[Security Advisory] Multiple Smartphones MMS Notification Sender Obfuscation

Discovered by: Michael Mueller a.k.a. c0rnholio
Contact: c0rnholio on domain netcologne.de
Vendor Status: not contacted
Fixes / Workarounds: none known
Discovery Date: June, 2008
Public Disclosure: 11.09.2009


Description:

A MMS Notification is part of the MMS communication flow. Usually an originator sends and
mms via a service provider (SP). After uploading the message to the SP, the recipient gets a
MMS notification from the SP with information like originator, subject and URL of the content.
In some mobile carrier networks it is allowed to send MMS notifications directly from one mobile
unit to another.

Some Smartphones fail to properly display the originator of this kind of message which leads
to a sender obfuscation.

Continue reading

[Security Advisory] Multiple Smartphones SMS Sender Obfuscation via WAP Push SI

Discovered by: Michael Mueller a.k.a. c0rnholio
Contact: c0rnholio on domain netcologne.de
Vendor Status: not contacted
Fixes / Workarounds: none known
Discovery Date: June, 2008
Public Disclosure: 11.09.2009


Description:

WAP Push SI (Service Indication) is a special service SMS which allows operators
or everyone else to provide an easy way for alerting the smartphone user about new
services or online resources. (see specification WAP-167 for further details)
Some Smartphones fail to properly display the originator of this kind of message
which leads to a sender obfuscation.

Continue reading