Multiple Smartphones SMS Sender Obfuscation via WAP Push SI [Security Advisory]

Posted by admin on 14/Sep/2009 in Security Alert Log | 0 comments

WAP Push SI (Service Indication) is a special service SMS which allows operators or everyone else to provide an easy way for alerting the smartphone user about new services or online resources. (see specification WAP-167 for further details). Some Smartphones fail to properly display the originator of this kind of message which leads to a sender obfuscation.

This attack can be used in combination with social engineering to mislead the recipient to access the resource specified in the WAP Push SI message (usually an online resource). In addition this attack can be used to send spam and hate SMS.

Tested Devices

The following devices have been tested and found vulnerable for this kind of attack: It is very likely that other devices and vendors are also vulnerable to this attack.

• Blackberry (Tested on BB 8800, Firmware: 4.5.0.37)
  The BlackBerry fails to report the correct originating number and display the number of the SMS service center as originator of the message
• Windows Mobile (Tested on WM5, WM6, WM6.1, WM6.5)
  A Windows Mobile driven device fails to properly display the originating number and displays whatever information is defined in the X-WAP-Initiator-URI field.
• Sony Ericsson W890i, W810i
  The Sony Ericsson W890i and W810i device fails to properly display the correct originating number and displays a default string instead.
• Motorola RazrV3
  The Motorola RazrV3 device fails to properly display the correct originating number and displays a default string instead.

Discovered by: Michael Mueller a.k.a. c0rnholio
Contact: c0rnholio on domain netcologne.de
Advisory Homepage: http://www.silentservices.de/adv03-2009.html
Vendor Status: not contacted
Fixes / Workarounds: none known
Discovery Date: June, 2008
Public Disclosure: 11.09.2009