The issue seems serious but the part about Australia and 000 that would ban an attacked device seems the typical LLM-being-too-anal paragraph, and completely lacking common sense.
Maybe I'm wrong and naive but given that the AU law was done to force people move forward from 3G only phones because the network was being shutdown and 000 moved to 5G (I believe), it's a law for operator to contact their customers still using an old phone and migrate them to a newer one.
I doubt they will block automatically the number if you are under that DOS for a few days in a row.
I don't see why Android or iOS couldn't enable location based DnD at certain locations. Of course make it optional, but they already have your location and know that the place you are at is an Opera house, theater, etc...
No thanks. "I tried to reach you yesterday". "Oh sorry, I happened to walk by an opera house." PLEASE, less, not more automatisms. Everything has a tendency to produce false positives.
The Google Issue Tracker link [0] on the site shows access denied for me. Not sure if this is due to it being reappraised or because I specifically don't have access
They do accept/forward messages without checking if they are special carrier-only ones. ~10 years ago I had some fun sending a "voicemail received" message to people, which caused android phones to display a notification which couldn't ever be dismissed. IIRC it only worked on HTC phones and required root/xposed. SS7 in general is built with total trust in connected systems.
The "if" is doing a lot of heavy lifting. Can it do what it claims to do? LLMs are always hallucinating that they've found the most severe bug in software history.
mind boggles, issue is they're swamped with AI slop and high number of findings, they're using AI assistance operated by a 3rd party to handle researcher submissions so many legitimate findings slip through the cracks.
That's unfortunate. They need to do some kind of triage then, I hope this doesn't mean that they're constantly busy now with equally bad or worse bugs, but I guess it wouldn't be too surprising.
Ironic comment from someone who literally just submitted an AI slop report and went so far as to give it a website and cutsey name to attempt to feign legitimacy and skill behind the "researcher."
WAP Push is a specially formatted SMS that triggers your phone to download a URL. Unfortunately the vuln here appears to hit at the SMS parsing phase, which I don't think can be turned off easily.
Blame heartbleed for the practice, which long predates ChatGPT and vibecoding. Human psychology is to blame. Only nerds are going to find CVE-2014-0160 triggering, but if I say heartbleed everyone who was there remembers.
> Only nerds are going to find CVE-2014-0160 triggering, but if I say heartbleed everyone who was there remembers.
That has more to do with the severity of heartbleed than the fact that it had a name and a logo. I've since seen a lot of vulnerabilities try to market themselves with websites, cute names, and stupid logos but I still don't remember them because they still just weren't big enough to actually be memorable.
agreed, we should all use gopher and block all web traffic, go back to text based systems, use single threaded operating systems and use token ring NIC's
Omfg I am interested in this, I'm interested in wtf a WAP push is, but all I'm getting on this website is Claude-speak "not this, but that" and tables of irrelevant numbers, because Claude fucking loves a table.
Look at this Claude shit:
> Zero-click. The victim does nothing. No tap, no open, no notification.
> Silent. Nothing appears in Messages; the attacker's number is never shown.
Congrats, now you sound like yet another AI YouTube advertisement. "You control when we... ...woohoo"...
OP, please, if you think you have important information, please write it up yourself, I am so sick and tired of being sent LLM generated Markdown files with zero human input, and now you're just publishing that on a website.
FFS.
Oh you had Claude publish your name presumably so you'd get credit for "your" "discovery".
>...which is the exact shape of a "Destructive Remote DoS" in the VRP's own rules.
The trend of Claude referring to everything as having a "shape" irrationally annoys the hell out of me. What an absolutely idiotic way to say "X is like Y."
This trend upsets me so much, because my brain actually does work like that, concepts and ideas exist in 3d space and have likenesses to each other.
I used to write like this, but I can't anymore. (I suspect enough people did in the training set that that's why it ended up being part of the vernacular.)
Maybe I'm wrong and naive but given that the AU law was done to force people move forward from 3G only phones because the network was being shutdown and 000 moved to 5G (I believe), it's a law for operator to contact their customers still using an old phone and migrate them to a newer one. I doubt they will block automatically the number if you are under that DOS for a few days in a row.
:grimace:
[0] https://issuetracker.google.com/issues/509520497
err, how can I send an SMS like this? Would a mobile network even accept/forward such an SMS?
Little hard reading through the vibe slop here
But not all SMS are text messages for the user.
My provider had given me a remotely managed router. It was trivial to change the configuration and have it work normally.
I'm not familiar with WAP Push and how it works, but is it possible to disable it or block that port on a non-rooted phone?
That has more to do with the severity of heartbleed than the fact that it had a name and a logo. I've since seen a lot of vulnerabilities try to market themselves with websites, cute names, and stupid logos but I still don't remember them because they still just weren't big enough to actually be memorable.
Before this practice in general you simply released the exploit and see if enough chaos triggers a fix.
Look at this Claude shit:
> Zero-click. The victim does nothing. No tap, no open, no notification.
> Silent. Nothing appears in Messages; the attacker's number is never shown.
Congrats, now you sound like yet another AI YouTube advertisement. "You control when we... ...woohoo"...
OP, please, if you think you have important information, please write it up yourself, I am so sick and tired of being sent LLM generated Markdown files with zero human input, and now you're just publishing that on a website.
FFS.
Oh you had Claude publish your name presumably so you'd get credit for "your" "discovery".
Mark Blaszczyk, please do better.
The trend of Claude referring to everything as having a "shape" irrationally annoys the hell out of me. What an absolutely idiotic way to say "X is like Y."
I used to write like this, but I can't anymore. (I suspect enough people did in the training set that that's why it ended up being part of the vernacular.)