I was wondering if that ai created site style had a name. 'hypeslop' seems like it could be perfect.

Australia has laws that require companies that provide a cellular service to follow, not fixing such a exploit would breach these laws. Under no circumstance can a telco, phone manufacturer or intermediary restrict or knowingly allow the restriction of access to Emergency Services. Google in this case would be considered as knowningly allowing the restriction as they're refusing the acknowledge this as an issue, something I'm sure ACMA could act upon or compel Google into fixing.

> I doubt they will block automatically the number if you are under that DOS for a few days in a row.

You doubt correctly. The law is about blocking IMEI numbers of phones that use the 3g network to dial 000 despite being 4g devices.

How can 000 move to 5G only?

Load apk, select which sim you want to use, enter Android victims phone number, hit send, it will crash telephony app and it’ll restart.. carrier will resend the text message as there was no acknowledgment crashing it again in a loop.

Only “fix” for this attack is to place SIM card in a non-Android phone to ack the inbound messages, or wait a few days of constant disconnects.

> The demo APK sends a message to the phone itself

That's not what the readme on the repo says.

"Install on a sender device, enter (or auto-fill from an active SIM) the target number, pick the sending SIM, and tap SEND CRASH SMS. Observe on the target..."

It's not clear, which makes me skeptical that this is all that serious of an issue.

I'd like to know - can any devices actually put such a malformed message onto the carrier network? It probably requires at least a custom app that would never be allowed on an app store, if it's possible at all. And do any carriers actually let it go through their network and to a device like a normal message? It's entirely possible the malformed message would crash some software in the carrier's processing stack first and so never be delivered. And if it doesn't, they could easily add a check to block such messages. It's difficult to believe they don't already have some sort of protection against spamming tons of messages to any device. It's also entirely possible it works differently on different carriers, and some but not others might add blocks for this but not make a press release about it or anything.

This seems more like meh, minor bug, fix it quietly in the next Android release, not OMG the world is on fire to me.

Where does it say that it's carrier configuration? Looking through the page it mentions WAP and PDU, seems PDU from my skimming is just a part of encoding WAP messages, so basically anyone being able to send WAP messages onto the network will have the carrier happily retransmitting it unless carriers starts blocking them/filtering these incorrect ones?

So you can allways trust the carriers. So then it's maybe a feature.

If the carrier is compromised an attacker could destroy millions of phones and cause humongous economic losses no?

It seems to me that the scenario is that someone spoofing a cell tower can disable your phone practically forever and recovery requires expert interference. Maybe I'm mistaken, though, it's not clear from the description whether a spoofed cell tower would suffice and whether it needs to remain in the vicinity to repeat the attack often enough or whether sending 200 corrupt SMS messages in one go would suffice.

wap-push is a legacy protocol, it predates mms's, android can send it fine, ios just ignores them.

> Only catch ArrayIndexOutOfBoundsException

:grimace:

Just guessing - maybe that re-delivery from telcom is the cause as message reception is never acknowledged?

Isn't it easier to kick to the back anyone with a mobile phone with a sound?

If this was a user controlled option, I would enable this. Not that my phone wouldn't receive sms at all, but just go into do not disturb mode.

If it was filed as a security issue, most well-set-up projects with public issue trackers would keep it closed off only to a reporter and internal security audit team.

Perhaps it was never really declassified in the tracker.

You can't access issues that are not assigned to you. I remember reporting a bug via VRP once, and it was marked as duplicated with another id, that I cannot access and see the original report.

Security sensitive issues have restricted visibility.

That’s insane, and I’d like to know more about how that even came to pass. A quick search isn’t surfacing anything relevant, do you have a link?

There was also a bug related to positioning requests for emergency services that crashed android phones:

"core Android Telephony Framework GPS race condition from the early days of Android (roughly 2011–2014)."

My AI was unable to find any existing webpages for this though?

Also there was this:

https://community.oneplus.com/thread/579700

negative attention is still attention..."no such thing as bad publicity"- PT Barnum.

Slop and real issue. Wap-push is a legacy format for sending urls via sms. Bug is a stupid one but it exists.

Google are rather vague in their triage, they just said temporary DoS does not qualify, then rejected to investigate further.

The "if" is doing a lot of heavy lifting. Can it do what it claims to do? LLMs are always hallucinating that they've found the most severe bug in software history.

Why are you believing an entirely Claude generated webpage?

mind boggles, issue is they're swamped with AI slop and high number of findings, they're using AI assistance operated by a 3rd party to handle researcher submissions so many legitimate findings slip through the cracks.

I've sent weird SMS messages through my (rooted) phone before. Silent SMS messages (useful for police trying to activate your phone for triangulation) still returned delivery reports a year or two ago, allowing someone to find out if someone else's phone is on without the target ever noticing.

I think Android removed the ability to send more annoying messages through its normal APIs (like flash SMS messages) but if you have access to any modem (either a smartphone or a full ESP32 dev board costing <50 bucks on AliExpress for 4G LTE), you can bypass any such restriction.

Carrier firewalls will probably filter these messages out but I wouldn't rely on it.

They do accept/forward messages without checking if they are special carrier-only ones. ~10 years ago I had some fun sending a "voicemail received" message to people, which caused android phones to display a notification which couldn't ever be dismissed. IIRC it only worked on HTC phones and required root/xposed. SS7 in general is built with total trust in connected systems. Edit: I think it was called "HushSMS"

Back in the day you could send logos, ringtones, and bunch of other random crap thru carrier APIs, provided you signed a blood contract with them lol

Those APIs are probably still online, and still require to nail your ass to the contract, but technically I would assume it's possible.

Looks like the website offers an APK.

But not all SMS are text messages for the user.

Claude is primarily a tool for spamming human attention.

I just wanted a home for it to share, llm just polished it up.

the message is silent, no notification notifying of the attackers origin, doesn't matter if it's locked, or connected to mobile data, so i stand by what is written.

I don't care about the credit, i have enough CVE's under my belt which are higher severity, none which have dedicated write-ups. i care that this gets fixed and give answers to those who are experiencing their phones constantly disconnecting from carrier.

>...which is the exact shape of a "Destructive Remote DoS" in the VRP's own rules.

The trend of Claude referring to everything as having a "shape" irrationally annoys the hell out of me. What an absolutely idiotic way to say "X is like Y."

No need to be dramatic, some people’s first language isn’t English, some have dyslexia, some just hate writing (myself) and won’t bother reading it twice to fix typos or grammar, your criticism is ok if the context doesn’t matter, but I would be ok with a fully generated landing page if the exploit is worthy.

are you ok?

get a grip. now you’re behaving like the guy who, when pointed at the moon, looks at the finger

Blame heartbleed for the practice, which long predates ChatGPT and vibecoding. Human psychology is to blame. Only nerds are going to find CVE-2014-0160 triggering, but if I say heartbleed everyone who was there remembers.

I think it's a good idea when there is no CVE and a don't fix status.

Before this practice in general you simply released the exploit and see if enough chaos triggers a fix.

why not? If you don't like it don't click it. Is not that the main purpose of the web that everybody can publish a web site?

Why? I like the presentation.

Not if it helps raise awareness and gets companies to notice. Is peanutbutterjelly.co.uk more worthy of a domain ?

agreed, we should all use gopher and block all web traffic, go back to text based systems, use single threaded operating systems and use token ring NIC's

feel free to curl it, or review the repo https://github.com/MarkBlah/smsofdeath/