Imagine that one day you are using your phone normally, maybe in the middle of a call. Suddenly, without any operation from you, the call drops for no reason, and the network shows “No Signal”. This phenomenon lasts for about two seconds, then the phone returns to normal as if nothing has happened.

You may think you just walked to a spot with poor signal, so you don’t pay much attention to it. But a few days later, the same situation occurs again. This time, your phone does not “recover automatically” any more: the network signal disappears repeatedly, and even the phone app interface keeps crashing and exiting.
Is the phone broken? Maybe it is. But there is another possibility: you have just encountered the latest “death text message” attack.
What is a “death text message”? To figure out the whole thing, you first need to understand a technical concept, the so-called “WAP Push data message”.
As we all know, ordinary SMS usually only contains basic text content. They are sent from the sender’s phone, transmitted through the operator’s network to your phone, and then you can read the corresponding content.

SMS (left) and MMS (right) are actually based on completely different sending and receiving methods
But many years ago, when the concept of “MMS” was first proposed, some changes took place. Because MMS is a “multimedia message” that may contain text, pictures, music and even animations (videos). For the 2G network at that time, receiving MMS consumed a lot of traffic.

Therefore, the WAP Push data message mechanism was designed, which can be regarded as the “doorknocker” of MMS. When an MMS is sent to you, the operator will first send a WAP Push data message to your phone. It is not for you to “view”, but to inform your phone that there is an MMS stored on the operator’s server now. At this time, the phone will notify the user whether to perform the download operation. In this process, the WAP Push data message itself will not be displayed in the SMS inbox, nor will it consume the number of SMS in the user’s plan.

But what if the WAP Push message happens to contain data that can trigger a serious system BUG? That is exactly the truth of the incident mentioned above.
Studies have found that from Android 12 to the latest Android 17 operating system, there is a very serious BUG. When they receive a specific WAP Push message, they will “misinterpret” the binary data in it, and eventually trigger the “Phone” process (com.android.phone) to restart automatically, which manifests as a temporary network disconnection of the phone and the ongoing call being hung up automatically.
After understanding the attack principle of the “death text message”, some of you may have noticed the key point already.
First of all, if the effect of the “death text message” attack is only to disconnect the phone from the network for a second or two, it does not seem to be a big problem. Why is it worth talking about specifically?
Secondly, if it is really a big problem, why has it existed from Android 12 all the way to Android 17 without being fixed?
In fact, that is exactly the crux of the problem.

Let’s go back to the previous analysis of the principle of WAP Push messages. Now that we know that a specific WAP Push message (that is, the “death text message”) will cause the phone process of Android phones to restart automatically, besides the instantaneous network disconnection and call drop, are there any other consequences?
Yes, because it will make the operator think that you have not received the WAP Push message just sent. As a result, the operator may try to resend it. At this time, the phone disconnects from the network again, and the operator thinks again that the message is not received, the message push fails, so it tries to send again, and then the network disconnection starts to loop continuously.

Relevant actual tests show that under the network of some “extra diligent” operators, one “death text message” may even cause the phone to repeatedly lose network connection for up to a week, and cannot make or receive any calls.
If the attacker does not send only one “death text message” at a time, but sends two or thirty of them in one go, the process crash frequency on the phone will become much higher, and eventually the database responsible for storing SMS data in the phone will be “corrupted”. Even if no more “death text messages” are received afterwards, the phone will fall into a semi-permanent crash loop, throwing errors constantly.

But please note that the above two extreme situations, one depends on the specific operator policy, and the other requires “persistent” attacks. However, different from other viruses and Trojans, the “death text message” may make the phone unusable, but it cannot cause data leakage, nor can it remotely control the attacked phone. In other words, it is very difficult for attackers to directly obtain economic benefits from it.
That is why this seemingly scary vulnerability has not been discovered for so many years. And even after it was “dug out” in May this year, it was once marked by Google engineers as “not a security issue, no need to fix”.
First of all, we want to reassure everyone that although Google decided not to fix the vulnerability after receiving the report in May this year, they actually submitted the fix code to AOSP in mid-June, and pushed the relevant patch to devices from Android 14 to Android 17 in the security patch of October this year.
In other words, as long as you are using a relatively new Android phone, after updating the system update of October or November this year (including domestic phones, which will also adopt Google’s monthly security updates), you are basically not afraid of this “death text message” attack.

But if the phone you are using happens to run on Android 12 or 13, the situation will be more complicated. There is no sign that these old versions of the system will be patched, and the details of the relevant attack have been fully disclosed, so old models are indeed facing great risks.

If you unfortunately get attacked, there is not completely no solution at the current stage. The simplest way is to turn off the phone first, remove the SIM card, then reset the system. At the same time, you have to find an iPhone or an Android phone with a new system, insert the SIM card of the attacked number into it. Since the program of these phones will not crash, the operator will “normally” receive the feedback that the WAP Push message has been delivered, and will no longer push the malicious message repeatedly.
But if you are using the “unsafe systems” of Android 12 or 13, and you have activated the eSIM function on your phone. Although this situation is almost impossible in the domestic market, if you unfortunately get attacked, it can be said that even a god can hardly save you, and you might as well just replace it with a new phone.
This article is from the WeChat official account “Three Easy Life” (ID: IT-3eLife), written by San Yijun, published with authorization from 36Kr.
该文观点仅代表作者本人，36氪平台仅提供信息存储空间服务。
36kr Europe (eu.36kr.com) delivers global business and markets news, data, analysis, and video to the world, dedicated to building value and providing business service for companies’ global expansion.
© 2024 36kr.com. All rights reserved.

source