Hacker News Reader

Comment by rixrax | Hacker News Reader

This brings back old memories from hardening the sms/text parsers of feature phones of yesteryear.

There it wasn’t entirely uncommon that when you sent a malformed sms-deliver PDU (e.g. text message) to the phone and crashed parser that tried to decode it, it took also the phone down before it could ack the message back to SMSC. Which of course meant that as soon as phone was turned on and it registered to network, that same message was redelivered (crashing it again) for as far as the network was concerned, it was never received by the mobile. Until the time that message either expired in the SMSC in few days, or you switched you sim to a non-vulnerable mobile to receive the message. Good times.

View on HN

Back in the day AOL parsed HTML for it's instant messages, a <font size=9999999999999999999999> would blue screen any client running windows. It was quite easy to empty chat room(s) using this.

Some AVs would monitor for certain IRC commands and kill the connection because it looked like your computer was talking to a c&c server.

But you could also write the same code into any IRC chat room and anyone running that AV would get booted.

DCC SEND startkeylogger 0 0 0

Hahaha on Yahoo we called it booting.

On AOL we called it "punting", and the apps that facilitated it were the first reason I ever wanted to code.

Strange nostalgic memories of "AOHell" and "LuciferX" come to mind... If I remember, a lot of them were visual basic apps that would use SendKeys() to control AOL via keyboard shortcuts. A little like the wild west back then...

Anyone recall the "SubZer0" proggie? (and who else recalls calling apps "proggies" in our kitchy chat rooms?)

I remember Sub-7 and its modules, including those that forced the user to play (and win) a game of tic-tac-toe, could melt the screen, flip the screen upside down and misc destructive things.

I recall a few, FaTe, AoLazy, and others being shared in island55. Also memories of Master AOL & Internal/Overhead accounts that allowed infinite scrolling in chat.

Man, I wish I knew what I was doing back then. Major service providers allowing unsanitized inputs like that? Sounds like a lot of low hanging fruit! And this was before blogging was popular so communicating advanced techniques wasn't as easy back then either.

Those must've been some scary code bases.

Ditto. I got into VB because of this "exploit," and that kicked off my inadvertent career choice. Punters were all the rage.

By the time AOL 3.0 rolled around, it wasn't bluescreening the machine, rather just ending the AOL process and disconnecting.

I downloaded VB4 from an AOL mail server when I was 11. I made the mistake of forwarding the email, which AOL considered making a pirated copy of the software. Came home from school the next day and our AOL account was terminated.

my little secret to not getting punted on aol was to remove the aolrich.dll which was responsible for parsing all the html the client received. those were great days!

Not to beat my own drum but I did not agree with the ethics of booting, and while I was too lazy to code back then, I rooted for defensive apps that armored you against getting booted :D. Yahelite on Yahoo was the best.

Same, this is how I got started with coding as a teenager.

Easier way to boot a group of people off of Yahoo Games back in the day when you wanted to clear up a room...

Just post in the general chat area.

“Hey, to speed up Yahoo Games, press alt-f4.”

Iirc the social engineering script was to “hold the alt key and repeatedly tap f4”. That has the two keys far enough from each other in prose to trick more people.

I always heard "hold down alt and press each f key one at a time", people forget about alt f4 if you don't specifically say f4

Even today Twitch chat is full of "Hold CTRL and type "WTF" for ℱ𝓪𝓷𝓬𝔂 𝓦𝓣ℱ" and people end up pressing ctrl+w, which closes the tab.

MSN Messenger did a similar thing.

I learned that you could evade their swear word filters in your screen name by using ASCII codes.

So I looked up a table. Beep didn’t work, but NULL would boot everyone on your contact list out.

Doesn't that date back to IRC?

irc has kicking / banning and kickbanning.. not necessarily booting (unless you used it as lingo) and certainly not HTML parsing.

/ping +++ATH0

There's supposed to be a delay in the Hayes protocol to prevent this kind of thing, but many "Hayes compatible" implementations didn't implement that part (through ignorance? working around a patent?), so this trick would work pretty well . . .

Patent issues. https://en.wikipedia.org/wiki/Time_Independent_Escape_Sequen...

Hayes themselves would even insert the sequence in press releases posted to Usenet. https://groups.google.com/forum/#!topic/comp.dcom.modems/Vr2...

IRC totally did have "booters" back in the old day, that would cause mass disconnects.

There was a nice talk about this a few years ago at the CCC congress.

https://media.ccc.de/v/27c3-4060-en-attacking_mobile_phones

http://www.ngolde.de/sms/smsodeath_mulliner_golde_cansecwest...

> [...] at the CCC congress

Your "congress" is redundant because CCC=Chaos Communication Congress.

ATM machine

CCC = chaos computer club. They might also use it for other meanings, but referring to the actual original name makes absolute sense.

This brings back old memories from hardening the sms/text parsers of feature phones of yesteryear.

They were indeed hardened? Do tell.

I've suggested that the iPhone be hardened against rendering crashes, here on HN. The immediate reaction is to downvote me, then reply, "undefined behavior must crash the process." That's pretty glib and shortsighted, however. It took me just a few seconds to think of a solution.

Have one process write the messages in a log file. This process also supervises the second process. The 2nd process renders the messages. If the 2nd process keeps crashing on the same message, the 1st process marks that message as a problem, and the user can be prompted to send the hex dump of the message for diagnostic purposes. (So if it's spicy, they can say no.)

The fact that such a basic function of the iPhone can be remotely vanished, requiring a reboot, is a pretty glaring hole. What's even worse, is that highly paid SV programmers would shrug their shoulders so easily.

Yes, Sony Ericsson A200 had a bug in SMS picture decoding (old, monochorme, pre-MMS one) which was easily craftable into an exploit if carriers were allowing multipart SMS.

Guess what cell carriers did back then? Yes, they disabled multipart SMS

What else could they do?

Filter. Spam detection wasn’t exactly a novel idea back then either.

With what? Especially back then, I wouldn’t assume there is anything with a programmable CPU in the data path that can inspect and filter things at line rate.

SMS are sent between devices via a message gateway server.

Fascinating problem. Since I have Faraday cages on the mind today (not that I know much more than ~10 minutes of reading)... simply isolating the phone from all signals would block both the message and any software update, so that doesn't work. But what if you attached it to wifi but not to the cell network? Either have the wifi router (itself having a wired connection) and the phone in the same shield; or, I guess, people say Faraday cages target certain wavelengths, so if wifi and cell tower are sufficiently different, maybe you could have a selectively blocking Faraday cage. Would that have been workable? (non-EE here)

To answer your question about selectively blocking, just put the wifi router inside the cage. To the point though, feature phones didn't have WiFi generally. I'm also not sure how doing so would fix the issue, unless you could block the number perhaps.

Feature phones also didn't have OTA updates. I remember taking my phones to service centers to get the latest software flashed. Later on you could flash it yourself with a cable to your PC, browsing esato.com for new versions.

> This brings back old memories from hardening the sms/text parsers of feature phones of yesteryear.

> There it wasn’t entirely uncommon that when you sent a malformed sms-deliver PDU (e.g. text message) to the phone and crashed parser that tried to decode it, it took also the phone down before it could ack the message back to SMSC.

By yesteryear do you mean the present and feature phones do you mean current android phones? Some models are still vulnerable to a text-of-death.

https://poetengineer.postach.io/post/deleting-the-text-of-de... not my blog, but the same problem happened with my mother in law's phone. The phone becomes unusable because of a stream of org.android.phone application has stopped messages and the only thing to do is use adb to delete all texts, until it comes in again. I was never able to pin down the exact problem.

Edit: Sorry, I didn't mean to come off as snarky, but I just wanted to 1) point out that there are still issues with decoding SMS and MMS messages, even in some modern phones and 2) provide a link to anyone who encounter the same issue as it was very frustrating for my MiL and very frustrating until I figured out I could just wipe all SMSes with adb.

Reply on news.ycombinator.com