HN

Need help?
<- Back
Zero click, silent, remote Android DoS

Zero click, silent, remote Android DoS

MarkBlah

Comments (117)

  • Retr0id
    A DoS like this is quite bad (in theory at least) but I think it's the first time I've seen one dressed up with a hypeslop landing page.
  • darkwater
    The issue seems serious but the part about Australia and 000 that would ban an attacked device seems the typical LLM-being-too-anal paragraph, and completely lacking common sense.Maybe I'm wrong and naive but given that the AU law was done to force people move forward from 3G only phones because the network was being shutdown and 000 moved to 5G (I believe), it's a law for operator to contact their customers still using an old phone and migrate them to a newer one. I doubt they will block automatically the number if you are under that DOS for a few days in a row.
  • jeroenhd
    Google has clearly flagged this as "not a security issue", repeatedly. It's a weird bug for sure, but what's the scenario here?Correct me if I'm wrong, but the carrier configuration messages can normally only come from carriers. The demo APK sends a message to the phone itself, but sending SMS messages requires special confirmation.Practically speaking, what's the risk?
  • dmitrijbelikov
  • rickdeckard
    The page mentions that an adb command is required to recover the device, but I can't find details on what exact adb this is.Overall a bit frustrating to have such a fancy webpage with a dedicated address, but then no description on how to actually #1 identify and #2 recover an affected device...> "Once the database is corrupt, com.android.phone no longer needs a fresh message to fail: it crashes immediately on every boot as it reads the damaged store [..] a factory reset only helps temporarily"Can't I delete the storage of com.android.phone instead of a full factory-reset?
  • jpl56
    We need this for opera houses. Send a few messages to each phone and we can enjoy the show without any ringing.
  • tompagenet2
    The Google Issue Tracker link [0] on the site shows access denied for me. Not sure if this is due to it being reappraised or because I specifically don't have access[0] https://issuetracker.google.com/issues/509520497
  • est
    I remember there was a tel: link than when I clicked it wipes everything on my samsung phone
  • grandfunction
    This is going to cause absolute havoc. I hope carriers move fast to block this payload.
  • cowlevel
    SQLite data corruption needs some explanation because SQLite is normally very reliable. How do I know this isn't slop written to spread a Trojan horse APK?
  • bossyTeacher
    "On a device using an eSIM, where the SIM can't simply be moved to another handset, recovery would be significantly harder, and for a non-technical user, effectively out of reach."eSims are great until they are not. Give me a second physical SIM tray over an eSim any day of the week.
  • rickdeckard
    > "A remote attacker can cut a phone off from Triple Zero"Disclaimer for non-aussies (like me): That's not the newest hacker slang for something, 000 is the phone number of Australian's emergency services...Replace with "can cut you off from 911" or 112, 999, etc. as needed (optionally wear sunglasses and add hand-gestures to amplify the effect)...or just call it "emergency services"
  • nubinetwork
  • syshyk
    Vanity sites...
  • Tepix
    Does this also affect GrapheneOS?
  • paxy
    It’s bizarre to me that on a forum where people constantly complain about AI garbage AI slop like this always gets upvoted to the top.
  • dools
    Networks still send WAP pushes but you can't just send randomly formatted WAP pushes to your friends. You can, however, use a stingray to MITM your friend's Android phone and send whatever you want to them, because now there is no network firewall to protect them. The combination of MITM and a bug like this could be pretty devastating.
  • soltanov
    Golden Era of AI exploits began few days ago. Close the doors, otherwise you will get cooked.
  • throwa356262
    Is this AI security slop or a real issue? Can the phone actually receive these kind of messages from the network?Also, I don't understand Googles position here. On android the phone ia not part of the OS and can be updated via an app or framework update. Why not just fix this as a functional bug?
  • klhs
    How could they possibly give this a "won't fix" if it can do what is reported here?
  • yellow_lead
    > The attack is remote, needs only the victim's number, and shows them nothing.err, how can I send an SMS like this? Would a mobile network even accept/forward such an SMS?Little hard reading through the vibe slop here
  • EdwardDiego
    Omfg I am interested in this, I'm interested in wtf a WAP push is, but all I'm getting on this website is Claude-speak "not this, but that" and tables of irrelevant numbers, because Claude fucking loves a table.Look at this Claude shit:> Zero-click. The victim does nothing. No tap, no open, no notification.> Silent. Nothing appears in Messages; the attacker's number is never shown.Congrats, now you sound like yet another AI YouTube advertisement. "You control when we... ...woohoo"...OP, please, if you think you have important information, please write it up yourself, I am so sick and tired of being sent LLM generated Markdown files with zero human input, and now you're just publishing that on a website.FFS.Oh you had Claude publish your name presumably so you'd get credit for "your" "discovery".Mark Blaszczyk, please do better.
  • 0xcrypto
    Can we stop vibecoding a new website for every next vulnerability we find please? Thank you.
  • anon
    undefined
  • anon
    undefined
  • hjadoui
    Good
  • villgax
    Shouldn’t click this reminder
  • anon
    undefined