This security vulnerability, also known as “zero-click denial-of-service”, can interrupt ongoing calls without requiring any interaction from the smartphone owner. This SMS is not visible to the user and does not appear in their inbox. Users can’t see the content of the text message, nor do they know where it comes from.
If attackers send several such text messages, this can cause a process on the mobile phone to crash. The smartphone then enters a restart loop and prompts the user to reset their mobile phone to factory settings. This results in the loss of all data. Blaszczyk describes the characteristics and process as follows:
- Zero-click. The victim doesn’t need to do anything. No tapping, no opening, no notification.
- Discreet. Nothing appears in ‘Messages’; the attacker’s number is never displayed.
- Calls are cut off, including emergency calls. Active voice calls are terminated with the cause ‘DisconnectCause CS_DEATH’ while the process is restarted.
- Telephony outage. 1-2 seconds of service interruption per message while ‘com.android.phone’ is restarted.
- Re-delivery by the network operator exacerbates the problem. Unconfirmed messages are resent by the network operator, causing the phone to crash again; in testing, a single message caused intermittent outages lasting up to a week.
- Around 20 messages render the device unusable for an extended period.
- Persistent denial of service. The faulty message remains in the queue and is retried at every system start-up, meaning the phone may crash on start-up until it is deleted.
What makes this vulnerability so threatening is that it is present even in the very latest version of Android, namely Android 17. The security researcher was able to demonstrate this vulnerability as early as Android 12.
Foundry
Google has responded to this vulnerability and is rolling out a patch for Android 14 through to Android 17. However, it depends on your phone brand when you’ll receive the version tailored for your handset. Google will likely not be fixing this vulnerability for Android 12 and Android 13.
How to respond correctly
If your Android smartphone does indeed enter recovery mode, don’t follow the prompt and tap ‘Wipe data’ or factory reset your phone, as this will result in the loss of all your data. Instead, switch it off and go to an Android expert for help.
The phone will need to be be connected to a computer with a USB cable, after which the problematic text message can be selectively deleted using the Android Debug Bridge (ADB) without the need for a factory reset of the smartphone. However, this process requires advanced technical knowledge.
