Siemens *35 and 45 series phones SMS Danial of Service

[subj subj]

Information:

The name of vulnerability: Siemens *35-45 DoS SMS Lag
To vulnerability are subject: All versions siemens *35 and *45.
Official site: www.siemens-mobile.com
Kind of vulnerability: Refusal in Service (Denial of Service).
Type of vulnerability: Removed / local.
Author: subj (r2subj3ct@dwcgr0up.com)
Date: 02.03.2003
Site: www.dwcgr0up.com

Description of vulnerability:

There is a local and remote vulnerability and
Siemens *35 and *45 series phones.

A message of the form "%String", where String is on of the
languages from the phone language selection menu, will
completely disable *35 series phones and result
in a 2 minute read delay on *45 series phones. Note that
the first letter of language should be capitalized and
the quotation marks should be present in the message.

The phone will try to read the message and then after 2 minutes
return to the main menu. This happens every time the message is sent.
After 10-15 messages the battery (NiMH) gets empty.

There is a local vulnerability of the same kind. A message of the
form "%some_word", where some_word is any lower case letter
sequence will result in the same effects described above.

Vulnerability exploiting:

(for remote):
We send on "phone - victim" the message:
"%Deutsch"
Or
"%Polski" "%Magyar" "%English" "%Deutsch"
(for local):
"testedersecurity"

Thanks:
DHG, GipsHack, Netp0is0n, de1irium, r00tc0de, f0kp
l0bster, r4ShRaY, D4rkGr3y, Moby, Orb, Foster, Owned, prior, dron
(Ivanov Andrey)

[Jan Niehusmann]

--WIyZ46R2i8wDzkSu
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Mon, Mar 03, 2003 at 01:06:43AM -0000, subj subj wrote:
> To vulnerability are subject: All versions siemens *35 and *45.
[...]
> languages from the phone language selection menu, will
> completely disable *35 series phones and result
> in a 2 minute read delay on *45 series phones. Note that

Please note that this vulnerability isn't as serious as you describe it.
At least on my S45, I am able to interrupt this 2 minute delay at any
time by pressing the 'hang up' key (but I have to press it for about half a
second instead of just hitting it), the message can be read by using
'edit message' instead of 'read message', and it can be deleted without
problems.

So while this obviously is a bug, it can hardly be called a DoS.

Jan


--WIyZ46R2i8wDzkSu
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+Y9sxnIUccvEtoGURAnlmAKClHa1s621QBS38eaQaqM Oc7gZ8lACfQ20m
E2UTSTWBiWNB11RoLu1gx8k=
=rgMC
-----END PGP SIGNATURE-----

--WIyZ46R2i8wDzkSu--

[Andreas Hofmeister]

Jan Niehusmann wrote:

>On Mon, Mar 03, 2003 at 01:06:43AM -0000, subj subj wrote:
>
>
>> To vulnerability are subject: All versions siemens *35 and *45.
>>
<snip>

> the message can be read by using
>'edit message' instead of 'read message', and it can be deleted without
>problems.
>
>So while this obviously is a bug, it can hardly be called a DoS.
>

An S35 locks up *completly* when one attemps to read the message -
worse: you had to read the message (wich is not possible) before you
could delete it, there is no edit option in the message list. Regarding
the S35 it really is a DoS.

Ciao
Andreas

[Willis Johnson]

What happens if the string is sent repeatedly while the phone is turned
on but is unattended or receives text messages silently? Is the battery
drained as predicted?=20

Willis

-----Original Message-----
From: Jan Niehusmann [mailto:jan@gondor.com]=20
Sent: Monday, March 03, 2003 2:46 PM
To: subj subj
Subject: Re: Siemens *35 and 45 series phones SMS Danial of Service


On Mon, Mar 03, 2003 at 01:06:43AM -0000, subj subj wrote:
> To vulnerability are subject: All versions siemens *35 and *45.
[...]
> languages from the phone language selection menu, will completely=20
> disable *35 series phones and result in a 2 minute read delay on *45=20
> series phones. Note that

Please note that this vulnerability isn't as serious as you describe it.
At least on my S45, I am able to interrupt this 2 minute delay at any
time by pressing the 'hang up' key (but I have to press it for about
half a second instead of just hitting it), the message can be read by
using 'edit message' instead of 'read message', and it can be deleted
without problems.

So while this obviously is a bug, it can hardly be called a DoS.

Jan

[Robert Waldner]

------------=_1046768028-557-47
Content-type: text/plain; charset=iso-8859-1
content-transfer-encoding: quoted-printable


On Mon, 03 Mar 2003 23:46:09 +0100, Jan Niehusmann writes:
>On Mon, Mar 03, 2003 at 01:06:43AM -0000, subj subj wrote:
>> To vulnerability are subject: All versions siemens *35 and *45.
>[...]
>> languages from the phone language selection menu, will
>> completely disable *35 series phones and result
>> in a 2 minute read delay on *45 series phones. Note that

>Please note that this vulnerability isn't as serious as you describe it.
>At least on my S45, I am able to interrupt this 2 minute delay at any
>time by pressing the 'hang up' key (but I have to press it for about half a
>second instead of just hitting it), the message can be read by using
>'edit message' instead of 'read message', and it can be deleted without
>problems.
>
>So while this obviously is a bug, it can hardly be called a DoS.

However, my S35i is _completely_ disabled, just as the original poster=20
described, no luck with just pressing the "hang up"-key, one has to=20
yank the battery out. Also, there is no "Edit Message" available until
after one reads a message, and thus disables the phone.

Please also note that if you append something to the "%String", the bug=20
no longer hits (for my S35i, that is). Most web->sms - gateways append
some signature to SMSs, and thus, by sheer luck, can't be used to exploit
this.

cheers,
&rw
--=20
/ Ing. Robert Waldner | Security Engineer | CoreTec IT-Security \
\ <rw@coretec.at> | T +43 1 503 72 73 | F +43 1 503 72 73 x99 /



------------=_1046768028-557-47
Content-Type: application/pgp-signature; name="signature.ng"
Content-Disposition: inline; filename="signature.ng"
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+ZGmcsydIrcM6K8ARAmTzAKDRydKQ3fBZIEtMUPrNAZ Z0Q6yeHwCfahml
IR3c+uX0/n379PHVDxOKgY0=
=OjI2
-----END PGP SIGNATURE-----

------------=_1046768028-557-47--