Re[2]: Siemens *35 and 45 series phones SMS Danial of Service

[=?ISO-8859-1?B?Sm/jbyBDb2xh528=?=]

Hi Andreas,

Tuesday, March 4, 2003, 12:33:10 AM, you wrote:

AH> An S35 locks up *completly* when one attemps to read the message -
AH> worse: you had to read the message (wich is not possible) before you
AH> could delete it, there is no edit option in the message list. Regarding
AH> the S35 it really is a DoS.

On the S35 you can access the Message Options menu for the message without
reading it. Simply select the message on the incoming Message
folder and press the Voice Memo button of the phone. Thus the phone
will never read the SMS and you could safely delete it...

I have tried this on my S35 and works.

--
João Colaço
Alto do Moinho - Corroios
Portugal
mailto:colaco@netvisao.pt

[=?iso-8859-2?Q?Dawid_Szyma=F1ski?=]

On Mon, 03 Mar 2003 23:46:09 +0100, Jan Niehusmann writes:

> Please also note that if you append something to the "%String", the bug
> no longer hits (for my S35i, that is). Most web->sms - gateways append
some signature to SMSs, and thus, by sheer luck, can't be used to exploit
this.

Not exactly...

If you send
"%String" blah blah

IT DOES work

Tested on 35i with Polish WWW->SMS gateway

Kind regards,

Dawid

[Christian \cycloon\ Gut]

--=-U9g8n4mDIP1PpKgNDvpB
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Mon, 2003-03-03 at 02:06, subj subj wrote:

> There is a local and remote vulnerability and
> Siemens *35 and *45 series phones.
>=20
> A message of the form "%String", where String is on of the
> languages from the phone language selection menu, will
> completely disable *35 series phones and result
> in a 2 minute read delay on *45 series phones. Note that
> the first letter of language should be capitalized and
> the quotation marks should be present in the message.

i have to add the S55 to the list here.
I sent a message as described to my friend and then read it im my "Sent"
folder =3D> 2 min delay. no chance to abort. so a real DoS.



--=20

Christian "cycloon" Gut <cycloon@is-root.org>

--=-U9g8n4mDIP1PpKgNDvpB
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQA+Zlvwx7jl1ui8gtARAhUzAJwJ4VysWPiw/e0OREx6FdxbP0DKuQCfcDET
pwo9Ut+E20OH18fJfo3l5UA=
=4ggY
-----END PGP SIGNATURE-----

--=-U9g8n4mDIP1PpKgNDvpB--

[Luciano Miguel Ferreira Rocha]

A "friend" tried that trick on me, but my S45 coped with the string
without any trouble.

It could be that my friend had done something wrong or that a firmware
update I made some time ago resolved that problem.

You can download it from
http://www.my-siemens.com/com.aperto/MySiemens/Files/Specials/hq/gprs/

Regards,
Luciano Rocha

--
Consciousness: that annoying time between naps.

[Timothy Farrell]

This appears to work on the S46 (GSM) phone also. However, just like the=
S45,=20
pressing and holding the "hang up" button appears to remedy the problem.

Timothy F. Farrell
Web Admin.
www.TamaquaFire.com

On Sunday 02 March 2003 20:06, subj subj wrote:
> Information:
>
> The name of vulnerability: Siemens *35-45 DoS SMS Lag
> To vulnerability are subject: All versions siemens *35 and *45.
> Official site: www.siemens-mobile.com
> Kind of vulnerability: Refusal in Service (Denial of Service).
> Type of vulnerability: Removed / local.
> Author: subj (r2subj3ct@dwcgr0up.com)
> Date: 02.03.2003
> Site: www.dwcgr0up.com
>
> Description of vulnerability:
>
> There is a local and remote vulnerability and
> Siemens *35 and *45 series phones.
>
> A message of the form "%String", where String is on of the
> languages from the phone language selection menu, will
> completely disable *35 series phones and result
> in a 2 minute read delay on *45 series phones. Note that
> the first letter of language should be capitalized and
> the quotation marks should be present in the message.
>
> The phone will try to read the message and then after 2 minutes
> return to the main menu. This happens every time the message is sent.
> After 10-15 messages the battery (NiMH) gets empty.
>
> There is a local vulnerability of the same kind. A message of the
> form "%some_word", where some_word is any lower case letter
> sequence will result in the same effects described above.
>
> Vulnerability exploiting:
>
> (for remote):
> We send on "phone - victim" the message:
> "%Deutsch"
> Or
> "%Polski" "%Magyar" "%English" "%Deutsch"
> (for local):
> "testedersecurity"
>
> Thanks:
> DHG, GipsHack, Netp0is0n, de1irium, r00tc0de, f0kp
> l0bster, r4ShRaY, D4rkGr3y, Moby, Orb, Foster, Owned, prior, dron
> (Ivanov Andrey)

[Lukasz Wojcik]

On 5 Mar 2003, Christian "cycloon" Gut wrote:

> On Mon, 2003-03-03 at 02:06, subj subj wrote:
>
> > There is a local and remote vulnerability and
> > Siemens *35 and *45 series phones.
> >
> > A message of the form "%String", where String is on of the
> > languages from the phone language selection menu, will
> > completely disable *35 series phones and result
> > in a 2 minute read delay on *45 series phones. Note that
> > the first letter of language should be capitalized and
> > the quotation marks should be present in the message.
>
> i have to add the S55 to the list here.
> I sent a message as described to my friend and then read it im my "Sent"
> folder => 2 min delay. no chance to abort. so a real DoS.
>

C55 is vulnerable as well, however it doesn't DoS - the phone hangs while
reading SMS in ordinary way but at any time you may exit from "Please
wait" screen by pressing "disconnect" key for a while.
Only method to read the sms is to Edit it insted of View.

SMS sent via www sms gateway _does_ "DoS".

Regards,
L.

[Michael Landsmann]

No, it won't. You actually have to open the message first, remember? The
phone will just receive the messages, waiting for them to be read.

Oh, by the way: 'Hang up' doesn't work on SL-42 either. It also disables the
phone completely.

--
Michael Landsmann.

----- Original Message -----
From: "Willis Johnson" <willisj@microsoft.com>
To: <bugtraq@securityfocus.com>
Sent: Tuesday, March 04, 2003 12:28 AM
Subject: RE: Siemens *35 and 45 series phones SMS Danial of Service


What happens if the string is sent repeatedly while the phone is turned
on but is unattended or receives text messages silently? Is the battery
drained as predicted?

Willis

-----Original Message-----
From: Jan Niehusmann [mailto:jan@gondor.com]
Sent: Monday, March 03, 2003 2:46 PM
To: subj subj
Subject: Re: Siemens *35 and 45 series phones SMS Danial of Service


On Mon, Mar 03, 2003 at 01:06:43AM -0000, subj subj wrote:
> To vulnerability are subject: All versions siemens *35 and *45.
[...]
> languages from the phone language selection menu, will completely
> disable *35 series phones and result in a 2 minute read delay on *45
> series phones. Note that

Please note that this vulnerability isn't as serious as you describe it.
At least on my S45, I am able to interrupt this 2 minute delay at any
time by pressing the 'hang up' key (but I have to press it for about
half a second instead of just hitting it), the message can be read by
using 'edit message' instead of 'read message', and it can be deleted
without problems.

So while this obviously is a bug, it can hardly be called a DoS.

Jan

[Raymond A. Meijer]

On Mon, 03 Mar 2003, 01:06, subj subj wrote:

> There is a local and remote vulnerability and Siemens *35 and *45 series
> phones.

Yes, it works on the M35 as well.

A friend sent it to me and it locks up my phone completely when I try to
read it.

An interesting side effect is that when a call comes in when the phone's
stuck, the display flashes with the incoming number, but the phone doesn't
ring or vibrate... It's also impossible to answer the call. Weird.

Now how can I delete this message? There's no "Edit" option in the message
menu; I have to view it before I can edit or delete it....


Ray

--
You cannot discover new oceans unless
you have the courage to lose sight of
the shore