DoS Vulnerability On Nokia Phones 114
Matt_Bennett writes "According to this report from CNN, it is possible to send a SMS (Short Message Service) message to certain Nokia GSM phones, in particular the Nokia 7110, which will cause it to lock up. At this point, they are unsure if it is possible from an email-to-SMS gateway. The phone has to have its battery removed and replaced to return to normal operation." "Sorry I couldn't call you back, my phone was haxx0r3d." We laugh, but as personal electronics get better, we rely on them more... and at the same time, they become more complex: the potential security holes grow. Its kinda creapy.
Re:Anybody know how to do this ?? (Score:3)
On norwegian TV yesterday, they interviewed some Nokia techies finishing up their research on the matter. Its seems that this bug only can be recreated with some sort of Nokia development software and equipment. This things are not readlily avalible.
Next version of this software should solve the issue. A recall of the exploitalbe phones is not consideredSad to say, Nokia doesn't "get it" - any of it. (Score:2)
It's amazing how unclued that company can remain.
It's not really just Nokia, it's the general short-sightedness of corporations still unable to get the clue from their own work-force geeks.
We're moving to information age not because of funny gadgets, but because of real, hard-to-use, hard-to-beat endlessly-programmable-information-processing-cap
</rant>
Vision:
I want a necklace of batteries and PCMCIA cards wired to my earplugs and sights, that I can secure myself against hazardous SMS'es and other forthcoming hacks.
Re:Anybody know how to do this ?? (Score:1)
make sms solutions and it would be great,
if we could filter out this type of messages.
Re:malformed message (Score:2)
for a DoS attack to be successful, the point is to flood a server that is required to be online at all times and that denial successfully takes them offline for an extended length of time.
this isn't a true DoS attack because the person sending it would have to send out a continual stream of these malformed messages that would get bounced back to them as soon as one brings down the phone. Also, the SMS provider software would shut down the point of entry if their load from a point becomes too large.
I would call this a simple software glitch that has the unfortunate problem of causing the phone's OS to crash.
call it a runtime error. call it a macintosh system error. it's just not a DoS
Re:Indeed it ain't anything difficult... (Score:2)
Re:Stupid and needless technology (Score:5)
Who are the geniuses that think these things up?
My guess would be Hanna-Barbara. We're all just bit players in a big Jetsons episode.
"I will gladly pay you today, sir, and eat up
Lack of interdisciplinary communication (Score:1)
As Dr. Evil said, "Give me a frickin' break."
Re:not as creepy (Score:1)
Re:malformed message (Score:2)
Also, cell phones are mission critical, for some people anyway. Emergency workers (firefighters, cops, ambulance drivers, etc) are beginning to rely more & more on cell phones for communication. The fact that someone can send my phone a message that forced me to manually reset the phone is pretty pitiful. IF something like this occured in, say, Pine or Elm, its would be considered a pretty big flaw.
Almost every GSM phone is vulnerable to SMS (Score:2)
Just to state that this is hardly Nokia-specific problem, but of course, Nokia is most visible target, just like Microsoft.
Update: (Score:1)
Re:Sad to say, Nokia doesn't "get it" - any of it. (Score:2)
Re:SMS "reconfiguration" (Score:2)
Re:malformed message (Score:2)
- How mission-critical the cell phone is depends on who is using it. If it's your average SUV-driving latte-drinking yuppie, then no -- it isn't mission critical at all. But if it's a medical worker on call, it better be considered mission-critical.
- The downtime depends on how soon the person notices that the cellphone has crashed.
- I simply hate the way people are so used to Windows that they expect instability from an operating system. What happens when silicon becomes even more common? I would hate the day my refrigerator had a GPF...
for a DoS attack to be successful, the point is to flood a server that is required to be online at all times and that denial successfully takes them offline for an extended length of time.DoS stands for Denial of Service, in case you were wondering. A DoS attack is anything that denies anyone service. Neither does it have to be against a server, nor does it have to be a flood. For example, the Winnuke attack was neither a flood, nor against a server (assuming that people aren't running servers on Windos).
I would call this a simple software glitch that has the unfortunate problem of causing the phone's OS to crash.
Oh sure, let me just reboot my cellphone. That's no problem, right? I mean software was meant to crash. And if my refrigerator (just wait a few years) suddently decides to crash in the middle of the night, I'll just run down and reboot it as well. No problem!
call it a runtime error. call it a macintosh system error. it's just not a DoS
See above.
--
Re:Stupid and needless technology (Score:1)
Seriously though, isnt it cool in star trek when they can control lights by voice. Sensors could turn lights off when you leave the room etc. They dont need to be accessable to Bob in Austrailia, but the applications are endless.
Having your video recorder available on the net so you can set it recording from work is another very useful thing. As you are driving home you can mumble something about coffee and your car would pick it up, relay it to your kettle and the kettle would switch on, saving you a couple of minutes as its boiled as you get in.
Web enables bog roll is defiantly a useless thing, but there are many applications for web enabled consumer items, or at least a web enabled X10 interface.
I ama big cynic when it comes to these new things, like WAP, but I have often wanted to send a quick email from my old non-wap mobile, or perhaps see the time of the next train.
Re:malformed message (Score:1)
My phone (non wap mind you) receives text messages when I am in a call, if it crashed then, perhaps while driving, I would not be happy. If someone floods my dial up connection I have to reconnect, its annoying. Its not essential I am on 24/7 (in fat its more like 19/7), but It's annoying when I have to disconnect (2 hour time out in the UK).
This is literaly a denial of service, but it's not covered by the conventional DoS definition, which is permanent.
Re:malformed message (Score:1)
Didnt Winnuke rely on port 139 being open, which is, If I can remember back to my windows days, a NetBIOS server port.
Re:malformed message (Score:1)
Good Try... but failed (Score:1)
Why do you try to make Germans bad?
No German would replace every ue with ü...
or every ss with ß..
hm (Score:1)
Re:They didn't keep security in mind... (Score:1)
Re:More SMS fun (Score:1)
(not spam, but I got these prices from this page [www.gsm.nl] it's in Dutch and for the Dutch market though..)
GSM..ahh..Ain't Europe a great place to be right now ;-) (Apart from Asia and Japanof course..)
--
Surveillance (Score:1)
There are several models of GSM mobiles that have a speakerphone capability, which you might still be able to get hold of if you look around.
7110 (Score:1)
...get a real phone, go ericsson or nokia 9110!
Re:malformed message (Score:1)
Mobile phones are becoming more and more complex - there's a huge amount of software in these things, usually upwards of 10s of millions of lines of code, spanning more that one processor. It's never possible to catch all the bugs, although there's (usually) a rigourous test phase to catch as many as possible.
Unfortunately, there's so much competition in the marketplace at the moment that new software has to be designed and coded to a very tight timescale, which means that human error is not just possible, it's very probable.
Your fridge/freezer probably already has some firmware to regulate the currently set temperature and control the quick freeze cycle or the defrost cycle - but as it doesn't have to support TCP/IP, then the firmware size is small - of the order of 10's of K, so the chance of error is reduced.
I'm curious now: If the power went out in the middle of the night, would you get up and check the fuses to work out what had blown, so that you could turn the freezer back on?
More SMS fun (Score:3)
Re:Filter at SMS gateway? (Score:1)
Some characters at the beginning of the message seem to have a special meaning for Nokia phones. A friend of mine sent ascii graph chistmas greetings, but most Nokia phone owners didn't see them, because the message begun with asterisk, which seems to indicate that a control sequence begins.
Re:One if by Bug, Two if by Design... (Score:1)
Anyways, the implication of this was that you could set it on silent, no vibrate, auto-answer, nuke the display and then leave it somewhere close to sensitive discussions. Just call your phone and listen away.
They didn't keep security in mind... (Score:2)
Re: And people laugh..... Oh dear. (Score:2)
What it means is that in North America there is not the infrastructure for digital phones to be always on the digital service. Dual band phones in North America might mean Digital and Analogue, but Dual Band phones in the rest of the world mean two different carrier band frequencies. I think this answers points (1) and (2) as well.
Analogue works because the infrastructure is there. Once the infrastucture is there, digital is MUCH preferable to Analogue, and I say this having been on a digital service for four years now in Europe, and when having to deal with the hiss and crackle of a analogue service both when in Canada and the States, it really annoyed me.
As for the hacking, no it cannot happen on AMPS, but then of course with a cheap scanner, anyone can listen in on your calls.
All this new-fangled technology, it will never last!! End sarcasm.
Re:More SMS fun (Score:3)
Re:Another hole in the WAP protocol? (Score:1)
- the communicator-side changes to mail-application without *any* sign of a received SMS
- same message but tell the phone you got a million new mails -> it'll eventually crash
..to name a couple but actually there's no need to do any special tricks to crash the thing it'll do it eventually anyway by itself
Re:What next? (Score:1)
Technology (Score:1)
of what is it going to be like in another five
years when these devices are dominate in the
market.
When you have a chance to start from a clean
slate why isn't it done right the first time?
The answer is really simple, when you are rushing
to get something finished in a not so timely
manner... usually tests are done for the output
or operation that you expect to recieve.
You keep hacking until it starts coming out the
way it should. Security is usually an after
thought.
Everything seems to ship broken... and companies
only make repairation if it ends up costing
enough money to make it cheaper to fix.
How many of us get paid any more if their
applications are just a little higher quality
or more secure then the next guy. Management
watches time tables... always have and always
will. Until companies start changing, we are
going to see more of these incidencies.
Re:ERICSSON (Score:1)
Re:An alle (Score:1)
cya
YerMaster
You're addicted to the net when
- You call 911 when your ISP goes down
Big deal. (Score:2)
Now imagine that as a phone virus...
not an isolated case (Score:1)
At my company, at least, security and reliability were not high priority issues. First priority was anything that might be visible to the chiefs (high executives of the company) in their use of the phones ("The CEO can't get his messages?!? Get the whole team on it right away!!!"). Second priority was marketing, which generally meant sweeping problems under the rug.
I shudder to think that anyone could be relying on these devices for important, live-and-death issues. They're considerably less reliable than, say, your typical accursed ISP. Don't depend on them!
ya... (Score:1)
Re:WAP-related lockups (Score:2)
SMS is hardly the only way to lock up your GSM
Indeed not. You can permanantly destroy many GSM mobiles (including the SIM card) just by repeatedly hitting them with a sledgehammer.
Yes, that was a joke.
Michael
...another comment from Michael Tandy.
Re:malformed message (Score:2)
No, a smurf attack consisits of sending and ICMP Echo packet to the bradcast address of a subnet who still allows that sort of thing, but the trick is, you spoofed the source IP in the IP header, so every host on that subnet sends an ICMP Echo Response packet to the spoofed source IP (your target). This has the benefit of multiplying you outgoung datastream by the number of hosts on the subnet you are bouncing from. it allows you to flood the target with much more bandwidth than you have available to you.
That is a smurf attack, emailing a Cell Phone does not count.
simlocking a phone (Score:1)
$ecurity Dollar$ (Score:1)
It's scary to think that World War III could be some hacker dismantling America's computer systems, and suddenly we're stuck with very little. I'm quite surprised we haven't focused even more on security.
Now, even my cell phone is at risk. Do you honestly think I'm going to go ahead and submit credit card information over the Internet just yet?
Luckily, this isn't burglary. On the Internet, things are a bit more easily tracked I would think. Security isn't difficult -- precautions aren't hard to fathom. Therefore, it is any company's responsibility to consider this before netting their devices.
I just think it's scary. We're so dependant one these things. But it's no less frightening then the first cars and the chance of getting hit, or even the first horses and stepping in sh*t. (that rhymed)
My point is: this is all necessary and wonderful, but let's just be very, very careful. Hopefully Congress will get moving and other countries will too.
Re:Siemens S10 and Quios (Score:1)
'Good browser' is relative (Score:2)
Re:Update: (Score:1)
DisableSMS(permanently);
}
Re:creapy? (Score:1)
Anybody know how to do this ?? (Score:1)
the upside (Score:1)
Re:More SMS fun (Score:1)
Of course, at $1K for the phone itself, plus probably $200/month for all the services needed to make it worth having, I won't junk my Palm Vx any time soon. Especially since I'm still hoping for CPDP service in my area. Not that I'm holding my breath for that -- there's every indication that pocket-network developers are abandoning PDAs in favor of augmented cell phones, like this puppy. For example, Paypal has discontinued their popular Palm app [palminfocenter.com] in favor of phone-based apps.
Re:What next? (Score:2)
But that reminds me of a funny story. A very long time ago, I was working with an engineer who'd come out of the auto industry. I asked him when we would see ABS brakes in actual consumer cars. He told me he would never drive a car that relied on (possibly buggy) software to stop. "It brings a whole new meaning to the halting problem!"
Historic Nokia bug? (Score:1)
And just HOW does Nextel work so damn well? I think it's somehow magically enchanted.
Blue Neon - quite possibly the perfect semi-caffiene-inspired online comic. [cjb.net]
Re:Anyone know? (Score:1)
Yes, some of the TCP/IP stacks for DOS have some well-known issues... Especially buffer overflows.
Nowadays, they're rare indeed as most internet apps are linked against Watt-32 (the successor to WatTcp). Since it's still actively developed, any DoS attacks can be fixed in the library source and the app can be relinked. Just like on *nix..
And, please... NO DOS IS DEAD EMAILS... Thanks... I get enough of it IRL, don't need it from here too...
--Matt
My uncle Joe felt the same way... (Score:1)
Hmmm... come to think of it, just look how dependent everyone seems to have gotten upon those hi-tech "wheel" doo-hickies. Just look at those tire recalls!
Point is, *any* technology at *any* level may have flaws.
Second time... (Score:4)
Another hole in the WAP protocol? (Score:1)
Re:HA! (Score:1)
One other explanation would be that the comment was written by Al Gore.
---
Nokia 7110 buggy? So what else is new? (Score:1)
Filter at SMS gateway? (Score:4)
Jacco /var/log
---
# cd
Re:Stupid and needless technology (Score:1)
Well, maybe you're not really into this big brother [terra.com] thing. Some guy overhere in The Netherlands is however so interested in it that he web-enabled his entire house [icepick.com] including his frigde and his recylce bin.
---
How mission critical is a cell phone? (Score:2)
Must your desktop computer be online at all times? Must it have zero down time? If not, please give me your IP address, and a vulnerability which causes you to do a full reset on your computer. I'll write an appropriate exploit.
Here's how to turn it into a true DoS.
while(1){crashPhone();
sleep(120);
}
Now as you were noting about this not being a DoS attack, could you please give me your Nokia phone's SMS e-mail gateway address?
----------------------------
howto *g* (Score:1)
Yes, they'll certainly find me... (Score:2)
Fortunately though, most people with the skills to cause such hassles also realize that it's just plain dumb to do such things.
----------------------------
Re:Filter at SMS gateway? (Score:1)
I had written a gateway interface at Pagemart, only to find that almost every beeper had it's own problems. Normally, though, the providers are quick to respond. (Typically, a customer tries to send a JPEG file to their phone.. har har har. it locks up.. doh)
pan
Re:malformed message (Score:1)
Re:'Good browser' is relative (Score:1)
However, things get a bit complicated when the gateway does infact compile the wml/xml. This is a key point not to be ignored, as the phones have to turn the wmlc into xml/wml before any parsing is done.
I agree the error messages leave a lot to be desired (in fact, they are often quite misleading!), but it's not necessarily a plain browser issue..
Of course, the networking and terminal departements of several big telecom companies, such as Nokia and Ericsson, tend to be somewhat seperate (not necessarily a bad thing, actually).
Not true. (Score:3)
That is not true.
Sending a message with 160 chars of '.' in it to older 5110 models caused them to lock up too. I've heard that this was an easter-egg deliberately made by some coder (though I'm not sure is this true or just another urban legend). The newer models don't have the bug (eg. mine doesn't - version 05.07 20-11-98 (you can see the version by typing *#0000#)).
Furthermore, this article [metrolehti.fi] (only Finnish, sorry) says that in some cases the SMS also destroyed the SIM-card (no specifics mentioned).
The article also mentions that Web2Wap has contacted Nokia and Nokia experts will meet with them Wednesday, but Nokia denies getting any contact requests. Typical.
Re:More SMS fun (Score:1)
the specs are:
9110 - 486sx 16mbs ram
9000 - 386 8mbs ram.
linux? hell yeah!
chris
Full Circle (Score:2)
Re:Second time... (Score:2)
Of course, since the bug wasn't detected and fixed at a very early stage, there are several affected firmware revisions. I have no idea if they all work exactly the same way.
Re:ERICSSON (Score:1)
If you sere wondering why you can't use your Ericsson with halfof the existing Wap gateways, well, now you know.
yeah linux is such a priority (Score:1)
It has been denied already (Score:1)
Well this explains quite a bit (Score:1)
Question:
As a monthly paying subscriber locked into a phone contract for a product that is clearly unsuitable for commercial use. ( read that I am self employed) who do I approach for compensation ?
Oh well thanks for the news Im off to inform a few people of the issues.
A real bug in Nokia 7110 (Score:1)
Want do DoS your friend's Nokia 7110? Just send him a calendar note from Nokia 6110 via a SMS. The calendar in 7110 will stop showing calendar notes. This works at least with firmware 4.84, I didn't check any other versions.
I wonder if we will live up to buffer overruns in mobiles. :-)
Re:Siemens S10 and Quios (Score:1)
It just shows standard closed source development (Score:1)
When they wrote the firmware they just made sure that the phone could parse the messages which were sent by another copy of the same program (or a completely standard-compliant version from Ericson, Siemens or whatever).
But they never thought that they would have to handle 3v1l H@x0rs who send messages with fucked up length headers, escape characters or one of the usual other DoS attacks (I don't know anything about SMS, but all protocols kinda look like the other, so I think I can make that assumption)
If I were old enough to remember I coulda sing the "When will they ever learn?" song
My first /. comment !!! woohoo (Score:1)
Re:Sad to say, Nokia doesn't "get it" - any of it. (Score:1)
Re:Stupid and needless technology (Score:3)
This is how that thing called 'progress' works. Someone comes up with a cool new technology. People come up with hundreds of nifty new gadgets and applications for that technology. Those gadgets and applications that people want to use become household items. Those gadgets that people don't want to use show up in fifty years time as jokes in TV shows.
Go back and look at all the stupid ideas people had when they first came up with that "electricity" thing. Think of the wacky ideas people had about how radio and television could be used. Think of the fact that only about one in twenty high-tech startups survive.
The trick, however, is that it's nearly impossible to tell before the fact which gadgets will be wanted, and which will not. Some things that are really good ideas will tank because it was released in the wrong place at the wrong time. Some things that we all think are stupid will turn into the next big craze in consumer electronics. So the only logical thing to do is to produce all of them, and let Darwin sort them out.
We prosper as a society when we allow people to think as wildly as possible, give them enough rope^H^H^Hesources to try their ideas out, take the best, and let the rest drop out.
Charles Miller
--
Re:yeah linux is such a priority (Score:1)
Re:Another hole in the WAP protocol? (Score:2)
Re:'Good browser' is relative (Score:1)
Don't rule out bad wml and/or a picky gateway (that would be my guess).
*-messages? (Score:1)
For some reason these messages end up being empty when they get to the receiver. Somewhat annoying for those of us that like to use the *s to show action taken. Like: "*knocks head in table*... My bad"
Does anybody know what these messages do anyway? Can I use them to tweak my phone or something?
What next? (Score:2)
Re:malformed message (Score:1)
Re:An alle (Score:1)
a) benutze die Englische Sprache b) hör auf scheisse zu schreiben
One if by Bug, Two if by Design... (Score:2)
Also, I've often wondered if a cel.tel could be activated - on the sly - as a surveillance device... i.e. open the microphone in response to a (silent) incoming call/message... it doesn't ring, light up , vibrate or talk... but listens and sends what it hears to an unknown operator.
If not now, then it's just a matter of time...
Re:Not true. (Score:1)
Message on our company Intranet:
"You have a sticker in your private area"
Re:Another hole in the WAP protocol? (Score:3)
Ewan
The first of many I think (Score:4)
I'm willing to bet that today's Nokias are more powerful that the PCs of 15 years ago. What kind of security problems will we be seeing from phones in 5 years time?
Re:HA! (Score:1)
Let's see. Did you mean the original Difference Engine (generally considered to be the forefather of the modern computer), invented by Charles Babbage the Brit?
Or did you mean the first electronic computer, Enigma, invented by The Allies during WW2 (i.e. NOT the Americans only)?
Or did you mean the first non-millitary computer, the Manchester Mark 1, invented by the British?
Or did you mean the first affordable Home Computer, invented by Sinclair Research, yet another non-American company?
So, to which particular definition of "invention of the computer" are you referring, Mr Coward?
Re:Informative link... (Score:1)
Disregard the above, it is a troll. There is no such address and the actual link points... elsewhere.
--
malformed message (Score:4)
Before everybody gets too excited (Score:2)
The 7110 had problems in the early versions of the firmware, but the one shipping the last few months is pretty good. It has the best protocol stack and best browser of the competing Ericsson R320 and Motorola Talkabout. I had to test them all, part of my job. I hope you get your hands on these models so you can compare. Try with several WAP sites, browse around, and decide for yourself.
Check the firmware version of the 7110, 4.80 is already rather good (even though about 6 months old). Type *#0000# to check the version.
BTW, IMHO the Motorola Talkabout has an outright ugly and unfriendly screen. Where on earth has Motorola found such cheap, contrastless LCD screens!?
WAP-related lockups (Score:3)
Earlier in the year we were working on a WAP application for a major automibile company. We actually had to put special effort in to ensure that the application *did not* lock up the phones. We tested the app with a number of phones from different manifacturers, including Nokia (I think the model used was 7110). The shocking part was that _almost all_ could be locked up, usually in different ways (which made things all the more frustrating, of course), and the problems occurred even when using the most basic WML. (the design of WML is another interesting discussion topic, but I guess I would have to leave that rant for another time)
A particularly interesting side of all that was that a lot of the ways in which the problems occurred pointed out to possible buffer overflow problems, something that would explain the lockups (one of the most obvious ones was lockups on some phones when the encoded and compressed WML pages, together with the POST data were above a certain size). Given this observation, I have been pondering since then whether those problems are actually exploitable. If they are, that would be majorly cool, or majorly scary, depending on what side of the fence you are on. Pity I don't have the zeal to delve into phone hacking at this point
Stupid and needless technology (Score:2)
"Hey, I got an idea! Why don't we make people so lazy that they don't ever have to get out of bed to do anything, and at the same time forget about how totally insecure the technology we are creating is, and thus give all those kiddie h4xxors the ability to spoil peoples' food, freeze them to death, starve their animals to death, and submit them to torturous light shows, all via the anonymity and distance of the internet!"
Warranty? (Score:2)
Since phones are more and more software, can we finally reclaim for faulty software?
__
Siemens S10 and Quios (Score:2)
Re:'Good browser' is relative (Score:2)
Since I'm using Orange in the UK, Nokia is also supplying the WAP gateway...
Anyway, as a 'plain user' I would probably have given up on WAP a long time ago due to these hassles - it's quite amazing to me that WAP works so badly for such a high percentage of pages. I happen to have a professional interest in WAP, GPRS, 3G, etc, so I keep on trying occasionally.