"SMS of Death"

[unixronin]

Via Bruce Schneier: Two German researchers have found a way to attack most common mobile "feature phones" (more than 80% of mobile phones in use worldwide), causing them to shut down and drop off cellular networks, simply by sending a single SMS message tailored to the phone manufacturer and platform.  The attack does not require the phone's owner to read or respond to the message; all that is necessary is for the phone to receive it.  A set of five SMS messages, sent using a cheap or free Internet SMS broadcast service, could knock out almost all cellular phones.

High-end smart phones are more likely to be configured to automatically install updates to protect against attacks, [Aurélien Francillon, a researcher in the system security group at ETH Zurich in Switzerland] says.  Francillon believes that the vulnerabilities that Mulliner found on feature phones "may remain open for a very long time before they are corrected on end users' phones—if ever."

"Smart phones" are not subject to this particular attack, but don't get cocky.  HTC phones running the Windows Mobile platform, and iPhones, can actually be taken over via an SMS attack.

Comments

[ithildae]

Security is an illusion. Obscurity is the only defense. Liberty and freedom to use our devices as we see fit is the only viable, long-term solution. (Unfortunately, it requires more knowledge.)

[unixronin]

Security through obscurity isn't a defense. Real security requires three things: awareness, preparedness, and defense in depth.

[ithildae]

Without control of our devices, we are left with the service provider's efforts for our security. Historically, that has proven ... inadequate. Without a more active voice in the matter, all we can rely on is obscurity. I do not dispute your analysis in any way. We simply do not have enough control to exercise preparedness or defense.