SMS of Death — that’s what they call a new vulnerability Androidwhich allows you to disable the smartphone with the help of a specially formed text message. No need to open to attack SMSclick a link, or perform any other action. In some cases, sending such messages repeatedly can render the device virtually unusable.
Found the problem security researcher Mark Blaszczyk. The vulnerability is related to the processing mechanism of special SMS messages in Android. According to the researcher, it affects Android 12 and newer versions. Successful test attacks were conducted, in particular, on smartphones Google Pixel and Samsung Galaxy.
How the SMS of Death attack works
A specially crafted WAP Push SMS message is used for the attack. Android handles it in the background, but an error parsing the message can cause the system service responsible for phone calls to crash. The peculiarity of the attack is that the message is not displayed in a regular SMS inbox. The user may not even guess what exactly caused the failure. Even one such SMS can temporarily disrupt the operation of telephone calls and mobile communications. However, much more serious consequences are possible if the attacker sends the message again. After a reboot, Android may try to process the corrupted message again. This can cause repeated failures of the system service or even a cyclical reboot of the smartphone. According to the researcher, about 20 such messages can make the device very difficult to use.
Google has already released a patch for Android
Google included the fix in the October security update for Android 14 and later. The updated system recognizes a malformed message and deletes it instead of trying to process it again. However, the availability of a patch in Android does not mean that all smartphones will receive it at the same time. Manufacturers should prepare and release updates for their own models. Therefore, the terms depend on the specific device and its manufacturer’s support policy. Special attention should be paid to old smartphones that no longer receive regular security patches. If such a device is not updated, it may remain vulnerable.
What to do owners of Android smartphones
First of all, you should check for security updates and install the latest available patch. Usually, the corresponding section is located in the menu:
Settings → Security and privacy → System and update.
The names of the items may differ depending on the manufacturer and Android version. If the smartphone is running Android 13 or earlier and is no longer receiving security updates, the risk remains. At the same time, there is no usual setting that is guaranteed to block this particular attack: the system processes a special message even before it appears in incoming SMS.
Why timely Android updates are important
The SMS of Death vulnerability shows that it doesn’t always take malicious apps, suspicious links or user carelessness to attack a smartphone. Sometimes a message that the system automatically processes in the background is enough. Therefore, regular security patching remains one of the most important ways to protect Android devices. This especially applies to smartphones that are used for calls, banking and storing personal data.
