SlideShare a Scribd company logo
1 of 25
Download to read offline
0class2DOS
Bogdan ALECU
www.m-sec.net
@msecnet
ABOUT…
Independent security researcher
Sysadmin @ Levi9
Passionate about security, specially when it’s related to
mobile devices; started with NetMonitor (thanks
Cosconor), continued with VoIP and finally GSM
networks / mobile phones
@msecnet / www.m-sec.net
TOPICS
▪ SMS Intro
▪ Fun stuff with SMS
▪ Wrong implementation of SMS
▪ Can it be fixed?
▪ Conclusions
SMS INTRO
▪ SMS stands for Short Message Service and represents a
way of communication via text between mobile phones
and/or fixed lines, using a standardized protocol. It is an
effective way of communication as the user just writes
some text and it’s almost instantly delivered to the
destination.
▪ The provision of SMS makes use of a Service Center,
which acts as a store and forward center for short
messages
SMS INTRO
• Two different point-to-point services have been defined:
mobile originated and mobile terminated
• An active MS shall be able to receive a short message
TPDU - Transfer protocol data unit - (SMS-DELIVER) OR
to submit a short message TPDU (SMS-SUBMIT) at any
time …

independently of whether or not there is a
speech or data call in progress
SMS DEVELOPMENT

How can you send other types of SMS?
▪ By using a modem and manually composing
the message
▪ By using a software that will create the
message
FUN STUFF WITH SMS
• Notifications
http://mobiletidings.com/2009/07/08/voicemail-waitingindication-sms/
DCS:
0xC8 – turn on voicemail
0xC9 – turn on fax
0xCA – turn on email
0xCB – turn on other message
0xC0 – turn off voicemail
0xC1 – turn off fax
0xC2 – turn off email
0xC3 – turn off other message
FUN STUFF WITH SMS
• “Silent” message
The receiving device must acknowledge receipt of the
message (so you can get a delivery receipt), but the content
of the message is to be discarded
Some carriers might restore it
PID: 0x40
DCS: 0xC0
FUN STUFF WITH SMS
• Service Load (WAP Push)
PID: 0x00
DCS: 0x04 (binary encoding)
WHEN THINGS GO WRONG
WHEN THINGS GO WRONG
Octets

Description

00

Info about SMSC – here the length is 0, which means that the
SMSC stored on SIM should be used.

01

There is no reply path, User Data Header, Status Report Request,
Validity Period

00

TP-Message-Reference. The "00" value here lets the phone set
the message reference number itself

0B

Address-Length. Length of phone number (11)

91

Type-of-Address. Here it is the international format of the phone
number

4421436587F9

The phone number in semi octets – 44123456789

00

PID, none specified

00

DCS, none specified

0B

User-Data-Length. Length of message = length of septets = 11

E8329BFD06DDDF723619

User-Data. These octets represent the message "hello world"
WHEN THINGS GO WRONG

a) Set the modem in PDU mode: AT+CMGF=0
b) Check if modem is able to process SMS: AT+CSMS=0
c) Send the message: AT+CMGS=23 >
0001000B914421436587F900000BE8329BFD06DDDF723619
WHEN THINGS GO WRONG

Class 0 /flash message defined in Data Coding Scheme (ETSI GSM 03.38)
DCS = 10 (hex)
When a mobile terminated message is class 0 and the MS has the
capability of displaying short messages, the MS shall display the
message immediately […]
The message shall not be automatically stored in the SIM or ME
WHEN THINGS GO WRONG
WHEN THINGS GO WRONG
Sending multiple class 0 messages
WHEN THINGS GO WRONG
Sending multiple class 0 messages
WHEN THINGS GO WRONG

PoC videos:
https://vimeo.com/80539057
https://vimeo.com/69643571
WHEN THINGS GO WRONG

Class 0 message Denial-of-Service
When sending over 30 messages to a Google device running Android:
• Messaging application stops
• Phone reboots
• Radio application restarts, but Internet no longer works
If SIM PIN protection is enabled -> no phone signal, no calls
WHEN THINGS GO WRONG

Class 0 message Denial-of-Service
• Reported to Google over 1 year ago
• Finally got a reply in July
• Still have no idea when / if this will be fixed
• Tested on Galaxy Nexus, Nexus 4 with Android 4.1-4.3
• Google devices with Android 4.4 KitKat (Nexus 5) are also affected!
FIX ME!
FIX ME!

• Class0Firewall application available in Google Play
• Thanks to Michael Mueller (@c0rnholio)
• You define the threshold, then Class0Firewall will
block any incoming “flash” messages
https://play.google.com/store/apps/details?id=com.
silentservices.class0firewall
FIX ME!
CONCLUSIONS

• Be careful on how you implement SMS
• Check as many messages types as possible
• Sometimes it may not be the number of
messages that causes the problem, but the type
of message
Thank you!
msecnet
www.mwww.m-sec.net
alecu@malecu@m-sec.net

More Related Content

Similar to DefCamp 2013 - 0Class2DOS

Whatsapp Business API Solution
Whatsapp Business API SolutionWhatsapp Business API Solution
Whatsapp Business API SolutionRouteMob
 
CNIT 128 Ch 2: Hacking the cellular network
CNIT 128 Ch 2: Hacking the cellular networkCNIT 128 Ch 2: Hacking the cellular network
CNIT 128 Ch 2: Hacking the cellular networkSam Bowne
 
SMS & MMS Technologies
SMS & MMS TechnologiesSMS & MMS Technologies
SMS & MMS TechnologiesArun Shukla
 
3Com 7030-10060
3Com 7030-100603Com 7030-10060
3Com 7030-10060savomir
 
3Com 3C10116 / 655-0040-0
3Com 3C10116 / 655-0040-03Com 3C10116 / 655-0040-0
3Com 3C10116 / 655-0040-0savomir
 
3Com 7030-10062
3Com 7030-100623Com 7030-10062
3Com 7030-10062savomir
 
SMS-SMPP-Concepts
SMS-SMPP-ConceptsSMS-SMPP-Concepts
SMS-SMPP-ConceptsDuy Do Phan
 
Leveraging Zend Framework for Sending Push Notifications
Leveraging Zend Framework for Sending Push NotificationsLeveraging Zend Framework for Sending Push Notifications
Leveraging Zend Framework for Sending Push NotificationsMike Willbanks
 
3Com 7030-10190
3Com 7030-101903Com 7030-10190
3Com 7030-10190savomir
 
3Com 7025015118640
3Com 70250151186403Com 7025015118640
3Com 7025015118640savomir
 
3Com 7030-10021
3Com 7030-100213Com 7030-10021
3Com 7030-10021savomir
 
3Com 1667-010-050-3.01
3Com 1667-010-050-3.013Com 1667-010-050-3.01
3Com 1667-010-050-3.01savomir
 
3Com 3C10115 / 655-0010-0
3Com 3C10115 / 655-0010-03Com 3C10115 / 655-0010-0
3Com 3C10115 / 655-0010-0savomir
 
3Com 02-0020-004
3Com 02-0020-0043Com 02-0020-004
3Com 02-0020-004savomir
 
3Com 3C6010
3Com 3C60103Com 3C6010
3Com 3C6010savomir
 
3Com 7030-10150
3Com 7030-101503Com 7030-10150
3Com 7030-10150savomir
 

Similar to DefCamp 2013 - 0Class2DOS (20)

Whatsapp Business API Solution
Whatsapp Business API SolutionWhatsapp Business API Solution
Whatsapp Business API Solution
 
I mode
I modeI mode
I mode
 
CNIT 128 Ch 2: Hacking the cellular network
CNIT 128 Ch 2: Hacking the cellular networkCNIT 128 Ch 2: Hacking the cellular network
CNIT 128 Ch 2: Hacking the cellular network
 
SMS & MMS Technologies
SMS & MMS TechnologiesSMS & MMS Technologies
SMS & MMS Technologies
 
128-ch2.pptx
128-ch2.pptx128-ch2.pptx
128-ch2.pptx
 
CCNA
CCNA CCNA
CCNA
 
3Com 7030-10060
3Com 7030-100603Com 7030-10060
3Com 7030-10060
 
3Com 3C10116 / 655-0040-0
3Com 3C10116 / 655-0040-03Com 3C10116 / 655-0040-0
3Com 3C10116 / 655-0040-0
 
3Com 7030-10062
3Com 7030-100623Com 7030-10062
3Com 7030-10062
 
SMS-SMPP-Concepts
SMS-SMPP-ConceptsSMS-SMPP-Concepts
SMS-SMPP-Concepts
 
Leveraging Zend Framework for Sending Push Notifications
Leveraging Zend Framework for Sending Push NotificationsLeveraging Zend Framework for Sending Push Notifications
Leveraging Zend Framework for Sending Push Notifications
 
3Com 7030-10190
3Com 7030-101903Com 7030-10190
3Com 7030-10190
 
3Com 7025015118640
3Com 70250151186403Com 7025015118640
3Com 7025015118640
 
3Com 7030-10021
3Com 7030-100213Com 7030-10021
3Com 7030-10021
 
3Com 1667-010-050-3.01
3Com 1667-010-050-3.013Com 1667-010-050-3.01
3Com 1667-010-050-3.01
 
3Com 3C10115 / 655-0010-0
3Com 3C10115 / 655-0010-03Com 3C10115 / 655-0010-0
3Com 3C10115 / 655-0010-0
 
3Com 02-0020-004
3Com 02-0020-0043Com 02-0020-004
3Com 02-0020-004
 
3Com 3C6010
3Com 3C60103Com 3C6010
3Com 3C6010
 
I - Mode Technology
I - Mode TechnologyI - Mode Technology
I - Mode Technology
 
3Com 7030-10150
3Com 7030-101503Com 7030-10150
3Com 7030-10150
 

More from DefCamp

Remote Yacht Hacking
Remote Yacht HackingRemote Yacht Hacking
Remote Yacht HackingDefCamp
 
Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Mobile, IoT, Clouds… It’s time to hire your own risk manager!Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Mobile, IoT, Clouds… It’s time to hire your own risk manager!DefCamp
 
The Charter of Trust
The Charter of TrustThe Charter of Trust
The Charter of TrustDefCamp
 
Internet Balkanization: Why Are We Raising Borders Online?
Internet Balkanization: Why Are We Raising Borders Online?Internet Balkanization: Why Are We Raising Borders Online?
Internet Balkanization: Why Are We Raising Borders Online?DefCamp
 
Bridging the gap between CyberSecurity R&D and UX
Bridging the gap between CyberSecurity R&D and UXBridging the gap between CyberSecurity R&D and UX
Bridging the gap between CyberSecurity R&D and UXDefCamp
 
Secure and privacy-preserving data transmission and processing using homomorp...
Secure and privacy-preserving data transmission and processing using homomorp...Secure and privacy-preserving data transmission and processing using homomorp...
Secure and privacy-preserving data transmission and processing using homomorp...DefCamp
 
Drupalgeddon 2 – Yet Another Weapon for the Attacker
Drupalgeddon 2 – Yet Another Weapon for the AttackerDrupalgeddon 2 – Yet Another Weapon for the Attacker
Drupalgeddon 2 – Yet Another Weapon for the AttackerDefCamp
 
Economical Denial of Sustainability in the Cloud (EDOS)
Economical Denial of Sustainability in the Cloud (EDOS)Economical Denial of Sustainability in the Cloud (EDOS)
Economical Denial of Sustainability in the Cloud (EDOS)DefCamp
 
Trust, but verify – Bypassing MFA
Trust, but verify – Bypassing MFATrust, but verify – Bypassing MFA
Trust, but verify – Bypassing MFADefCamp
 
Threat Hunting: From Platitudes to Practical Application
Threat Hunting: From Platitudes to Practical ApplicationThreat Hunting: From Platitudes to Practical Application
Threat Hunting: From Platitudes to Practical ApplicationDefCamp
 
Building application security with 0 money down
Building application security with 0 money downBuilding application security with 0 money down
Building application security with 0 money downDefCamp
 
Implementation of information security techniques on modern android based Kio...
Implementation of information security techniques on modern android based Kio...Implementation of information security techniques on modern android based Kio...
Implementation of information security techniques on modern android based Kio...DefCamp
 
Lattice based Merkle for post-quantum epoch
Lattice based Merkle for post-quantum epochLattice based Merkle for post-quantum epoch
Lattice based Merkle for post-quantum epochDefCamp
 
The challenge of building a secure and safe digital environment in healthcare
The challenge of building a secure and safe digital environment in healthcareThe challenge of building a secure and safe digital environment in healthcare
The challenge of building a secure and safe digital environment in healthcareDefCamp
 
Timing attacks against web applications: Are they still practical?
Timing attacks against web applications: Are they still practical?Timing attacks against web applications: Are they still practical?
Timing attacks against web applications: Are they still practical?DefCamp
 
Tor .onions: The Good, The Rotten and The Misconfigured
Tor .onions: The Good, The Rotten and The Misconfigured Tor .onions: The Good, The Rotten and The Misconfigured
Tor .onions: The Good, The Rotten and The Misconfigured DefCamp
 
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...DefCamp
 
We will charge you. How to [b]reach vendor’s network using EV charging station.
We will charge you. How to [b]reach vendor’s network using EV charging station.We will charge you. How to [b]reach vendor’s network using EV charging station.
We will charge you. How to [b]reach vendor’s network using EV charging station.DefCamp
 
Connect & Inspire Cyber Security
Connect & Inspire Cyber SecurityConnect & Inspire Cyber Security
Connect & Inspire Cyber SecurityDefCamp
 
The lions and the watering hole
The lions and the watering holeThe lions and the watering hole
The lions and the watering holeDefCamp
 

More from DefCamp (20)

Remote Yacht Hacking
Remote Yacht HackingRemote Yacht Hacking
Remote Yacht Hacking
 
Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Mobile, IoT, Clouds… It’s time to hire your own risk manager!Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Mobile, IoT, Clouds… It’s time to hire your own risk manager!
 
The Charter of Trust
The Charter of TrustThe Charter of Trust
The Charter of Trust
 
Internet Balkanization: Why Are We Raising Borders Online?
Internet Balkanization: Why Are We Raising Borders Online?Internet Balkanization: Why Are We Raising Borders Online?
Internet Balkanization: Why Are We Raising Borders Online?
 
Bridging the gap between CyberSecurity R&D and UX
Bridging the gap between CyberSecurity R&D and UXBridging the gap between CyberSecurity R&D and UX
Bridging the gap between CyberSecurity R&D and UX
 
Secure and privacy-preserving data transmission and processing using homomorp...
Secure and privacy-preserving data transmission and processing using homomorp...Secure and privacy-preserving data transmission and processing using homomorp...
Secure and privacy-preserving data transmission and processing using homomorp...
 
Drupalgeddon 2 – Yet Another Weapon for the Attacker
Drupalgeddon 2 – Yet Another Weapon for the AttackerDrupalgeddon 2 – Yet Another Weapon for the Attacker
Drupalgeddon 2 – Yet Another Weapon for the Attacker
 
Economical Denial of Sustainability in the Cloud (EDOS)
Economical Denial of Sustainability in the Cloud (EDOS)Economical Denial of Sustainability in the Cloud (EDOS)
Economical Denial of Sustainability in the Cloud (EDOS)
 
Trust, but verify – Bypassing MFA
Trust, but verify – Bypassing MFATrust, but verify – Bypassing MFA
Trust, but verify – Bypassing MFA
 
Threat Hunting: From Platitudes to Practical Application
Threat Hunting: From Platitudes to Practical ApplicationThreat Hunting: From Platitudes to Practical Application
Threat Hunting: From Platitudes to Practical Application
 
Building application security with 0 money down
Building application security with 0 money downBuilding application security with 0 money down
Building application security with 0 money down
 
Implementation of information security techniques on modern android based Kio...
Implementation of information security techniques on modern android based Kio...Implementation of information security techniques on modern android based Kio...
Implementation of information security techniques on modern android based Kio...
 
Lattice based Merkle for post-quantum epoch
Lattice based Merkle for post-quantum epochLattice based Merkle for post-quantum epoch
Lattice based Merkle for post-quantum epoch
 
The challenge of building a secure and safe digital environment in healthcare
The challenge of building a secure and safe digital environment in healthcareThe challenge of building a secure and safe digital environment in healthcare
The challenge of building a secure and safe digital environment in healthcare
 
Timing attacks against web applications: Are they still practical?
Timing attacks against web applications: Are they still practical?Timing attacks against web applications: Are they still practical?
Timing attacks against web applications: Are they still practical?
 
Tor .onions: The Good, The Rotten and The Misconfigured
Tor .onions: The Good, The Rotten and The Misconfigured Tor .onions: The Good, The Rotten and The Misconfigured
Tor .onions: The Good, The Rotten and The Misconfigured
 
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
 
We will charge you. How to [b]reach vendor’s network using EV charging station.
We will charge you. How to [b]reach vendor’s network using EV charging station.We will charge you. How to [b]reach vendor’s network using EV charging station.
We will charge you. How to [b]reach vendor’s network using EV charging station.
 
Connect & Inspire Cyber Security
Connect & Inspire Cyber SecurityConnect & Inspire Cyber Security
Connect & Inspire Cyber Security
 
The lions and the watering hole
The lions and the watering holeThe lions and the watering hole
The lions and the watering hole
 

Recently uploaded

Design pattern talk by Kaya Weers - 2024 (v2)
Design pattern talk by Kaya Weers - 2024 (v2)Design pattern talk by Kaya Weers - 2024 (v2)
Design pattern talk by Kaya Weers - 2024 (v2)Kaya Weers
 
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...BookNet Canada
 
Digital Tools & AI in Career Development
Digital Tools & AI in Career DevelopmentDigital Tools & AI in Career Development
Digital Tools & AI in Career DevelopmentMahmoud Rabie
 
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Mark Goldstein
 
Assure Ecommerce and Retail Operations Uptime with ThousandEyes
Assure Ecommerce and Retail Operations Uptime with ThousandEyesAssure Ecommerce and Retail Operations Uptime with ThousandEyes
Assure Ecommerce and Retail Operations Uptime with ThousandEyesThousandEyes
 
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality AssuranceInflectra
 
Varsha Sewlal- Cyber Attacks on Critical Critical Infrastructure
Varsha Sewlal- Cyber Attacks on Critical Critical InfrastructureVarsha Sewlal- Cyber Attacks on Critical Critical Infrastructure
Varsha Sewlal- Cyber Attacks on Critical Critical Infrastructureitnewsafrica
 
Landscape Catalogue 2024 Australia-1.pdf
Landscape Catalogue 2024 Australia-1.pdfLandscape Catalogue 2024 Australia-1.pdf
Landscape Catalogue 2024 Australia-1.pdfAarwolf Industries LLC
 
A Framework for Development in the AI Age
A Framework for Development in the AI AgeA Framework for Development in the AI Age
A Framework for Development in the AI AgeCprime
 
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesHow to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesThousandEyes
 
Connecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfConnecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfNeo4j
 
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...panagenda
 
Genislab builds better products and faster go-to-market with Lean project man...
Genislab builds better products and faster go-to-market with Lean project man...Genislab builds better products and faster go-to-market with Lean project man...
Genislab builds better products and faster go-to-market with Lean project man...Farhan Tariq
 
Bridging Between CAD & GIS: 6 Ways to Automate Your Data Integration
Bridging Between CAD & GIS:  6 Ways to Automate Your Data IntegrationBridging Between CAD & GIS:  6 Ways to Automate Your Data Integration
Bridging Between CAD & GIS: 6 Ways to Automate Your Data Integrationmarketing932765
 
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...Nikki Chapple
 
Kuma Meshes Part I - The basics - A tutorial
Kuma Meshes Part I - The basics - A tutorialKuma Meshes Part I - The basics - A tutorial
Kuma Meshes Part I - The basics - A tutorialJoão Esperancinha
 
Potential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and InsightsPotential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and InsightsRavi Sanghani
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPathCommunity
 
Emixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native developmentEmixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native developmentPim van der Noll
 
Testing tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesTesting tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesKari Kakkonen
 

Recently uploaded (20)

Design pattern talk by Kaya Weers - 2024 (v2)
Design pattern talk by Kaya Weers - 2024 (v2)Design pattern talk by Kaya Weers - 2024 (v2)
Design pattern talk by Kaya Weers - 2024 (v2)
 
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
 
Digital Tools & AI in Career Development
Digital Tools & AI in Career DevelopmentDigital Tools & AI in Career Development
Digital Tools & AI in Career Development
 
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
 
Assure Ecommerce and Retail Operations Uptime with ThousandEyes
Assure Ecommerce and Retail Operations Uptime with ThousandEyesAssure Ecommerce and Retail Operations Uptime with ThousandEyes
Assure Ecommerce and Retail Operations Uptime with ThousandEyes
 
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
 
Varsha Sewlal- Cyber Attacks on Critical Critical Infrastructure
Varsha Sewlal- Cyber Attacks on Critical Critical InfrastructureVarsha Sewlal- Cyber Attacks on Critical Critical Infrastructure
Varsha Sewlal- Cyber Attacks on Critical Critical Infrastructure
 
Landscape Catalogue 2024 Australia-1.pdf
Landscape Catalogue 2024 Australia-1.pdfLandscape Catalogue 2024 Australia-1.pdf
Landscape Catalogue 2024 Australia-1.pdf
 
A Framework for Development in the AI Age
A Framework for Development in the AI AgeA Framework for Development in the AI Age
A Framework for Development in the AI Age
 
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesHow to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
 
Connecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfConnecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdf
 
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
 
Genislab builds better products and faster go-to-market with Lean project man...
Genislab builds better products and faster go-to-market with Lean project man...Genislab builds better products and faster go-to-market with Lean project man...
Genislab builds better products and faster go-to-market with Lean project man...
 
Bridging Between CAD & GIS: 6 Ways to Automate Your Data Integration
Bridging Between CAD & GIS:  6 Ways to Automate Your Data IntegrationBridging Between CAD & GIS:  6 Ways to Automate Your Data Integration
Bridging Between CAD & GIS: 6 Ways to Automate Your Data Integration
 
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
 
Kuma Meshes Part I - The basics - A tutorial
Kuma Meshes Part I - The basics - A tutorialKuma Meshes Part I - The basics - A tutorial
Kuma Meshes Part I - The basics - A tutorial
 
Potential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and InsightsPotential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and Insights
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to Hero
 
Emixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native developmentEmixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native development
 
Testing tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesTesting tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examples
 

DefCamp 2013 - 0Class2DOS

  • 2. ABOUT… Independent security researcher Sysadmin @ Levi9 Passionate about security, specially when it’s related to mobile devices; started with NetMonitor (thanks Cosconor), continued with VoIP and finally GSM networks / mobile phones @msecnet / www.m-sec.net
  • 3. TOPICS ▪ SMS Intro ▪ Fun stuff with SMS ▪ Wrong implementation of SMS ▪ Can it be fixed? ▪ Conclusions
  • 4. SMS INTRO ▪ SMS stands for Short Message Service and represents a way of communication via text between mobile phones and/or fixed lines, using a standardized protocol. It is an effective way of communication as the user just writes some text and it’s almost instantly delivered to the destination. ▪ The provision of SMS makes use of a Service Center, which acts as a store and forward center for short messages
  • 5. SMS INTRO • Two different point-to-point services have been defined: mobile originated and mobile terminated • An active MS shall be able to receive a short message TPDU - Transfer protocol data unit - (SMS-DELIVER) OR to submit a short message TPDU (SMS-SUBMIT) at any time … independently of whether or not there is a speech or data call in progress
  • 6. SMS DEVELOPMENT How can you send other types of SMS? ▪ By using a modem and manually composing the message ▪ By using a software that will create the message
  • 7. FUN STUFF WITH SMS • Notifications http://mobiletidings.com/2009/07/08/voicemail-waitingindication-sms/ DCS: 0xC8 – turn on voicemail 0xC9 – turn on fax 0xCA – turn on email 0xCB – turn on other message 0xC0 – turn off voicemail 0xC1 – turn off fax 0xC2 – turn off email 0xC3 – turn off other message
  • 8.
  • 9. FUN STUFF WITH SMS • “Silent” message The receiving device must acknowledge receipt of the message (so you can get a delivery receipt), but the content of the message is to be discarded Some carriers might restore it PID: 0x40 DCS: 0xC0
  • 10. FUN STUFF WITH SMS • Service Load (WAP Push) PID: 0x00 DCS: 0x04 (binary encoding)
  • 11. WHEN THINGS GO WRONG
  • 12. WHEN THINGS GO WRONG Octets Description 00 Info about SMSC – here the length is 0, which means that the SMSC stored on SIM should be used. 01 There is no reply path, User Data Header, Status Report Request, Validity Period 00 TP-Message-Reference. The "00" value here lets the phone set the message reference number itself 0B Address-Length. Length of phone number (11) 91 Type-of-Address. Here it is the international format of the phone number 4421436587F9 The phone number in semi octets – 44123456789 00 PID, none specified 00 DCS, none specified 0B User-Data-Length. Length of message = length of septets = 11 E8329BFD06DDDF723619 User-Data. These octets represent the message "hello world"
  • 13. WHEN THINGS GO WRONG a) Set the modem in PDU mode: AT+CMGF=0 b) Check if modem is able to process SMS: AT+CSMS=0 c) Send the message: AT+CMGS=23 > 0001000B914421436587F900000BE8329BFD06DDDF723619
  • 14. WHEN THINGS GO WRONG Class 0 /flash message defined in Data Coding Scheme (ETSI GSM 03.38) DCS = 10 (hex) When a mobile terminated message is class 0 and the MS has the capability of displaying short messages, the MS shall display the message immediately […] The message shall not be automatically stored in the SIM or ME
  • 15. WHEN THINGS GO WRONG
  • 16. WHEN THINGS GO WRONG Sending multiple class 0 messages
  • 17. WHEN THINGS GO WRONG Sending multiple class 0 messages
  • 18. WHEN THINGS GO WRONG PoC videos: https://vimeo.com/80539057 https://vimeo.com/69643571
  • 19. WHEN THINGS GO WRONG Class 0 message Denial-of-Service When sending over 30 messages to a Google device running Android: • Messaging application stops • Phone reboots • Radio application restarts, but Internet no longer works If SIM PIN protection is enabled -> no phone signal, no calls
  • 20. WHEN THINGS GO WRONG Class 0 message Denial-of-Service • Reported to Google over 1 year ago • Finally got a reply in July • Still have no idea when / if this will be fixed • Tested on Galaxy Nexus, Nexus 4 with Android 4.1-4.3 • Google devices with Android 4.4 KitKat (Nexus 5) are also affected!
  • 22. FIX ME! • Class0Firewall application available in Google Play • Thanks to Michael Mueller (@c0rnholio) • You define the threshold, then Class0Firewall will block any incoming “flash” messages https://play.google.com/store/apps/details?id=com. silentservices.class0firewall
  • 24. CONCLUSIONS • Be careful on how you implement SMS • Check as many messages types as possible • Sometimes it may not be the number of messages that causes the problem, but the type of message