Rendered at 12:11:43 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
Retr0id 43 minutes ago [-]
A DoS like this is quite bad (in theory at least) but I think it's the first time I've seen one dressed up with a hypeslop landing page.
darkwater 2 hours ago [-]
The issue seems serious but the part about Australia and 000 that would ban an attacked device seems the typical LLM-being-too-anal paragraph, and completely lacking common sense.
Maybe I'm wrong and naive but given that the AU law was done to force people move forward from 3G only phones because the network was being shutdown and 000 moved to 5G (I believe), it's a law for operator to contact their customers still using an old phone and migrate them to a newer one.
I doubt they will block automatically the number if you are under that DOS for a few days in a row.
erebussss 13 minutes ago [-]
Australia has laws that require companies that provide a cellular service to follow, not fixing such a exploit would breach these laws. Under no circumstance can a telco, phone manufacturer or intermediary restrict or knowingly allow the restriction of access to Emergency Services. Google in this case would be considered as knowningly allowing the restriction as they're refusing the acknowledge this as an issue, something I'm sure ACMA could act upon or compel Google into fixing.
dools 8 minutes ago [-]
> I doubt they will block automatically the number if you are under that DOS for a few days in a row.
You doubt correctly. The law is about blocking IMEI numbers of phones that use the 3g network to dial 000 despite being 4g devices.
chinathrow 1 hours ago [-]
How can 000 move to 5G only?
dools 10 minutes ago [-]
It didn't. The 3g network was shut down. There were several older devices that were 4g but still used 3g to call 000, so they had to be blocked from connecting.
jeroenhd 1 hours ago [-]
Google has clearly flagged this as "not a security issue", repeatedly. It's a weird bug for sure, but what's the scenario here?
Correct me if I'm wrong, but the carrier configuration messages can normally only come from carriers. The demo APK sends a message to the phone itself, but sending SMS messages requires special confirmation.
Practically speaking, what's the risk?
whizzter 37 minutes ago [-]
Where does it say that it's carrier configuration? Looking through the page it mentions WAP and PDU, seems PDU from my skimming is just a part of encoding WAP messages, so basically anyone being able to send WAP messages onto the network will have the carrier happily retransmitting it unless carriers starts blocking them/filtering these incorrect ones?
_trampeltier 1 hours ago [-]
So you can allways trust the carriers. So then it's maybe a feature.
mzajc 53 minutes ago [-]
I trust mine not to brick my smartphone on purpose, at least. Especially not using methods that leave traces of what was done.
rvba 40 minutes ago [-]
a bad actor can hack the carrier and brick the phones the same way the fridges were hacked and bricked few weeks ago
perhaps even a rogue employee
t_mahmood 20 minutes ago [-]
If that happens, I think they actors will have more serious things to hack around then phone-looping some poor souls
jeroenhd 1 hours ago [-]
I don't think carriers can be trusted per se, but if a carrier wants to interrupt your call, they can just kill the connection.
vijaybritto 44 minutes ago [-]
If the carrier is compromised an attacker could destroy millions of phones and cause humongous economic losses no?
MarkBlah 1 hours ago [-]
wap-push is a legacy protocol, it predates mms's, android can send it fine, ios just ignores them.
jonathanstrange 54 minutes ago [-]
It seems to me that the scenario is that someone spoofing a cell tower can disable your phone practically forever and recovery requires expert interference. Maybe I'm mistaken, though, it's not clear from the description whether a spoofed cell tower would suffice and whether it needs to remain in the vicinity to repeat the attack often enough or whether sending 200 corrupt SMS messages in one go would suffice.
The Google Issue Tracker link [0] on the site shows access denied for me. Not sure if this is due to it being reappraised or because I specifically don't have access
If it was filed as a security issue, most well-set-up projects with public issue trackers would keep it closed off only to a reporter and internal security audit team.
Perhaps it was never really declassified in the tracker.
pitkali 23 minutes ago [-]
Security sensitive issues have restricted visibility.
KJs6ZxELzQM37O 1 hours ago [-]
You can't access issues that are not assigned to you. I remember reporting a bug via VRP once, and it was marked as duplicated with another id, that I cannot access and see the original report.
jpl56 2 hours ago [-]
We need this for opera houses. Send a few messages to each phone and we can enjoy the show without any ringing.
user2722 1 hours ago [-]
Isn't it easier to kick to the back anyone with a mobile phone with a sound?
embedding-shape 32 minutes ago [-]
No, talking to other humans is over and if it's not a technological solution with zero human feedback, it's not a solution I could build a VC-funded startup on, so obviously not a solution in real-life.
ece 2 hours ago [-]
If this was a user controlled option, I would enable this. Not that my phone wouldn't receive sms at all, but just go into do not disturb mode.
Geezus_42 2 hours ago [-]
I don't see why Android or iOS couldn't enable location based DnD at certain locations. Of course make it optional, but they already have your location and know that the place you are at is an Opera house, theater, etc...
broken-kebab 1 hours ago [-]
There are plenty of apps in which you can setup an action on geolocation
lynx97 2 hours ago [-]
No thanks. "I tried to reach you yesterday". "Oh sorry, I happened to walk by an opera house." PLEASE, less, not more automatisms. Everything has a tendency to produce false positives.
zimpenfish 1 hours ago [-]
> "Oh sorry, I happened to walk by an opera house."
It would be unfortunate for them to phone you precisely in the small period where DND was turned on as you walked past the opera house (even a large one would be, what, under two minutes of walking?) and not try you again.
(Because if you have instant location-based DND, yes, it might turn on as you walk by an opera house but equally it would turn off when you were past the opera house. Normally, though, I'd expect location-based DND to only kick in after a certain period of time in the same location - say 10 minutes.)
thereader12 1 hours ago [-]
So like sitting at a coffee shop next to the theatre. Or chatting with a person on the street.
zimpenfish 52 minutes ago [-]
Sure, the coffee shop might be a problem (since I'm guessing that'd be more than 10 minutes.) You could always turn it off (and a smart system wouldn't turn it back on 10 minutes later unless you leave and come back.)
zimpenfish 1 hours ago [-]
iOS focus does let you have location-based activations ("when I arrive at work", etc.)
grandfunction 3 hours ago [-]
This is going to cause absolute havoc. I hope carriers move fast to block this payload.
est 4 hours ago [-]
I remember there was a tel: link than when I clicked it wipes everything on my samsung phone
latexr 2 hours ago [-]
That’s insane, and I’d like to know more about how that even came to pass. A quick search isn’t surfacing anything relevant, do you have a link?
contingencies 2 hours ago [-]
At a guess it was an MMI / USSD code for factory reset. Allegedly the code:
*2767*3855#
Executes a full wipe and firmware reinstall with no confirmation prompt. This was probably it. Don't post the clickable link.
fg137 32 minutes ago [-]
Looks like it only works on a certain older Samsung phone.
Thanks to some genius at Samsung who thinks this is a good idea.
contingencies 28 minutes ago [-]
This sort of thing can make sense in manufacturing where you want to clear evidence of tests run, etc. For example, it is common to run optical test suites and then program the optics within a phone to account for imprecision rather than attempt to manufacture for a lack of it. Source: Drinking in Dongguan with the head of optics manufacturing for the company subcontracted to produce the iPhone optics assembly some years ago.
It’s bizarre to me that on a forum where people constantly complain about AI garbage AI slop like this always gets upvoted to the top.
soltanov 3 hours ago [-]
Golden Era of AI exploits began few days ago. Close the doors, otherwise you will get cooked.
klhs 3 hours ago [-]
How could they possibly give this a "won't fix" if it can do what is reported here?
anonymous908213 3 hours ago [-]
The "if" is doing a lot of heavy lifting. Can it do what it claims to do? LLMs are always hallucinating that they've found the most severe bug in software history.
dspillett 1 hours ago [-]
> LLMs are always hallucinating that they've found the most severe bug in software history.
That is a function of the training data/method, like many of AI's problems. This doesn't stop it being a problem of course, but it shouldn't be a surprise.
Big bugs, like heartbleed, over the years have had breathy websites going over how serious the problem is because the problem was that serious, so the models associate that sort of wording with bug reports. Less serious bugs don't get the same excited treatment, repeated in many many places, so more measured descriptions figure in the training data relatively less.
klhs 57 minutes ago [-]
Good point, I don't know! That's why I formulated it this way.
Edit: I guess what I'm trying to say is, with security relevant things it might do no harm to be a bit more credulous when it comes to initial reports. (In theory, no idea how to best handle the growing flood of LLM generated stuff. Pointing LLMs at each other doesn't seem great.)
paxy 30 minutes ago [-]
Why are you believing an entirely Claude generated webpage?
MarkBlah 3 hours ago [-]
mind boggles, issue is they're swamped with AI slop and high number of findings, they're using AI assistance operated by a 3rd party to handle researcher submissions so many legitimate findings slip through the cracks.
luca020400 39 minutes ago [-]
As far as I can tell the next ASB will fix this issue... maybe they simply forgot to tell you :/
There's yet another PDU fixup that stems from negative index
klhs 3 hours ago [-]
That's unfortunate. They need to do some kind of triage then, I hope this doesn't mean that they're constantly busy now with equally bad or worse bugs, but I guess it wouldn't be too surprising.
j16sdiz 1 hours ago [-]
They triaged them - that's why it gets wontfix.
False negative? I honestly don't know what we can do about it. If this is a real issue, maybe another llm will rediscover it and it eventually will get triaged right?
klhs 35 minutes ago [-]
True, I should have written they misclassified it, should it work as advertised. If Google knows something that makes it not an issue, hopefully they'll let us know.
coldfloor 2 hours ago [-]
Ironic comment from someone who literally just submitted an AI slop report and went so far as to give it a website and cutsey name to attempt to feign legitimacy and skill behind the "researcher."
yellow_lead 3 hours ago [-]
> The attack is remote, needs only the victim's number, and shows them nothing.
err, how can I send an SMS like this? Would a mobile network even accept/forward such an SMS?
Little hard reading through the vibe slop here
jeroenhd 1 hours ago [-]
I've sent weird SMS messages through my (rooted) phone before. Silent SMS messages (useful for police trying to activate your phone for triangulation) still returned delivery reports a year or two ago, allowing someone to find out if someone else's phone is on without the target ever noticing.
I think Android removed the ability to send more annoying messages through its normal APIs (like flash SMS messages) but if you have access to any modem (either a smartphone or a full ESP32 dev board costing <50 bucks on AliExpress for 4G LTE), you can bypass any such restriction.
Carrier firewalls will probably filter these messages out but I wouldn't rely on it.
lesspassiveobse 2 hours ago [-]
They do accept/forward messages without checking if they are special carrier-only ones. ~10 years ago I had some fun sending a "voicemail received" message to people, which caused android phones to display a notification which couldn't ever be dismissed. IIRC it only worked on HTC phones and required root/xposed. SS7 in general is built with total trust in connected systems.
Edit: I think it was called "HushSMS"
1116574 1 hours ago [-]
Back in the day you could send logos, ringtones, and bunch of other random crap thru carrier APIs, provided you signed a blood contract with them lol
Those APIs are probably still online, and still require to nail your ass to the contract, but technically I would assume it's possible.
rustyhancock 3 hours ago [-]
Looks like the website offers an APK.
But not all SMS are text messages for the user.
snitch182 3 hours ago [-]
carriers can reset access points via messages for example. Learned it the hard way when my 1st grader suddenly had internet...
LtWorf 2 hours ago [-]
I think you need better network equipment at home.
My provider had given me a remotely managed router. It was trivial to change the configuration and have it work normally.
jeroenhd 2 hours ago [-]
Phones take APN configuration through special kinds of SMS messages. This isn't just about routers.
38 minutes ago [-]
throwa356262 1 hours ago [-]
Is this AI security slop or a real issue? Can the phone actually receive these kind of messages from the network?
Also, I don't understand Googles position here. On android the phone ia not part of the OS and can be updated via an app or framework update. Why not just fix this as a functional bug?
MarkBlah 35 minutes ago [-]
Slop and real issue. Wap-push is a legacy format for sending urls via sms. Bug is a stupid one but it exists.
Google are rather vague in their triage, they just said temporary DoS does not qualify, then rejected to investigate further.
01 06 88 80 80 80 00 BE → sent as a data SMS to port 2948
I'm not familiar with WAP Push and how it works, but is it possible to disable it or block that port on a non-rooted phone?
motionlessveloc 2 hours ago [-]
WAP Push is a specially formatted SMS that triggers your phone to download a URL. Unfortunately the vuln here appears to hit at the SMS parsing phase, which I don't think can be turned off easily.
EdwardDiego 3 hours ago [-]
Omfg I am interested in this, I'm interested in wtf a WAP push is, but all I'm getting on this website is Claude-speak "not this, but that" and tables of irrelevant numbers, because Claude fucking loves a table.
Look at this Claude shit:
> Zero-click. The victim does nothing. No tap, no open, no notification.
> Silent. Nothing appears in Messages; the attacker's number is never shown.
Congrats, now you sound like yet another AI YouTube advertisement. "You control when we... ...woohoo"...
OP, please, if you think you have important information, please write it up yourself, I am so sick and tired of being sent LLM generated Markdown files with zero human input, and now you're just publishing that on a website.
FFS.
Oh you had Claude publish your name presumably so you'd get credit for "your" "discovery".
Mark Blaszczyk, please do better.
dsr_ 2 hours ago [-]
Claude is primarily a tool for spamming human attention.
MarkBlah 1 hours ago [-]
I just wanted a home for it to share, llm just polished it up.
the message is silent, no notification notifying of the attackers origin, doesn't matter if it's locked, or connected to mobile data, so i stand by what is written.
I don't care about the credit, i have enough CVE's under my belt which are higher severity, none which have dedicated write-ups. i care that this gets fixed and give answers to those who are experiencing their phones constantly disconnecting from carrier.
coldfloor 2 hours ago [-]
>...which is the exact shape of a "Destructive Remote DoS" in the VRP's own rules.
The trend of Claude referring to everything as having a "shape" irrationally annoys the hell out of me. What an absolutely idiotic way to say "X is like Y."
birdsongs 2 hours ago [-]
This trend upsets me so much, because my brain actually does work like that, concepts and ideas exist in 3d space and have likenesses to each other.
I used to write like this, but I can't anymore. (I suspect enough people did in the training set that that's why it ended up being part of the vernacular.)
hard_times 3 hours ago [-]
are you ok?
3 hours ago [-]
kome 2 hours ago [-]
get a grip. now you’re behaving like the guy who, when pointed at the moon, looks at the finger
0xcrypto 4 hours ago [-]
Can we stop vibecoding a new website for every next vulnerability we find please? Thank you.
solyin 4 hours ago [-]
Blame heartbleed for the practice, which long predates ChatGPT and vibecoding. Human psychology is to blame. Only nerds are going to find CVE-2014-0160 triggering, but if I say heartbleed everyone who was there remembers.
autoexec 4 hours ago [-]
> Only nerds are going to find CVE-2014-0160 triggering, but if I say heartbleed everyone who was there remembers.
That has more to do with the severity of heartbleed than the fact that it had a name and a logo. I've since seen a lot of vulnerabilities try to market themselves with websites, cute names, and stupid logos but I still don't remember them because they still just weren't big enough to actually be memorable.
therealmarv 2 hours ago [-]
why not? If you don't like it don't click it. Is not that the main purpose of the web that everybody can publish a web site?
embedding-shape 27 minutes ago [-]
Well, to be fair, you don't know it is until after you've gotten there. But also to be fair the other way, you can just click the close tab and move on with your life. But again to the other side, it sucks when N% of HN articles end up being closed within 2 seconds as you realize the author spent about 4 seconds writing a prompt and is now asking you to spend 5 minutes reading what they likely didn't even review themselves before hitting publish.
A bit like the postal system. Yes, it's meant to send physical letters and what not to my home, but it still sucks when I get ads that just goes straight into the trash. Yes, you're using the system as intended, but I still consider your business slop if you send ads to me this way.
rustyhancock 3 hours ago [-]
I think it's a good idea when there is no CVE and a don't fix status.
Before this practice in general you simply released the exploit and see if enough chaos triggers a fix.
exploderate 3 hours ago [-]
If people can't be responsible, let's just create a mailing list, call it "full-disclosure" and post everything there.
__m 4 hours ago [-]
Why? I like the presentation.
xuhu 1 hours ago [-]
Not if it helps raise awareness and gets companies to notice. Is peanutbutterjelly.co.uk more worthy of a domain ?
MarkBlah 3 hours ago [-]
agreed, we should all use gopher and block all web traffic, go back to text based systems, use single threaded operating systems and use token ring NIC's
AspireOne 2 hours ago [-]
I'll be honest, I have no idea what gopher or ring NIC is, lol.
MarkBlah 30 minutes ago [-]
Ah before www, gopher was used to try arrange information, similar to this page. Prior to that there were bbs’s where you dialed up to another computer.
Maybe I'm wrong and naive but given that the AU law was done to force people move forward from 3G only phones because the network was being shutdown and 000 moved to 5G (I believe), it's a law for operator to contact their customers still using an old phone and migrate them to a newer one. I doubt they will block automatically the number if you are under that DOS for a few days in a row.
You doubt correctly. The law is about blocking IMEI numbers of phones that use the 3g network to dial 000 despite being 4g devices.
Correct me if I'm wrong, but the carrier configuration messages can normally only come from carriers. The demo APK sends a message to the phone itself, but sending SMS messages requires special confirmation.
Practically speaking, what's the risk?
perhaps even a rogue employee
:grimace:
[0] https://issuetracker.google.com/issues/509520497
Perhaps it was never really declassified in the tracker.
It would be unfortunate for them to phone you precisely in the small period where DND was turned on as you walked past the opera house (even a large one would be, what, under two minutes of walking?) and not try you again.
(Because if you have instant location-based DND, yes, it might turn on as you walk by an opera house but equally it would turn off when you were past the opera house. Normally, though, I'd expect location-based DND to only kick in after a certain period of time in the same location - say 10 minutes.)
Thanks to some genius at Samsung who thinks this is a good idea.
That is a function of the training data/method, like many of AI's problems. This doesn't stop it being a problem of course, but it shouldn't be a surprise.
Big bugs, like heartbleed, over the years have had breathy websites going over how serious the problem is because the problem was that serious, so the models associate that sort of wording with bug reports. Less serious bugs don't get the same excited treatment, repeated in many many places, so more measured descriptions figure in the training data relatively less.
EDIT: actually already fixed in https://review.lineageos.org/c/LineageOS/android_frameworks_...
There's yet another PDU fixup that stems from negative index
False negative? I honestly don't know what we can do about it. If this is a real issue, maybe another llm will rediscover it and it eventually will get triaged right?
err, how can I send an SMS like this? Would a mobile network even accept/forward such an SMS?
Little hard reading through the vibe slop here
I think Android removed the ability to send more annoying messages through its normal APIs (like flash SMS messages) but if you have access to any modem (either a smartphone or a full ESP32 dev board costing <50 bucks on AliExpress for 4G LTE), you can bypass any such restriction.
Carrier firewalls will probably filter these messages out but I wouldn't rely on it.
Those APIs are probably still online, and still require to nail your ass to the contract, but technically I would assume it's possible.
But not all SMS are text messages for the user.
My provider had given me a remotely managed router. It was trivial to change the configuration and have it work normally.
Also, I don't understand Googles position here. On android the phone ia not part of the OS and can be updated via an app or framework update. Why not just fix this as a functional bug?
Google are rather vague in their triage, they just said temporary DoS does not qualify, then rejected to investigate further.
I'm not familiar with WAP Push and how it works, but is it possible to disable it or block that port on a non-rooted phone?
Look at this Claude shit:
> Zero-click. The victim does nothing. No tap, no open, no notification.
> Silent. Nothing appears in Messages; the attacker's number is never shown.
Congrats, now you sound like yet another AI YouTube advertisement. "You control when we... ...woohoo"...
OP, please, if you think you have important information, please write it up yourself, I am so sick and tired of being sent LLM generated Markdown files with zero human input, and now you're just publishing that on a website.
FFS.
Oh you had Claude publish your name presumably so you'd get credit for "your" "discovery".
Mark Blaszczyk, please do better.
the message is silent, no notification notifying of the attackers origin, doesn't matter if it's locked, or connected to mobile data, so i stand by what is written.
I don't care about the credit, i have enough CVE's under my belt which are higher severity, none which have dedicated write-ups. i care that this gets fixed and give answers to those who are experiencing their phones constantly disconnecting from carrier.
The trend of Claude referring to everything as having a "shape" irrationally annoys the hell out of me. What an absolutely idiotic way to say "X is like Y."
I used to write like this, but I can't anymore. (I suspect enough people did in the training set that that's why it ended up being part of the vernacular.)
That has more to do with the severity of heartbleed than the fact that it had a name and a logo. I've since seen a lot of vulnerabilities try to market themselves with websites, cute names, and stupid logos but I still don't remember them because they still just weren't big enough to actually be memorable.
A bit like the postal system. Yes, it's meant to send physical letters and what not to my home, but it still sucks when I get ads that just goes straight into the trash. Yes, you're using the system as intended, but I still consider your business slop if you send ads to me this way.
Before this practice in general you simply released the exploit and see if enough chaos triggers a fix.