How can a short message that can make a mobile phone fail be forwarded to someone else's mobile phone?

Recently, a very lively event is the exposure of MTK mobile phone short message vulnerability. Because the purchase of mobile phones using MTK solutions now accounts for a large proportion in the market, and this vulnerability is effective for almost all MTK mobile phones, and individual users can hardly prevent or remedy it, so it is affected in a wide range. After a lot of collection and sorting, as well as my own testing, I found that this vulnerability is really tried and tested, and I hereby share it.

Maybe many people don't know what to say when they hear "MTK mobile phone". Actually, this is a formal name. MTK mobile phone refers to the mobile phone with MTK mobile phone chip developed by MediaTek Company. Because of low price, strong function, high market share and low production cost, many unknown brands can make mobile phones, which has caused a lot of confusion in the market. Generally, we call it a "cottage phone". A notable feature is that the screen is a touch screen, and there is a gray function area at the bottom of the screen with four or five function buttons distributed on it, as shown in the figure below:

After reading the picture, we basically know what the so-called "MTK mobile phone" is. Since the goal is clear, let's talk about this loophole.

I. Conditions at the time of the attack:

Recently, it is often reported that after receiving prank messages, the mobile phone appears black screen, vibration and ringing, which is the most typical vulnerability feature. This kind of short message basically tells you that if you browse the short message, there will be a black screen and so on. If you have courage, turn it over. Most people think this is a boring game played by boring people, but who knows that when you refuse, the situation will really appear. ...

Second, the vulnerability code:

In fact, all these situations are caused by imy ringtones supported by MTK mobile phones. Loading different imy files in the short message content will have different effects. The contents of this imy file are as follows: (Note that the code is between two lines of #, excluding #)

1。 blank screen

###########################

BEGIN:IMELODY

Beat: 1200

Melody: (ledoffbackoffvibeoffr5 ledoffbackoffvibeoffr5 @ 600)

End: IMELODY

###########################

2。 great earthquake

###########################

BEGIN:IMELODY

Version: 1.2

Format: CLASS 1.0

Beat: 100

Melody: (Ledofledonbackoffbackovibeon @ 300)

End: IMELODY

###########################

3。 ring

###########################

BEGIN:IMELODY

Version: 1.2

Format: CLASS 1.0

Beat: 200

Melody: (ledoffbackoffvibeonr5vibeoffledonbbackonr5 @ 200)

End: IMELODY

###########################

Third, take advantage of loopholes

This short message vulnerability can only be used on MTK mobile phones, which means that MTK mobile phone editors must send similar short messages to other MTK mobile phones to take effect. So first, you must have an MTK mobile phone. Then open Notepad in the computer, paste the corresponding code (the part between two lines of # signs, excluding # signs) into it, save it as a file, and put the imy file in the audio folder of the mobile phone. Make sure it's a mobile phone folder, not a memory card. Finally, start writing short messages on your mobile phone (note that they are short messages, not multimedia messages). The content of the short message is optional. After editing, click Options-Insert Object-My Ringtone, select the imy file you just made and send it to users who are also MTK phones.

When writing imy file, please note that the line "MELODY" has an @ symbol followed by a number, which is actually the action time. The larger the number after @, the longer it takes. You can change the status quo yourself. The unit of time is milliseconds.

Fourthly, vulnerability analysis.

After reading the previous content, it is clear that the essence of this vulnerability is imy file. It is understood that imy file is the earliest monosyllabic ringtone supported by Sony Ericsson, which can be used to call the decoding chip of mobile phone to make some sounds and even some core instructions. So if there are similar commands in the code, such as black screen, ringing, etc., these commands will be triggered once they are opened after being sent to the other party, which will of course cause corresponding results. At present, as long as someone can understand the programming language of these codes, it should be no problem to send short messages such as formatted memory cards. I have an imy file with formatting command in my hand, so I didn't experiment because I was afraid of causing bad consequences to others.

Experimental situation and prevention of verb (abbreviation of verb)

During the experiment, I found that not all mobile phones with gray function keys on the screen can be recruited. Maybe these phones don't use MTK scheme. I guess, since imy is not a proprietary format of MTK mobile phones, theoretically all mobile phones that support imy ringtones will be recruited. As for prevention, I find it difficult. After all, as long as it is triggered, it will be recruited. Maybe it will only help if you close similar SMS immediately, stop browsing and avoid activating imy file code. Of course, this is only relative, if the short message sent by the other party is inserted into imy file before writing. ...