Is
Your Smartphone under SMS Curse of Silence?
Finland-based cyber security company F-Secure warns that “SMS Curse of
Silence” exploit can crash the SMS function of the smartphone. That
means users won’t be able to receive new text messages. The company’s
mobile security solution promises to protect against this denial of
service.
It says
that a new exploit for a wide range of Symbian OS-based smartphones was
made public a couple of days ago. This exploit has been dubbed the “SMS
Curse of Silence” by Tobias Engel, who discovered and disclosed the
exploit at the 25th Chaos Communication Congress, says F-Secure.
The
exploit can make the text messaging function of the affected phone
unusable. Affected phones cannot receive SMS text messages. Smartphones
that can be attacked this way include UIQ devices and S60 2nd Edition
Feature Packs 2 and 3, 3rd Edition and 3rd Edition Feature Pack 1. S60
3rd Edition Feature Pack 2 or 5th Edition phones are not affected.
Here’s
how the curse comes. The Denial-of-Service (DoS) attack consists of
sending one, or depending on the phone model, several specifically
formatted SMS messages to the smartphone being targeted. The messages
crash the phone’s SMS system, but the phone remains functional
otherwise.
Older
models do not show symptoms of the attack that would be visible to the
user, however newer phones can show messages that the phone is running
out of memory or experience constantly flashing message icons after the
attack.
“Performing the attack does not require technical expertise, and due to
this, there is a risk of it becoming a nuisance. We have already
provided a security update to this threat to our F-Secure Mobile
Security customers,” says Samu Konttinen, VP of Mobile Business Unit at
F-Secure.
The
F-Secure Mobile Security solution, says the company, protects against
this exploit by detecting it and by repairing the phone so that users
don’t lose the messages in their inboxes. The solution is available for
all the smartphone models at risk.
It can
be downloaded directly to the phone by using the phone’s browser to
access www.f-secure.mobi. There is a free 7-day trial version of
F-Secure Mobile Security available.
