Obscure SMS bug no need to panic

Well, you can underplay this one. But I've put you down many times Steve for claiming that PlatSec + Symbian signed makes Symbian so secure. I've cited the SMS/Push etc route as the classic counter example and here is one manifestation.

If this was a buffer overrun bug (which it could easily have been), then it would be fairly easy to do something very destructive (as I've said, message server - the process in which you SMS code runs could do a lot of nasty things).

I think you are mostly right about overblowing the significance of these, but there are so many bugs hidden in a 10million line of code project that you can never be sure of a catastrophic fault being exploited. The recent news of a few hundred PSPs being used to crack MD5 certificates should be a sobering lesson to anyone who thinks that such attacks are theoretical.
Once a platform like s60 has such a market share, it's not the in your face bricking that you should worry about, it's the code that gently leaks your private details over the network.

So forget about platsec and signed. If you find a horrid bug- the only way to avoid it is to have a firmware upgrade that addresses the problem installed promptly on the device.
As some have pointed out, in the developing world - phones may be two years or more behind the curve of the flashy new devices that you hold in your hand each day.

Essentially - vulnerabilities are marketing tools for competitors. On announcement it's always going to be in someone's interest to have news of the problem spread as fast as possible. This is how competition politics and of course the media work.

Steve, I agree largely with your point, but... you were really asking for this by the way which you posted the article! The headline/summary began on the offensive, so that's what came back in return 😉

I believe that anti-virus is a waste of both money and valuable resources on a mobile phone (especially s60v3), and that this bug shouldn't be that serious, but it is going too far to say that no-one should report on the bug.

I also think that this event and the publicity surrounding it may (and hopefully will) have an effect in driving more people to update their firmware. We can't really compare (say) windows to symbian in this respect because windows, by default, will automatically install all security updates as they are release - phones must be manually updated in sometimes a rather cumbersome procedure.

Serious 60 wrote:If this was a buffer overrun bug (which it could easily have been), then it would be fairly easy to do something very destructive

I don't know whether you do Symbian programming, but probably not, because you hardly would issue such a statement if you did.

To a Symbian programmer, it's pretty clear what very probably happens here: The SMS processing code uses a "descriptor" which can hold at most 32 characters and which is heavily protected against any buffer overruns. Any attempt to put more than 32 characters into it will kill the process trying to do so.

The symptoms speak for exactly this scenario: Every time when some internal Symbian SMS process tries to work on the message in question - the one in front of the queue and thus the first to be taken - it dies, and no more SMS processing is possible.

And as I said, it dies exactly because it is so damned hard to produce buffer overruns in Symbian. So no, this could not easily have been a buffer overrun instead. We did not evade total meltdown only by hair's breadth.

And well, "fairly easy to do something very desctructive" if it really was an exploitable buffer overflow? I don't know your definition of "fairly easy": Packing enough binary ARM code into somewhat over 100 bytes that the SMS allows that does something really nasty? Ok, possible, but fairly easy? Come on.

I feel with Steve: Time to take this serious, but no time to panic.

How long until we start seeing widespread riots ?

Here we go again, more pathetic melodrama over an insignificant software bug. I'm sick of people trying to make a big deal of these thing whatever OS or platform, PCs, phones, PDAs. Get a life nurdy-boys.

You get less fuss over car safety re-calls. SAFETY recalls that can cost LIVES, not a few text messages and a phone reset. For goodness sake people have some perspective. I'm going to yawn and forget this one. I wish I'd never heard of it.

Williamoni wrote:

As for ''Unregistered" I think it's cowardly to criticise Steve and not put your name to what you have to say.

LOL! You can type anything into that username box. Having a name on a post means nothing. It might as well be unregistered or Barack Obama for all the significance it carries.

We're caught in a trap
An obscure SMS bug
But there's no need to panic baby

Why can't you see
What you're doing to me
When you send me nasty curse of silence texts?

We can't go on together
With suspicious texts
And we can't build our dreams
If our phones don't work.

ROFL! It scans too.... 8-)

Um. . while everyone's argueing the severity-degree of the matter. Has anyone sent an e-mail to Nokia and/or Symbian;requesting comments ?

ChaosFire wrote:Um. . while everyone's argueing the severity-degree of the matter. Has anyone sent an e-mail to Nokia and/or Symbian;requesting comments ?

Well not me because I don't give a flying fig.

http://www.darlamack.com/darlamack/2009/01/nokias-reaction.html

During his 10 minute presentation Tobias quoted someone from Nokia; every day Nokia sells more phones than there are people who upgrade their Nokia phone firmware in a year.

Speculation: maybe a good outcome from this will be that more people upgrade their firmware, and that more operators will support distribution of firmware updates for their branded phones.

That's a fascinating little tidbit, and brings up an interesting question: IF Nokia had issued a firmware update for every single one of the affected S60 2nd Edition, S60 3rd Edition, and S60 3rd Edition, Feature Pack 1 devices (can you IMAGINE the resources required to do THAT?), how many people would 1. known there was a new firmware or 2 bothered to updated it anyways?

Especially given the fact that only like, 2-3 of the non-FP2 devices have UDP, which means that everyone would have essentially had to hard reset their phone - either you got attacked and had to do so or you updated your firmware and had to do so.

Sure, something should have been done, but the question is then, 'what?' If this exploit was able to completely brick your phone, that would be an entirely different conversation. However, it doesn't, so what level of resources is Nokia expected to invest in preventing/fixing a bug that will affect so few users, knowing such a fix will likely be applied by even fewer?

Exactly. And it's interesting to note that, despite this bug having been publicised to high heaven in the last 4 days, I haven't heard of a single person who has been 'attacked'.

Out of 80 million or so vulnerable phones, I'd be surprised if there have actually been more than a dozen actual nuisance-DoS attacks using this exploit. And I'd lay odds that during the whole of 2009 there won't be more than a few hundred. Many networks already block these strangely-formatted messages and more will block them in the coming days if they prove a nuisance [and a blow to lucrative SMS revenue], all newer (FP2 and beyond) S60 phones aren't affected anyway, plus there will be firmware updates galore....

In short, reason after reason why this isn't going to be a big problem in the real world.

kflyer,

The truth however is that Steve was the first mainstream blogger to complain about the OS hack - taking a rather harsh view of it. You might need to dig a bit more deep into the AAS archives

Secondly, I don't want to start a competition here and I don't know if Steve was quicker than us or not, but please be sure that we've also had a lot of negative and condemning comments about the OS hack in Spring 2008 on our discussion forums, to a point that both me and BentL OFFICIALLY BANNED and FORBADE promoting the hack on My-Symbian forums and entire site. You might need to dig a bit more deep into the My-Symbian archives...

Lastly, I wrote it to Steve (and that's why I started my comment with "Dear Steve", haven't you noticed?) and not to you, so why be a self-appointed avocate of him instead of letting him answer by himself? He CAN write and he does it well, which he proves with his great articles daily.

Pansies,

Those sites ARE Symbian OS fansites because they're providing Symbian OS users with news that will BENEFIT them.

It's like if a fan club of some rock band was distributing forged tickets for that band's concerts or illegal MP3s of their newest album. Following your way of thinking, it would also be "benefitial" for users, but definitely not so benefitial for the rock band they're (allegedly) fans of.

What is your link between the OS hack and the supposed boosting of piracy?

The main thing that has boosted piracy is the developer certificates from the Chinese websites, not hacking.

If you ever had your own Symbian website (not necessarily as old as mine, 9,5 years of experience now and the oldest Symbian OS software shop in the Internet, launched 2 years before even Handango started selling Symbian software), you'd know precisely when software sales have dropped by several hundred percent, when people stopped downloading trial versions, and even when freeware downloads dropped seriously because most of those kids prefer to get a cracked commercial app than freeware, simply because "forbidden fruit tastes better". Call it a coincidence, but it was Spring 2008. Yes, there was also a drop in sales a year or so earlier, when the Chinese certificates appeared, but that drop was 10 times smaller. So when talking about piracy, I'm using numbers from the oldest and very popular Symbian software shop and not from my dreams.

And even if you don't have your own site, just by taking a look from time to time on what's happening on several most popular warez sites with Symbian software you could have a very clear view of when popularity of warez for S60 3rd Edition simply EXPLODED, just by counting the number of posts in threads with a cracked app attached, and checking their contents, as described above.

It's not just the piracy scaring away developers.

It's Symbian Signed that is scaring away developers

why do you think the big players like Psiloc are still in the game?

Because they can easily get their stuff signed unlike small time developers like Samir - why has none of his stuff been signed?

The expensive and annoying Symbian Signing process is what is preventing new blood from developing for S60.

It's IDIOTIC to say that hacking the OS was meant to make lives of developers easier, because it actually RUINED some of them. Want to see how the hack "made it easier to develop for S60"? See this page and read carefully what they wrote:

http://www.symot.com/

And no, it was not a developer that went bankrupt because they couldn't afford Symbian Signed. Their apps (e.g this one were all signed, and quite interesting. They went bankrupt because when the cracks became available to anyone, people started using only STOLEN, pirated copies and they stopped seeing any new sales. Having this in mind, kindly re-read what I wrote above. And if this one example isn't enough for you, let me know and I'll give you a couple more of similar links.

Windows mobile is still thriving despite the massive possibility for pirating apps.

Nice to see that Michal has lost none of his charm; I'd almost forgotten why I no longer visit My-Symbian....

First of all, I didn't write that Steve NEVER complained about the OS hack. I wrote that I haven't seen him complaining. THAT MAKES A DIFFERENCE.

It was very clear what you meant the first time round. But on that note, the hack is not all bad. I wouldnt touch it myself, but know of many many people that do.

And not for piracy.

The ability to tweak things they normally cannot is such a lure to some they havent upgraded firmware.

Do i think the hack is more bad than good? Yes. But to claim its responsible for killing off developers due to piracy is a complete joke.

Symbian signed is, and thats no mistake. The developing side was becoming a bit stagnent well before the hack came along. The worst problem is Nokia, and the bad approach to finding and installing (and buying) applications.

Lastly, I wrote it to Steve (and that's why I started my comment with "Dear Steve", haven't you noticed?) and not to you, so why be a self-appointed avocate of him instead of letting him answer by himself? He CAN write and he does it well, which he proves with his great articles daily.

With respect to that, you could send it via PM or email, by posting it on the comments section in which the whole world can see and reply to, you are rather leaving it open for...comment.

Back to the main point....

I fully understand Steve's ire.

First off, it would be such an unknown problem that very very few would know about it. But, because of hype, then more people will know about it.

Secondly, why is everyone bashing Nokia? Granted, its a nasty thing to have, but since they have only been aware of it for 7 weeks, how is that long enough to critisise for not having firmware out?

Third, I am certainly not saying Nokia should not include it in firmware updates, but what exactly are the people who suffer from this problem going to do? Most people on this site should be well aware that the general masses never update firmware, I'd go so far to say the majority dont even know about firmware updates.

Forth, this is NOT a security expliot. People are making out its far more serious than it actually is. It cannot steal any information from your phone.

All OS's have problems found, most of them far more serious. This is one that is extremely unlikely to be explioted, and will only cause a hassle if so.

The argument will rage on as to if its a serious exploit or not (though if it was, I'd like to know what a proper security related one is called), and people will not agree.

I've just discovered a MASSIVE NEW BUG with my Symbian phone. It is possible for a thief to steal it and when this happens I lose everything and the only cure is restore from backup.

How can Nokia let this happen? DISGRACE!

> In order to be affected, you've got to have a vulnerable device
> AND someone who's got it in for you AND has your mobile number
> AND knows the explicit (fiddly) details of how to contruct the special
> bug-hitting messages.

OR, you've got to have someone who knows the explicit (fiddly) details and a lot of time to try different phone numbers randomly, and yours happens to be among them. If you have a vulnerable phone, you're toast.

(Disclosure: I work for a security firm.)

Unregistered wrote:OR, you've got to have someone who knows the explicit (fiddly) details and a lot of time to try different phone numbers randomly

Could you please be so kind and add a plausible motive for this person to spend considerable time and quite possibly money to try all these random phone numbers? Explanations like "There are just many bad persons in this world" would not count, IMHO.

Maybe this is a little exagerated as well, but a real-world equivalent of this argument would be "Wear bullet-proof wests all the time! Some bad people shoot around at random, and sooner or later they may hit you." (A helpful advice from your bullet-proof west producer, of course.)

Unregistered wrote:Nice to see that Michal has lost none of his charm; I'd almost forgotten why I no longer visit My-Symbian....

If you don't visit My-Symbian, just don't. I've never been politically correct and I always say and write what I think. That's what some people love My-Symbian forums for, and that's what some people hate it for. If you're one of the latter, it's your free choice and you don't have to visit my site. But you don't have to say it every time you see my post on some other site, especially that I do it extremely rarely. With one post every couple of years here, I'm sure I don't abuse this site.

bartmanekul,

But on that note, the hack is not all bad. I wouldnt touch it myself, but know of many many people that do.

Do i think the hack is more bad than good? Yes.

But to claim its responsible for killing off developers due to piracy is a complete joke.

Sales dropped considerably just when the hack has been made available. And not just in my store. In all stores. Ask Steve or Rafe if they haven't noticed a considerable software sales drop in Spring and Summer 2008.

And I posted a link to a developer site clearly mentioning that they went bankrupt because they stopped seeing any sales. It's not Symbian Signed that killed them. As I wrote, they had all their applications signed and until mid 2008 they've had enough sales to keep them alive. They died only recently, when people suddenly stopped buying their applications. You can blame Symbian Signed for it, but everyone can clearly see that it has nothing to do with it.

As I wrote, I can post at least several similar links to developers who stopped supporting Symbian OS because of no sales, and not because of being unable to afford signing their applications.

Symbian signed is, and thats no mistake. The developing side was becoming a bit stagnent well before the hack came along.

With respect to that, you could send it via PM or email, by posting it on the comments section in which the whole world can see and reply to, you are rather leaving it open for...comment.

First off, it would be such an unknown problem that very very few would know about it. But, because of hype, then more people will know about it.

Secondly, why is everyone bashing Nokia?

Forth, this is NOT a security expliot. People are making out its far more serious than it actually is. It cannot steal any information from your phone.

Unregistered wrote:OR, you've got to have someone who knows the explicit (fiddly) details and a lot of time to try different phone numbers randomly, and yours happens to be among them. If you have a vulnerable phone, you're toast. (Disclosure: I work for a security firm.)

Hardly. For a start, it would cost the wannabe prankster money to send out these random texts, and there would be no indication that anything's happening to any recipients. And "Toast"? You mean that absolute worst case, after receiving 11 wierd texts in a row (how unlikely is THAT from a random source), you might lose SMS functionality and need to (shock horror) wipe your internal disk and resync your data and apps. For something to be so incredibly unlikely AND to have next to no payload makes me think even more that this is a non-story from the end user point of view.

I agree with Unregistered regarding My-Symbian. I have always found AAS and its forum to be very friendly and helpful, something which could not be said of My-Symbian, mainly due to Michal's insistence on putting people down whenever possible. And it has nothing to do with political correctness and everything to do with a generally negative attitude to other people's opinions.

"putting people down whenever possible".

You can't be serious! I don't remember any case of such behaviour, but only rational posts with, and sometimes also rational replies against unrational accusations (much like yours, if I may add). Anyway, this is not the place for this type of ranting and raving; this topic is about a Messaging bug in certain S60 versions.

buster wrote:I agree with Unregistered regarding My-Symbian. I have always found AAS and its forum to be very friendly and helpful, something which could not be said of My-Symbian, mainly due to Michal's insistence on putting people down whenever possible. And it has nothing to do with political correctness and everything to do with a generally negative attitude to other people's opinions.

I expressed my opinion about the OS hack and its consequences, if you haven't noticed, not about you or any other person. If you don't agree with my opinion about piracy being boosted by the OS hack, come with some ARGUMENTS like I did, instead of purely personal (and rude) judgements. Your posts are the best example of who's putting other people down and who's alergic to other people's opinions, jumping into personal comments when you don't have valid arguments.

I should have known that posting on this forum always ends up like that. That's why I post here so rarely, already sicken several times in the past by this unfriendly and personal attitude of some of this site's members (often those once banned from My-Symbian for similar attitude and disturbing other people in having normal discussions), and after seeing now that nothing has changed I will avoid using this forum even more. Even though Steve (and sometimes Rafe) post on My-Symbian forums from time to time (and more often than I post here), it NEVER happened that they got such rude and personal responses from any of our 125.000 members or staff. Our forums are "unfriendly and unhelpful" only for people like you, turning every discussion into personal quarrel.

I won't be following this thread any longer so if anyone was planning to post further personal opinions about me, please save your time and AAS' server space.

Goodbye and happy new year.

Goodbye and good riddance. The only person I ever found to be rude and unfriendly on My-Symbian was you, and I was not banned, I left of my own volition, due to the hostile nature of your forum.

Nice to see that Nokia are taking the issue seriously:

http://discussions.nokia.co.uk/discussions/board/message?board.id=communicators&thread.id=33223

Nice to see that Nokia are taking the issue seriously:

http://discussions.nokia.co.uk/discussions/board/message?board.id=communicators&thread.id=33223

You can't be serious! I don't remember any case of such behaviour, but only rational posts with, and sometimes also rational replies against unrational accusations (much like yours, if I may add). Anyway, this is not the place for this type of ranting and raving; this topic is about a Messaging bug in certain S60 versions.

Well it was about the messaging bug, until a certain individual tried to change the topic. And having suffered the wrath of Michal after an innocent posting about some soon-to-be-released phone, his response to my rational posting was definitely what many would consider irrational. But you're quite right, and I shall say nothing more on the subject...

buster wrote:Well it was about the messaging bug, until a certain individual tried to change the topic. And having suffered the wrath of Michal after an innocent posting about some soon-to-be-released phone, his response to my rational posting was definitely what many would consider irrational. But you're quite right, and I shall say nothing more on the subject...

I've been visiting My Symbian and their forum since the beginning, for a decade or so. I finished school, got married, had children, changed my job twice and my phone like 5 times or so and the guy's still around doing good work. Like hundreds if not thousands of other regular visitors, I consider their forum one of the best in the internet, free of spam and stupid discussions like this one (and silly people commencing them), ran and moderated on a very high and professional level. The admin and mods are unique in their daily presence on the forum and their constant readiness to answer people's questions and take part in discussions. IIRC, Michal posted around 25000 posts on his forum and BentL posted well over 10000. Compare this to mods on other sites, including this one. Each of them separately posted more than what all mods on other sites posted together. They have their way of being, and you may like it or not, but they're among the hardest working and most active Symbian guys in the internet. If you don't like My Symbian or Michal, don't visit his website but stop bothering everyone with your personal animosities because no one gives a flying... saucer about it.

Now, can we go back to talking about the Messaging bug instead of Buster's hatred towards My Symbian owners before we all get sick of it? Especially that Michal has apparently left this discussion and it's rude to badmouth absent ones.

There's a tool that apparently should fix devices that have been affected by this attack, rather than needing a hard reset. Downloads can be found here.

(news spotted at Symbian Freak, but I thought a download from the official developers of the tool would be better).

It's nice to know the bug now has a name; CurseSMS. I'm curious to know who dreamt this up, though it would seem to be Fortinet, the company providing the fix...