free w/plan phone now... (Score:1)
Tut tut... (Score:2, Funny)
I once crashed my friend's Alcatel One Touch Easy by flooding his phone from mtnsms.com...
Canada and SMS (Score:1)
I pay 15 dollars per month for web access, but it is UNLIMITED usage and I can use AIM for chatting to all my friends that I con into installing AIM so I am not so bored on the transit ride home. It's great. I just wish Nokia had a plug in keyboard for my 6185.
Bell Canada, Telus, and Rogers-AT&T have actually recently made an agreement to allow full two way text messaging across their networks. So..Canada at least isnt 8 years behind.
This is new? (Score:2, Interesting)
Crashing my 7110 (Score:1)
1) Connecting to any wap service.
Same bug always, requires removal of the battery. After that it works fine. It always happens the first time I try to connect it when I haven't used it in a while(only uses it to show to people why it suck)
2) Using the IR connector, requires reboot to make it work again.
Using the phone to dial up to the company ppp pool. It drops the connection after 5 minutes. Yes, I know it is slow but when staying in a boring hotel room in a boring city, slashdot at 9600 baud(i'd say it performs like 2300) ain't that bad.
Also trying to sync my palm using the IR requires a reboot the next time I want to use it.
3) Impossible to talk for a long time while driving, even using the handsfree kit with external antenna. When it have to switch bands while talking, always drops the connection. But I guess that is the phonecompany's fault.
normally I don't react like this... (Score:1, Offtopic)
sorry, I know that someone is going to mod me down for this... BUT THAT IS NOT FAIR!!!
If someone with the same expierence reads this please reply or tell me about your unfair rejection by email me(at)sluggie.org.
Thanks!
sluggie out.
So now we can use the DMCA! (Score:1, Funny)
Maybe he will face up to 25 years!
But, hey! wait...
Soon all the devices will have the enforced SSSCA so no need for that. The big companies will control every single piece of hardware and using the DMCA it will be ilegal to try to hack it... so
Start praying.
NokiaMan
Here's how I want to hack Cellphones.... (Score:1)
2.) A message that will simply explode all those phones that people use to talk like a bastardized two way radio with the annoying beep every time someone stops talking.
3.) A message that causes the cellphone to emit sterilizing radiation at an especially idiotic user's genital regions. Helping Darwin along...
Number 3 is, sadly, only a dream. Number 1 is almost definitely impossible, especially when you only have about 120 characters in the SMS message. Number 2 might be possible, just target the specific models of phones that support this "feature". Get to work, l33t |-|@xx0rs.
(Although I do own a cellphone, I use it less in a month than half the other cellphone owners use it in a day. The ringtone it is set to is a simple unannoying beep. Usually it is off anyway so that no one can call me.)
Tim
Just when I was about to give in and go wireless (Score:1)
Not just SMS, but regular Nokias, too.... (Score:3, Interesting)
In my case, all I had to do was to send an email to mytelephonenumber@mobile.att.net, and it would be processed by the phone. (Great way to act as a pager, too.)
In my experiment with music ring tones, I found that it was quite easy to accidently craft a message (in my case, a new ring tone) that is malformed. And it actually hung my cell phone up.
I probably should have published this as a cool DOS attack, but then again, I really didn't know WHERE to public cell phone DOS attacks, much less what could be done to counter it, so I kept it to myself.
Play around enough, though, and you'll find your own special email you can send to a cell phone that'll lock it tight.
Why Europe and Asia have moved faster in wireless (Score:1)
telephone network. The U.S. certainly has a lot of government regulation in regards to the wired telephone network, but no where near as bad as Europe or Asia. The technical quality of our landline network is excellent. Demand for wireless is therefore less.
It is old news (Score:1)
Just goes to show that TheRegister apparently missed a great hacker conference
SMS phones (Score:1)
Does not the DMCA make it illegal for this researcher to tell Nokia about the fault in their phone, meaning that this bug cannot legally be fixed?
SMS can save lives (Score:1)
Packet filtering would solve the problem (Score:1)
There is a simple solution for this: a packet filtering modue at the operator's SMS software. And since Nokia wouldn't like their mobile phones to crash, they will of cource gladly supply such a patch, right :)
Since you can't update every single terminal (ie phone), you would have to filter out the bad messages at the operator. And why not. After all, that's the logical place.
It's just like bad packets get filtered out at the filewall/switch and not at the workstation.
Re:Black hats (Score:1)
Re:Black hats (Score:5, Interesting)
Is it at all possible to have any sort of message board without people coming along and using the word asshole?
Any other way, and you wouldn't be on planet earth, bub. Stop whining about it, and start questionting which you value more: crashable cell phones, or no cell phones?
Society must accept the inevitability of technology as an unbiased tool. Technology CANNOT be created for good. Like it or not, as a society, we must accept that when we adopted cell phones, we accepted the possibility that they may not always work, in the same way that as a society we value the use of cars more so than the lives of the thousands upon thousands of people who die as a result of them every year.
Anyone who thinks technology puts powers only in the hands of the righteous (whatever the hell that is) is a fool. In the case of Black Hats, I'd rather the concaine junkies in my neighbourhood congregate and do their thing in the middle of daylight in the park rather than at night, in allys, if you catch my drift. The fact that this was demonstrated at a conference is a good thing
Re:Black hats (Score:1)
Re:Behind WHICH curve? (Score:4, Insightful)
You obviously haven't tried using the same phone in both the U.S. and Europe. Get a tri-band GSM phone, take it to any large city in Europe, and you'll see you get much better coverage than in NYC/someother U.S. city.
Re:Behind WHICH curve? (Score:2, Interesting)
Re:Behind WHICH curve? (Score:2)
An American friend one pointed out to me that the USA has the benefit of inventing many new technologies, and being the first to implement a massive number of them...
...This of course means that the USA tends to implement version 1.0 all across the country, and when you've covered an area that big with version 1.0, version 2.0 is gonna be a long time coming
Steve
Re:Behind WHICH curve? (Score:4, Insightful)
The fashion made the economics look better, and that in turn drove more manufacturers to enter the market and compete, driving the price down further.
The other feature that killed off the other mostly non-digital systems was security. After the 'squidgy' tape loads of people would only get digital, particularly Prince Charles- and the GSM phones were a convenient digital standard to go for at that time.
Britain is an ideal place for cell phones- the population density is pretty high, so less cells are required; most people I know have a cell phone in britain. Many of them don't have a fixed line at all anymore.
Incidentally, there IS a satellite phone system- Iridium, last time I checked it was very expensive, didn't work indoors or in cities, had low quality; and the handsets are really heavy.
The military loves them.
Re:Black hats (Score:3, Insightful)
- Is it at all possible to have any sort of technology without assholes coming along and ruining it for everyone
Who's the bigger asshole? The one who exploits flaws in products or the one that releases products without checking for flaws that could be exploited?One could say that the "black hats" are really "white hats" in demonstrating flaws so that they do get fixed (in reality there are shades of gray in between, depending on what the discoverer does with that information).
Of course, if Microsoft had their way, we wouldn't even know about flaws such as this and have to put our faith in the vendors fixing these "secret" flaws (read: Ralph Nadar's Unsafe at any Speed). Of course, where's the motivation to fix flaws that the public doesn't know about?
Re:Behind WHICH curve? (Score:1, Informative)
This is good for Europe...
Remember standardise early, but not too early
CDMA is not 3G anyway. We all has to upgrade.
but in real life most of the US has just as good of coverage as Europe.
GSM works on the top of Kilimanjaro.
Sure there is only one provider, but who cares if the phone works?
I would care about paying even more than here in Europe.
Get out from the major cities and there is no service, but a single GSM standard would't help much. Population densities are very low in the US, to there day there are many miles where there is no coverage on any system. (Unless there is a satalite system now)
In Europe the operators have to provide near complete coverage, but this only makes any kind of economic sense if the market is not fragmented between different standards. Population density is very low in northern Sweden, but look at this map of Telia's coverage:
http://www.gsmworld.com/gsminfo/cov_sete.htm
Re:Behind WHICH curve? (Score:5, Interesting)
What I find funny about this statement is that these two are not necessarily comparable. CDMA is a radio protocol, used by both Sprint PCS and Verizon here in the USA. GSM, on the other hand, fully describes a wireless network, from the radio protocol (TDMA), to the included services (voice, 9600bps data, SMS), all the way to the SIM chip.
While CDMA may be a better radio protocol than TDMA, it is definitely not a wireless network. You can't use a Sprint phone on the Verizon network can you? As far as I know, these are separate networks with their own definitions. They just happen to share a common radio protocol.
So when someone brings up the ancient war: CDMA vs TDMA vs GSM, be sure to reorganize this into: Sprint vs Verizon vs AT&T vs GSM. This is a much more sensible comparison. Anyhow, perhaps in the future GSM's radio protocol can be replaced with a CDMA incarnation.
SMS is NOT useless (Score:3, Interesting)
- If you cannot talk or do not want to talk, in a lecture for example, you can still type.
- If you want to send a phone number or a complex address, it is easier for the receiver to read it than to have to write it when you talk.
- You can reuse the same message as many times as you want.
- You can type a message and send it later.
- If the network is poor and audio not working, sms still works. (I only use sms with why brother, the antenna of his phone is broken). It even saved a man's life in England.
- With sms, you can see the number of the sender and ignore it.
- you can receive personal news and services that way.
- you can have your email forwarded etc.
- etc.
Finally if you find a place where 802.11b works everywhere with phones as cheap as current ones, I will go live there !
bad moderating (Score:2)
Re:SMS is useless (Score:2, Informative)
Last time I checked the UK is in Europe, and I know of no network in the UK where you pay per call, when roaming in France, Spain, Portugal and Greece I have also always payed per minute. Where did this idea we pay per call come from?
Re:SMS is useless (Score:1)
Everything is COTS if you have enough money, just under 10thousand still is quite a bit of money to spend on a single scanning device (for an individual that is). And then you have to crack the message itself which requires you to pick up a distinct call.
Billing per-minute still sucks, but sucks much less than per CALL
Paying per call is a term I'm not familiar with, we mostly pay per minute here in Europe (per second in my country actually, after the first 10 seconds).
Coverage is good.
My coverage is excellent here too. If there is a paved road in my country, I can use my GSM there, and some gravel roads as well. Did I mention I can take a trip around my country and still have coverage? No, I don't live in Holland or Denmark, I live in Iceland which is not quite known for its population density. And in case you're even dreaming about coming up with the argument "you're so few, you don't need to cover as many people as we do" I surely needn't remind you that transmitters and relays for GSM may be cheap but not THAT cheap (there are only 280 thousand of us you know). Plus I can take my phone to almost every country in the world (the US not included) and make calls and receive them just as I do back home. Plus I usually get to choose between different providers.
KISS. Keep It Simple, Stupid. I don't want SMS on my phone
SMS is Simple Stupid! And if you don't want sms on your phone don't open them! Don't want to send an SMS, don't send it then! Feel bothered by the phone ringing (which I hear you pay for, that's stupid, paying for incoming calls that is), don't answer it, or better yet, turn the bell off, or turn the phone off! Nobody's forcing you to use the phone. As for building 802.11b everywhere, that's
a) a whole lot more expensive
b) even more pointless, I don't feel like lugging my ThinkPad all over the place.
c) Prone to hacking too you know!!! (thus nulling your argument that GSM is fundamentally broken).
As for SMS, it really is a nice communications medium if you just want to send a quick message without going through the usual formalities. Instead of
"Hi, how are you doing, fine me too, listen I'm going to be a bit late for that meeting so blablabla"
You can send a quick SMS with the message
"Hi, sorry, I'm going to be a bit late for the meeting".
Now, with GSM I also get the following benefits: a) A choice between many providers b) A choice between a wide range of phones, the ones that
Now, your point FOR CDMA was again?
Re:SMS is useless (Score:1)
That's why you don't use email, and just call people, right? And all these instant messaging (ICQ, AIM, etc.)... Who needs that, if you can just call all the people? Man, why didn't you tell us before? We would have never used this stupid SMS-stuff, if we just had known...
Oh wait, the reason European users won't do that is because they pay PER CALL.
??? Ever been to europe? Every provider I know of, charges per minute. Actually it's often cheaper to speak for 1-2 minutes than to send an SMS (which is somehow ridiculous...).
SMS is surely not the most efficient form of communication, but often it's really convenient. It's pretty much as useful as all the instant-messaging services which are so popular right now, only that you can use it whereever you are...
1) CDMA works. TDMA and GSM are fundamentally broken. GSM's encryption is crackable real-time using COTS hardware. CDMA's isn't (yet).
That's why AT&T and co. would never switch to GSM, right? CDMA may be the more sophisticated technology but GSM just works. Everywhere...
2) Billing per-minute still sucks, but sucks much less than per CALL. Most calls are less than 2 minutes, so you don't get raided too bad in the US. And besides, roaming charges are quickly becoming a thing of the past, and now most providers are including bucketfuls of minutes, even in their cheap plans...
See above. What about paying for incoming calls/messages? Another thing often forgotten in price-comparisions US-Europe, is the base fee, charged every month. It's usually much higher in the US.
3) Coverage is good. I have no problem making a call no matter where I go (my provider is VZW).
I had a very different experience in the US. And judging from the other comments I'm not the only one...
4) KISS. Keep It Simple, Stupid. I don't want SMS on my phone. Don't want spinning 3-d wingdings. Don't want to read my email from the phone.
So, what? I want all that stuff. I use SMS, I get my email to the phone and I actually use WAP (over GPRS). And most of the people I know do so, too. And now?
If I want to read my email wirelessly, then build me an 802.11b network everywhere. Don't make me do it from a phone!!
Yes, I'm dreaming of stuffing my laptop in my pockets, too... Show me the technology, that puts 802.11b-receivers in cell phones without running out of battery too fast. Then show me how to deploy it for nationwide coverage. And finally show me how to make it scale to the user numbers of cell-phone systems.
Summary: Just because you think phone-messaging is stupid doesn't mean, everybody feels that way. And judging from the user numbers in europe and especially asia, a lot of people do seem to like SMS...
Re:Behind WHICH curve? (Score:3, Informative)
Australia uses multiple systems, but now supports mainly CDMA and GSM. Which is more popular? CDMA is better for covering distance - and please (unless you are posting from antartica) don't underestimate the issues faced in Australia. We have a land mass 2/3 the size of the US, but with a population of 18 million.
GSM is locked in by design to a 35 Km radius around the base station. Not an issue in say, NY, London or Europe for that matter. A big issue in Oz where your neighbour might be further away than that. Telstra (the major teleco in Australia) have modified GSM transmitters to provide a second 35-70 Km ring of coveravge from a base station. In outback Australia, you can easily get 70 km line of sight to a tower.
Despite all these limitations, GSM still wins hands down. The biggest reason? Competition I think. Being able to change service provider with a change of SIM card, rather than handset.
Plus the provision of enough features above and beyond phone - SMS messaging. Although primitive, it was flexible enough to make your phone a pager and message service in one.
In hindsight, the bandwidth limitations (9600 baud) and absence of packet radio (always on rather than dial in) features weren't enough of a liability to hold back its initial rollout.
You might call it the microsoft or VHS solution - near enough, good enough without actually being the best.
MIchael
Re:Behind WHICH curve? (Score:2)
I'd probably argue a lot of Gen 3 stuff is heavily influenced by the Asian markets, a lot more on the uptake than the American cellular market, and where they already have cellulars with data capacity of 2mbps.