Symbian DoS attack revealed

A security researcher has uncovered a new Denial-of-Service (DoS) attack against Nokia's Symbian Series 60 smartphone platform dubbed "the curse of silence."

According to an article on CNet, the attack takes the form of a specially crafted SMS message which, once received by a vulnerable handset, prevents further – legitimate – messages from being accepted by the system.

Demonstrated by security researcher Tobias Engel at the Chaos Communication Congress in Berlin last week, the receipt of an SMS containing a 'from' e-mail address of more than 32 characters causes devices based on versions 2.6, 2.8, 3.0 and 3.1 of Nokia's S60 platform to reject all further messages – in the case of 2.6 and 3.0, this happens after a single additional message gets through, with versions 2.8 and 3.1 clonk out after eleven further messages.

When the handset has entered the "curse of silence" state, the only solution is a complete factory reset – which also erases all data held on the internal memory, along with address books and stored messages and images. Data held on external memory such as add-in cards would be unaffected.

Nokia has said that it is "aware of the vulnerability" but "is not currently aware of any malicious incidents on the S60 platform related to this alleged issue and [does] not believe that it represents a significant risk to customers' devices." Accordingly, there is no firmware fix for the affected devices as yet – although the company is "working with the Symbian team to further investigate" the issue.

The good news is that handsets running S60 3rd Edition Feature Pack 2 – such as the company's popular N95 range – are unaffected by the attack. It is also possible to implement network-based filtering at the service provider level to reject delivery of a malformed SMS message, and Nokia has claimed that "many operators are looking into and actually already implementing network filtering to prevent this issue." Which operators that might be was not revealed by the company.

Is the attack something to be worried about, or are you hoping you don't irritate anyone enough to be targeted by a denial of service attack? Share your thoughts over in the forums.