Sign in with
Sign up | Sign in

SMS Messages Can Kill Mobile Phones

By - Source: Tom's Guide US | B 25 comments

You may not think much of SMS messages hitting your phone every day, but two researchers revealed earlier today at a hacking conference in Berlin, Germany, that SMS could be used to attack and shut down individual cell phones or an entire carrier network.

The attack discussed at the 27C3 conference resemble the nature of a denial of service attack with a huge number of messages being sent of cell phones. In this specific case, Collin Mulliner and Nico Golde of the Technical University of Berlin tested cell phones in an isolated environment and shot 120,000 messages at them. The phones tested were simple feature phones (as opposed to smartphones such as the iPhone or Android devices) with just one processors as their operating systems usually shut down when just one application crashes. It is estimated that there are currently more than 4.6 billion feature phones in use today.

German website heise.de reports that Nokia's 540 struck out with a “white screen of death”, forced a restart and shut down completely after the third attack. Samsung phones shut down when they were flooded with SMS messages that were separated into multiple parts, LG phones were vulnerable to buffer overflow attacks and one unnamed device was put into a permanent offline state.

According to Mulliner and Golde, such SMS attacks could be used to prevent individual users from being reachable. They could be used to shut down an entire network when tens of thousands of attacked devices are trying to log on to a carrier network. The researchers noted that it was difficult to reach cell phone manufacturers to report software flaws and that the general delivery method for patches should be improved.

Discuss
Display all 25 comments.
This thread is closed for comments
  • -1 Hide
    N.Broekhuijsen , December 29, 2010 4:25 PM
    Yes, thats all great, but NO mobile phone network is going to be capable of actually processing so many messages at once. The network is WAAAY sooner to crash probably then the mobile phones!

    There is only so much data that can go through the air. They did this under "Isolated circumstances", probably with an entire network dedicated to 1 phone or so, not a couple thousand phones.

    Interesting, but not surprising.
  • 5 Hide
    igot1forya , December 29, 2010 4:33 PM
    This reminds me of the days when you could kill an AOL Dial-Up session by flooding the an other user with IM requests... ;) 
  • -2 Hide
    f-14 , December 29, 2010 4:47 PM
    much better then one of marcus yams articles, thanks for the heads up
  • 0 Hide
    dark_lord69 , December 29, 2010 4:49 PM
    Huh... So a program setup to automatically send hundreds of SMS texts could disable a basic phone.. OR if you specified multiple recipients many phones...

    Sounds like mail bombing only with SMS texts and it results a phone that needs to be rebooted.
  • 0 Hide
    dredg98 , December 29, 2010 4:54 PM
    android has a app for sms bombing should be taken off the Market
  • 1 Hide
    dark_lord69 , December 29, 2010 5:04 PM
    xbeaterYes, thats all great, but NO mobile phone network is going to be capable of actually processing so many messages at once. The network is WAAAY sooner to crash probably then the mobile phones!There is only so much data that can go through the air. They did this under "Isolated circumstances", probably with an entire network dedicated to 1 phone or so, not a couple thousand phones.Interesting, but not surprising.

    I don't think so. Do you know how small an of an amount of data a txt represents?
    A single text is about 160 bytes of data. If you sent 100,000 texts it would equal 16,000,000 or 16MB. 16MB isn't jack sh*t. When you watch a movie on netflix the incoming data would be about 400MB - 600MB (or more) depending on the quality of the video. Movies streamed on a playstation are up to and over 1,600MB which would be 100,000,000 texts. YOU CANNOT CRASH A NETWORK BY SENDING TEXTS. Network capabilities go FAR beyond the tiny amount of data that is sent within a text.
  • 5 Hide
    hellwig , December 29, 2010 5:16 PM
    Igot1foryaThis reminds me of the days when you could kill an AOL Dial-Up session by flooding the an other user with IM requests...

    Yeah, I remember the wedge. If a chatroom you wanted to be on was full, you could wedge someone off the network to get in. Real jerk move, but then, people tend to be that way.

    dredg98android has a app for sms bombing should be taken off the Market

    Imagine the financial damage you could do to someone if they didn't have a messaging plan. Of course, hopefully they could track it back to the attacker and sue the crap out of them for any damages.

    dark_lord69I don't think so. Do you know how small an of an amount of data a txt represents?A single text is about 160 bytes of data. If you sent 100,000 texts it would equal 16,000,000 or 16MB. 16MB isn't jack sh*t. When you watch a movie on netflix the incoming data would be about 400MB - 600MB (or more) depending on the quality of the video. Movies streamed on a playstation are up to and over 1,600MB which would be 100,000,000 texts. YOU CANNOT CRASH A NETWORK BY SENDING TEXTS. Network capabilities go FAR beyond the tiny amount of data that is sent within a text.

    You aren't thinking in the proper terms. Its not the amount of data, its the amount of requests. DDOS attacks don't work because they flood servers with gigabytes of data, they work because they flood servers with millions of simple requests. It is the processing required to handle all of those requests that bring websites down, and its that same processing that would bring-down a cell network long before a cell-phone. You couldn't run an SMS botnet to attack a particular cell-phone, the cell network would never be able to handle processing all those messages and routing them to their destination. It would serve, however, to bring down the network which is probably the primary goal anyway.
  • 1 Hide
    dkant1n , December 29, 2010 5:21 PM
    Really interesting. I'm surprised that networks dont have protections against this kind of "attacks"
  • 1 Hide
    mikem_90 , December 29, 2010 5:28 PM
    dkant1nReally interesting. I'm surprised that networks dont have protections against this kind of "attacks"


    Development time and business. Why spend 2-4 times the development time to make something you could spend the normal time and then upgrade it later as a 'feature' and maybe wring some money out of congress to Upgrade your infrastructure?
  • 1 Hide
    joebob2000 , December 29, 2010 6:45 PM
    dark_lord69I don't think so. Do you know how small an of an amount of data a txt represents?A single text is about 160 bytes of data. If you sent 100,000 texts it would equal 16,000,000 or 16MB. 16MB isn't jack sh*t. When you watch a movie on netflix the incoming data would be about 400MB - 600MB (or more) depending on the quality of the video. Movies streamed on a playstation are up to and over 1,600MB which would be 100,000,000 texts. YOU CANNOT CRASH A NETWORK BY SENDING TEXTS. Network capabilities go FAR beyond the tiny amount of data that is sent within a text.


    -1, Dumb. Do you get that SMS operates on a special channel in the cell phone system, a channel that has a much slower base speed? And on that channel, the timeslices for SMS messages to be executed are not infinite? It is very possible to saturate the SMS pathway with a relatively small number (100,000) of messages.

    But you are on the right track. Cell providers need to abandon public SMS use in favor of IP based solutions that DO scale with network bandwidth. Now if only the providers didn't stand to lose millions in SMS fees each year by doing such a thing...
  • -1 Hide
    joebob2000 , December 29, 2010 6:46 PM
    dkant1nReally interesting. I'm surprised that networks dont have protections against this kind of "attacks"


    And risk losing the revenue generated by someone who goes on a SMS binge and rightfully racks up 100,000 messages? That's $25,000!!!
  • -1 Hide
    dogman_1234 , December 29, 2010 6:55 PM
    So, could SMS beomce a malicous tool in crashing via file to file? Like a virus. A virus SMS could travel phone to phone on a network and when it crosses the network threshhold infect another network and 'crash' the previous one...repeating itself?
  • 0 Hide
    nevertell , December 29, 2010 7:58 PM
    I once had a program on my symbian that could send a virus sms, and that actually crashed a non-symbian feature phone.
  • -1 Hide
    h2o_skiman , December 29, 2010 8:13 PM
    Come on - think people.
    Just how many mobile phones are out there and how many SMS messages get sent every second to all various mobile phones in one system. Many teens have logged more than a thousand per day. Think about people who subscribe to certain SMS alerts. Some servers send out tens of thousands of SMS messages at one time. The only thing is they are going to tens of thousands of phones. Instead of hundreds of thousands going from many phones to many phones, just direct them to a single phone. It would not be difficult for the network to handle 100,000 sms messages to a single phone.

    Just as a simple test, with one click I sent myself 100 SMS messages to my mobile via email, from yahoo using the address multiple times in the to:, cc: and bcc: fields. In less than one minute (37 seconds), all 100 separate SMS messages arrived on my android phone. Given the extrapolation of the above, I could theoretically get 10,000 SMS messages in about 1 hour.

    It would not be difficult to launch multiple mail sends simultaneously from a single computer, let alone a botnet.

    Since I do not have an unlimited text plan, I am not going to test the limits further, but I think everyone is underestimating the capabilities of the mobile networks to handle the large number of requests.

    What the article was about was that non-smartphones cannot handle such a load of incoming messages. Several years ago, one of my older phones would lock up if I did not delete the text messages already received. If someone blasted SMS messages to that phone, even a hundred sent every couple of minutes, they will just lock up.
  • -2 Hide
    jerreece , December 29, 2010 8:28 PM
    Quote:
    one unnamed device was put into a permanent offline state.


    This is my favorite line. I wonder if this was an Apple product. :)  Maybe that's why it's "unnamed". SSsshhhh.... quiet... the antenna works...
  • 1 Hide
    BulkZerker , December 29, 2010 8:41 PM
    Jerreece, your reading comprehension sucks.

    They were dumbphones used in the test. Not android, blackberry, or iPhones.

    Also the hodling it wrong meme is older than cake.
  • 0 Hide
    chickenhoagie , December 29, 2010 9:34 PM
    its very easy to flood another persons phone via text messages..I do it with my iphone all the time. i just type a period and send as fast as i can. most other peoples' phones can't handle the mass income of messages coming in. I've made peoples' phones restart on them a dozen times by doing this. Its quite funny, especially when you have someone harassing you on the other end. they think twice about calling you again. :) 
  • 0 Hide
    tonitelaoag , December 30, 2010 12:07 AM
    these posting above of products messes with my reading other useful posts here , stop it please
  • 0 Hide
    mayankleoboy1 , December 30, 2010 12:57 AM
    already happens in my country with hundreds of sms on my phone daily about telemarketing
  • 0 Hide
    fancarolina , December 30, 2010 3:55 AM
    jerreeceThis is my favorite line. I wonder if this was an Apple product. Maybe that's why it's "unnamed". SSsshhhh.... quiet... the antenna works...


    "The phones tested were simple feature phones (as opposed to smartphones such as the iPhone or Android devices)"

    Someone was so eager to Apple bash they forgot to read first.
Display more comments
Tom’s guide in the world
  • Germany
  • France
  • Italy
  • Ireland
  • UK
Follow Tom’s guide
Subscribe to our newsletter