News for hackers. Stuff that matters.

A comment on The Hacker is Watching. Parent comment

Re:The Hacker is Watching by breckinloggins on Sunday January 22, 2012 @06:57PM (#3498331)
There would have to be a buffer overrun in the text message handling code plus a way to exploit it in 160 characters. That sounds difficult, unless I'm wrong about the fact that the carrier enforces the limit.

I could maybe see doing it with MMS or iMessage. The more I think about it, the more interesting this question is...

Has anyone heard of any exploitable flaws in a phone's SMS software?

[ Parent | on HN ]
Re:The Hacker is Watching by tryke on Sunday January 22, 2012 @08:54PM (#3498653)
CVE-2009-2204 was a vulnerability in iOS' SMS handling (versions < 3.0.1).

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2204

[ Parent | on HN ]
Re:The Hacker is Watching by nitrogen on Sunday January 22, 2012 @10:12PM (#3498826)
It's not just buffer overruns that can cause issues. You can crash the font display system by sending characters that aren't handled properly. You may also be able to direct the phone to download a hacked firmware update via SMS (AIUI carriers sometimes use specially-coded SMS messages to tell phones to update their software, PRL, etc.).
[ Parent | on HN ]
Re:The Hacker is Watching by zandor on Sunday January 22, 2012 @07:10PM (#3498383)
This might be of interest: Fuzzing the Phone in your Phone [26C3]

http://www.youtube.com/watch?v=qBWc67iy4zI

[ Parent | on HN ]
Re:The Hacker is Watching by nookiemonster on Monday January 23, 2012 @12:36AM (#3499241)
On windows mobile 6.0, you could send wap pushes that linked to signed apps which would auto-execute/install.

right now, there aren't any vulns which are similar in danger that I am aware of. SMS isn't a super friendly medium for stack manipulation, and most modern mobile OS'es implement ASLR.

The browser is the more likely vector today.

[ Parent | on HN ]
Re:The Hacker is Watching by artursapek on Sunday January 22, 2012 @07:02PM (#3498356)
From what I have seen longer messages get sent as multiple segmented texts.
[ Parent | on HN ]