Microsoft confirms Windows Phone Messaging killing bug

December 14, 2011 | By Surur

Tom Warren from Winrumors revealed (pretty irresponsibly we feel) that Windows Phone 7 has an SMS bug that would allow specially formatted messages (be it from Facebook, SMS or Windows Live) to reboot devices and then cause the Messaging system to lock up permanently, requiring a hard reset to fix.

This would of course be a pretty good denial of service attack on a user, and given that it can come from a SMS message, it could originate from people completely unknown to you.

Microsoft has now confirmed the bug and promised to work to fix it, with Greg Sullivan, Senior product manager for the Windows Phone division telling the Verge:

“We are aware of the issue and our engineering teams are examining it now. Once we have more details, we will take appropriate action to help ensure customers are protected.”

The last time Microsoft had to send out a security update it was for the browser certificate security vulnerability, which was pushed out several months after the vulnerability was patched on the desktop. Lets hope Microsoft proves more nimble on this occasion.

Source:theVerge.com

About Surur

Site Admin and Windows Phone enthusiast, he has been using Windows Mobile devices since before they were called PocketPC’s. He is currently sporting a HTC 7 Trophy.

Tagged bug, Messaging, security, windows phone 7.5

http://twitter.com/osmox Karim

Here another bug alike on WP7 (7720) :
- Ensure that your PIN is required.
- Turn On your phone and don’t enter PIN code (Press back button).
- Open Phone Hub, go to Call Settings :
- Normally, it prompt you PIN code…..
- If you click cancel button on the pad you get access to settings anyway !

rsgx

What?

The back button doesn’t work when the phone is locked.
Thomas Bundgaard

What’s the big deal? You can’t do anything in there anyways.

Anonymous

The last time Microsoft had* #corrections

Luckily the bug isn’t very terrible. He only revealed it’s possible, not how to do it, and he informed Microsoft about the technical details so they can analyse the problem more quickly.
Also, I expect MS would give this a fairly high priority, so I expect an update quickly.
http://www.facebook.com/profile.php?id=1038421423 Jamie Buzz Darani

I don’t think it was irresponsible to put this out as news on WinRumors, they have not revealed to anyone how it is done other than Microsoft.

rsgx

Agreed.

It should hopefully get MS to act on it quickly.
Anonymous

Surur, you should just remove that part of your blog post. It adds no value and makes you sound jealous!

Anonymous

If some-one were to send me one of those SMS messages now I would lose all my SMS messages, as there is no way to back them up and I would need to hard reset. As mentioned I think the disclosure was very irresponsible. They way these things are normally done is first contact the company, negotiate with them, find out what is safe to release and then release details after patch has been send out if the company is responsive, or after a month if they are not.

Blasting the news out first to every hacker on the planet with an axe to grind and then informing Microsoft is pretty irresponsible and backwards.

Anonymous

I like the word: irresponsibly. That’s something all blogers/writer should avoid, unless you are doing this with malicious intent. If you look at the web, this message is spreading everywhere. Those haters are in hunger with this kind of message. When the message get to their mouth, they will distort the truth, and make it huge deal. Tom Warren got a lot of hits, if that’s what he wanted, fine.
https://profiles.google.com/christopher.gull/ CG

On the other hand, revealing it like this will speed up MS’s process of fixing it, as us regular users are now in jeopardy, and MS would not like that.

Anonymous

True. But 1. it is unfair for Microsoft because, like surur mentioned, reporting the story itself is like telling hackers to work on it. 2. it is unfair to the users like us for obvious reason.

https://profiles.google.com/christopher.gull/ CG

I’m a user of WP7, and yes, it would suck if my messaging hub died, but it would suck even more if someone else, perhaps with evil intentions, found this, and started exploiting it without telling anyone about it. That is, if nobody knew about it and it happened to me, I would be mad. With a potential threat to users, MS will have to be swift, that is my conclusion.