conv.

All stories
SecurityQuiet 12d · day 14

Android bug lets remote attacker disable phone calls via malformed SMS

A zero-click vulnerability in WAP Push SMS handling can crash Android's telephony system and permanently brick devices, blocking even emergency calls.

newest coverage 11d agosummary written 13d ago28 pieces325 likes & upvotes186 comments Hacker NewsMastodonNewswires

What to know

  • A malformed WAP Push SMS can remotely crash Android phones' telephony system and drop emergency calls, requiring no user interaction and leaving no trace.
  • Repeated attacks corrupt the message database, creating persistent telephony failure that factory reset cannot fix, because carriers redelivery the payload automatically.
  • Under Australian law, devices unable to reach emergency services are blocked from carrier networks—meaning the regulatory remedy for this attack is device disconnection, not patching.
  • Google's vulnerability triage reportedly dismissed the report despite its severity; debate centers on real-world exploitability (carrier SMS restrictions vs. MITM or stingray scenarios).

The dispute Whether the vulnerability constitutes a critical security risk hinges on whether carrier-level SMS filtering adequately prevents exploitation, or whether MITM/stingray scenarios make it a genuine threat. · positions read across 23 posts and comments

many voices

This is a severe security issue that should have been escalated higher in Google's triage process.

  • “If this report came on my lap I would definitely have flagged this as a severe security issue. Just a DoS yes, but a severe DoS.”

    mrb · Hacker News ↗
many voices

The practical risk is limited because carriers control WAP Push delivery and would block malformed messages; Google's dismissal may be justified.

  • “Google has clearly flagged this as "not a security issue", repeatedly. It's a weird bug for sure, but what's the scenario here? the carrier configuration messages can normally only come from carriers.”

    jeroenhd · Hacker News ↗
some voices

The attack becomes viable through MITM or stingray interception, which removes carrier firewalls and enables delivery of arbitrary WAP Pushes.

  • “You can, however, use a stingray to MITM your friend's Android phone and send whatever you want to them, because now there is no network firewall to protect them. The combination of MITM and a bug like this could be pretty devastating.”

    dools · Hacker News ↗
some voices

The report's Australian regulatory angle is overcomplicated and unlikely to result in automatic device bans for temporary DoS.

  • “the part about Australia and 000 that would ban an attacked device seems the typical LLM-being-too-anal paragraph, and completely lacking common sense. I doubt they will block automatically the number if you are under that DOS for a few…”

    darkwater · Hacker News ↗

MarkBlah Security researcher

How it unfolded 1 development · click the chart to see its coverage articlespostscomments

Peak 10 pieces in 4h at Oct 29, 2 AM; 28 pieces over 14 days (2 articles · 3 posts · 23 comments) Oct 29, 2 AM — 10 pieces · 2 articles · 2 posts · 6 comments — Hacker News 7, Newswires 2, Mastodon 1Oct 29, 6 AM — 9 pieces · 1 post · 8 comments — Hacker News 8, Mastodon 1Oct 29, 10 AM — 5 pieces · 5 comments — Hacker News 5Oct 29, 2 PM — 3 pieces · 3 comments — Hacker News 3Oct 29, 6 PM — quietOct 29, 10 PM — quietOct 30, 2 AM — quietOct 30, 6 AM — quietOct 30, 10 AM — quietOct 30, 2 PM — quietOct 30, 6 PM — quietOct 30, 10 PM — quietOct 31, 2 AM — quietOct 31, 6 AM — 1 piece · 1 comment — Hacker News 1Oct 31, 10 AM — quietOct 31, 2 PM — quietOct 31, 6 PM — quietOct 31, 10 PM — quietNov 1, 1 AM — quietNov 1, 5 AM — quietNov 1, 9 AM — quietNov 1, 1 PM — quietNov 1, 5 PM — quietNov 1, 9 PM — quietNov 2, 1 AM — quietNov 2, 5 AM — quietNov 2, 9 AM — quietNov 2, 1 PM — quietNov 2, 5 PM — quietNov 2, 9 PM — quietNov 3, 1 AM — quietNov 3, 5 AM — quietNov 3, 9 AM — quietNov 3, 1 PM — quietNov 3, 5 PM — quietNov 3, 9 PM — quietNov 4, 1 AM — quietNov 4, 5 AM — quietNov 4, 9 AM — quietNov 4, 1 PM — quietNov 4, 5 PM — quietNov 4, 9 PM — quietNov 5, 1 AM — quietNov 5, 5 AM — quietNov 5, 9 AM — quietNov 5, 1 PM — quietNov 5, 5 PM — quietNov 5, 9 PM — quietNov 6, 1 AM — quietNov 6, 5 AM — quietNov 6, 9 AM — quietNov 6, 1 PM — quietNov 6, 5 PM — quietNov 6, 9 PM — quietNov 7, 1 AM — quietNov 7, 5 AM — quietNov 7, 9 AM — quietNov 7, 1 PM — quietNov 7, 5 PM — quietNov 7, 9 PM — quietNov 8, 1 AM — quietNov 8, 5 AM — quietNov 8, 9 AM — quietNov 8, 1 PM — quietNov 8, 5 PM — quietNov 8, 9 PM — quietNov 9, 1 AM — quietNov 9, 5 AM — quietNov 9, 9 AM — quietNov 9, 1 PM — quietNov 9, 5 PM — quietNov 9, 9 PM — quietYesterday, 1 AM — quietYesterday, 5 AM — quietYesterday, 9 AM — quietYesterday, 1 PM — quietYesterday, 5 PM — quietYesterday, 9 PM — quietToday, 1 AM — quietToday, 5 AM — quietToday, 9 AM — quietToday, 1 PM — quietToday, 5 PM — quiet 1
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9now · 9:14 PM ET
  1. 1

    Australian emergency-call law could trigger device bans against attack victims

    The report notes that Australian Telecommunications (Emergency Call Service) Determination requires carriers to block devices that cannot reach Triple Zero (000). An attacker inducing this condition remotely could effectively get a victim's own device barred from carrier service, creating a perverse regulatory outcome where the fix for lost emergency access is network disconnection rather than OS patching.

    “So an attacker who can remotely induce that condition on an Android handset can, in effect, get the victim's own device barred from carrier service until a fix exists.”
    — smsofdeath.com report

    • What confused the people dismissing this all over the comments here? It was clearly a DoS bug.Perhaps the site's tagline was all they read and admittedly I'd have phrased differently. > A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim. An…

      6thbitHacker News13d agoview on Hacker News ↗
    2 more of the top 3 · 23 posts in this stretch

    • It is more likely a severe communication issue happened. A related fix was committed by Google on June 15th [0] and was apparently assigned CVE-2026-58882. GrapheneOS [1] was able to ship the fix through the security preview channel as early as July, but it will otherwise be in the upcoming November security bulletin.[0]

      WonderfallHacker News13d agoview on Hacker News ↗

    • As an ex-Google ISE, part of my work was to review security vulnerability reports to us. If this report came on my lap I would definitely have flagged this as a severe security issue. Just a DoS yes, but a severe DoS. I did tier two engineering reviews though. From the website's timeline it seems like a tier one triager dismissed it. And I would…

      mrbHacker News13d agoview on Hacker News ↗
    all of them →
  2. background

    Vulnerability enables persistent denial of service requiring full recovery sequence — The report clarifies that database corruption from repeated attacks forces the device into persistent telephony failure: even factory reset provides only temporary relief because the carrier automatically redelivers the unacknowledged WAP Push payload, retriggering the crash on each boot. Full recovery requires technical intervention beyond standard user procedures.

  3. background

    Researcher discloses zero-click Android SMS DoS affecting Pixel and Samsung phones — A technical report details a vulnerability in Android's WAP Push SMS decoder that throws an uncaught exception when processing a specially crafted 5-byte header, crashing the telephony daemon. The payload can be delivered silently as data SMS with no user interaction. Testing shows 100% reproduction on Pixel 9 and various Samsung Galaxy/A-series devices.

Also covered reported alongside — the timeline has no entry for these yet

  1. 2 outlets Zero click, silent, remote Android DoS

    first by HN Best, 13d ago · also HN Frontpage

What people are saying 16 voices from 1 site · best of 23 · verbatim

Still unanswered
  • What is the exact ADB recovery command referenced on the report page?
  • Can the message database be recovered by deleting app storage rather than factory reset?
  • Will carriers proactively block this WAP Push payload, and how quickly?