‘Curse of Silence’ attack gives us a glimpse of the future
Written by Dan Blacharski on January 6, 2009
All mobile phones are becoming more intelligent. Today’s smartphone, still considered cutting edge and a tool for the upper class, will be tomorrow’s ordinary pocket phone. And when that happens, look out.
More evidence is coming in that smartphones will become a major target for attackers in the future. Just about everyone has some sort of security on their desktops or notebooks, but what about those smartphones? Increasingly, people use their smartphones to send email, but little attention is paid to security. It won’t be too long in the future that smartphones will be as common as notebooks. Besides the incredible popularity of the BlackBerry and the iPhone, the Google Android platform is gaining in popularity, and I expect this to be a game-changer. Android apps, until now, have only been freebies, but Google just announced that it’s shifting to a paid model–and this is going to result in serious developers creating applications–including business and communications applications–for the Android platform. Prices will be driven down, and more people will be using smartphones.
I’ve always said that attackers are opportunistic. They target the low-hanging fruit, they take the easiest path, and they take advantage of the most popular platforms so that they can cast the widest net possible. It’s inevitable that before too long, the bad guys will be taking a long, hard look at smartphones.
Just recently, it was discovered that it is possible to send a malformed text message to prevent Nokia smartphones from receiving further SMS messages. The malformed message can be sent from almost any Nokia phone. The so-called “Curse of Silence” attack, demonstrated rcently by the Chaos Communications Congress, shows how Nokia smartphones cannot receive SMS or MMS after receiving the malformed messages. To correct the problem, the phone must be factory reset. The attack is remarkably simple to execute, which may cause some worries.
The Curse of Silence attack however, doesn’t have a profit motive, so in my opinion anyway, it’s not going to be that widespread. There will be those who will take advantage of it just to annoy people, to be sure, but most people who are interested in attacks are looking for ways to steal something from you. That said, Curse of Silence is just the beginning. More dangerous attacks, which may steal login information, passwords, or other data from your smartphone, will become more prevalent.


