A security vulnerability known as the ‘SMS of Death’ has been disclosed by a researcher, highlighting a critical flaw in Android devices. This vulnerability allows a single malformed text to disrupt phone services without any user interaction. Google has identified this as a non-security issue, declining to address it, according to the disclosure.
Understanding the SMS of Death Flaw
The flaw resides in the WapPushOverSms.decodeWapPdu() function, which processes WAP Push messages on Android devices. These messages, which are not visible in the user’s inbox, are mishandled due to a conversion error. Specifically, a header length is read as a large number and converted to a smaller signed integer, leading to an error.
When the five-byte sequence 88 80 80 80 00 is processed, it results in a conversion to -2147483648. The Android system then attempts to allocate a byte array with this size, causing an uncaught NegativeArraySizeException which terminates the com.android.phone process. This occurs silently, without alerting the user or revealing the sender’s identity.
Impact on Android Devices
The flaw causes active calls to disconnect and leads to temporary service outages. During testing, repeated resending of the problematic messages resulted in prolonged disruptions. Affected devices, such as the Pixel 9 and various Samsung models, consistently experienced crashes.
Google’s Android 17 version introduces new security measures to address other zero-click threats, but this specific parsing issue remains unprotected. The persistent nature of the flaw means that repeated message sending can even corrupt the device’s SMS database, causing continuous app crashes.
Mitigation and Future Concerns
Recovery from the flaw requires complex steps, such as swapping the SIM to a non-Android device to acknowledge the messages and clearing corrupted data via ADB. This process is complicated further by eSIM technology, making it inaccessible for many users.
Zero-click vulnerabilities are not uncommon, as demonstrated by past discoveries like BLASTPASS, which exploited iPhones with Pegasus spyware. The advent of AI in cyberattacks raises concerns about the increasing speed and cost-effectiveness of such threats, underscoring the need for robust defenses.
In conclusion, the ‘SMS of Death’ flaw presents a significant challenge to Android security, highlighting the necessity for ongoing vigilance and innovation in cybersecurity strategies.
