Australian emergency-call law could trigger device bans against attack victims
1 Oct 29 3:08 AM · 13d ago · 2 articles · 3 posts · 16 comments · 3 sources · development 1 of 1
The report notes that Australian Telecommunications (Emergency Call Service) Determination requires carriers to block devices that cannot reach Triple Zero (000). An attacker inducing this condition remotely could effectively get a victim's own device barred from carrier service, creating a perverse regulatory outcome where the fix for lost emergency access is network disconnection rather than OS patching.
“So an attacker who can remotely induce that condition on an Android handset can, in effect, get the victim's own device barred from carrier service until a fix exists.”
smsofdeath.com reportMarkBlah Security researcher
The whole story articlespostscomments the bright band is this development · numbered dots are the others · click one to jump
Reported in the same hours no headline names this development itself — these 1 claim were published in its stretch
-
2 outlets Zero click, silent, remote Android DoS
first by HN Best, 13d ago · also HN Frontpage
What people said 19 voices · best of 23 · verbatim
-
What confused the people dismissing this all over the comments here? It was clearly a DoS bug.Perhaps the site's tagline was all they read and admittedly I'd have phrased differently. > A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim. An…
-
It is more likely a severe communication issue happened. A related fix was committed by Google on June 15th [0] and was apparently assigned CVE-2026-58882. GrapheneOS [1] was able to ship the fix through the security preview channel as early as July, but it will otherwise be in the upcoming November security bulletin.[0]
-
As an ex-Google ISE, part of my work was to review security vulnerability reports to us. If this report came on my lap I would definitely have flagged this as a severe security issue. Just a DoS yes, but a severe DoS. I did tier two engineering reviews though. From the website's timeline it seems like a tier one triager dismissed it. And I would…
-
The page mentions that an adb command is required to recover the device, but I can't find details on what exact adb this is.Overall a bit frustrating to have such a fancy webpage with a dedicated address, but then no description on how to actually #1 identify and #2 recover an affected device...> "Once the database is corrupt, com.android.phone no…
-
The issue seems serious but the part about Australia and 000 that would ban an attacked device seems the typical LLM-being-too-anal paragraph, and completely lacking common sense.Maybe I'm wrong and naive but given that the AU law was done to force people move forward from 3G only phones because the network was being shutdown and 000 moved to 5G…
-
Australia has laws that require companies that provide a cellular service to follow, not fixing such a exploit would breach these laws. Under no circumstance can a telco, phone manufacturer or intermediary restrict or knowingly allow the restriction of access to Emergency Services. Google in this case would be considered as knowningly allowing the…
-
triage seems outsourced for android, messages like "we will forward this to the android team". This seems to have been a communication issue, they set it as Will Not Fix, they 'fixed' the bug by adding try/catches further up the chain in upcoming release, i missed that before i submitted.they did set it as a duplicate of a ticket they…
-
> "A remote attacker can cut a phone off from Triple Zero"Disclaimer for non-aussies (like me): That's not the newest hacker slang for something, 000 is the phone number of Australian's emergency services...Replace with "can cut you off from 911" or 112, 999, etc. as needed (optionally wear sunglasses and add hand-gestures to amplify the…
-
Google has clearly flagged this as "not a security issue", repeatedly. It's a weird bug for sure, but what's the scenario here?Correct me if I'm wrong, but the carrier configuration messages can normally only come from carriers. The demo APK sends a message to the phone itself, but sending SMS messages requires special confirmation.Practically…
-
Networks still send WAP pushes but you can't just send randomly formatted WAP pushes to your friends. You can, however, use a stingray to MITM your friend's Android phone and send whatever you want to them, because now there is no network firewall to protect them. The combination of MITM and a bug like this could be pretty devastating.
-
The Google Issue Tracker link [0] on the site shows access denied for me. Not sure if this is due to it being reappraised or because I specifically don't have access[0]
-
> I doubt they will block automatically the number if you are under that DOS for a few days in a row.You doubt correctly. The law is about blocking IMEI numbers of phones that use the 3g network to dial 000 despite being 4g devices.
-
A DoS like this is quite bad (in theory at least) but I think it's the first time I've seen one dressed up with a hypeslop landing page.
-
Now what we need is a PlayStore walled garden to protect us. Glad the big G happened already to be right on it.
-
I was wondering if that ai created site style had a name. 'hypeslop' seems like it could be perfect.
-
We need this for opera houses. Send a few messages to each phone and we can enjoy the show without any ringing.
-
So with proper tinfoil hat on: What can this be used for?- targeted suppression - targeted disruption
-
I remember there was a tel: link than when I clicked it wipes everything on my samsung phone
-
This is going to cause absolute havoc. I hope carriers move fast to block this payload.
All 1 developments of Android bug lets remote attacker disable phone calls via… →
Hacker NewsMastodonNewswires