Technology News

Mobile phone security vendors were rejoicing last night when it emerged that an obscure bug in an old version of the Symbian OS could allow an attacker to crash a target’s mobile phone with a specially-formatted text message.

The attack has been rather dramatically branded the “Curse of Silence”, and is a genuine bug that prevents incoming SMS messages being received once a specially-formatted text has been sent to the target as, demonstrated by Tobias Engel. Phones running Nokia’s S60 interface, versions 2.6 to 3.1, can be attacked in this way, and some models need a hard reset to recover.

The bug comes courtesy of the way that SMS was designed to integrate with internet email services: no one really understood what the relationship between email and SMS would eventually be, and in the early days there were many email-to-SMS gateway services. Short messaging was seen as the ideal way of delivering email alerts, but the combination of price and increasing spam levels paid to most of them, especially as spam filtering was unknown at the time.

But not before the 3GPP, the standards-setting body for the cellular industry, had stated that messages could be identified as “Internet Electronic Mail”, and should be displayed as such when received. Prior to version 2.6 the S60 messaging client made no attempt to display such messages properly, but with 2.6 the messages got broken into “sender” and “message body”, and (it turns out) if the “sender” field is more than 32 characters then the messaging client falls down.

Security vendors have been looking for something against which to protect mobile-phone users for a while; mobile phone viruses are little more than proof-of-concept experiments, and when a real security issue comes up it’s on embedded platforms that the security firms can’t protect anyway. So F-Secure proudly states that its customers are protected from the “Curse of Silence”, though even Vice President Samu Konttinen admits that at worst “there is a risk of it becoming a nuisance”.

Recent handsets, such as the N85, N96, 6650, are using S60 Feature Pack 2 and are therefore immune. However, if you’ve got one of the earlier models and tech-literate enemies who know your number and enjoy irritating you, then you could be at risk. ®

I have never expected much out of a Silicon Valley startup with a name that sounds like a baby word, but Swoopo is a rare exception. It’s an online auction site with a dastardly twist.

When you bid on products at Swoopo, you don’t specify a price. You pay 75 cents for the bid, and that bid increases the price of the item by 15 cents, while extending the auction for around 20 seconds. When the clock runs out, the auction is over. By this mechanism, the winning bidder can buy, for example, a brand new Nintendo DS game system for around $30, when the item is valued at well over $100.

And Swoopo cashes in on all of the losing bidders who drop 75 cents every time they fail to win. If you don’t want to spend your time giving this company your money, you can activate their automatic Bid Butler, as lightening your wallet is a task best left to machines (a fundamental law of the internet first proven by Google).

Most of the items up for bidding are real products like TVs, computers, and iPods. But to make things interesting, Swoopo has some specialty auctions, such as “FreeBids,” where bidders bid on bids. Since they’re valued at 75 cents a piece, Swoopo can sell bids like real products. Even better than that, they run auctions for cash – where users spend their money trying to win a couple hundred dollars.

This is very close to gambling, but the nondeterminism comes directly from the actions of other users, not the randomness of a dice roll or a deck of cards, so while Swoopo hasn’t quite crossed the line, they can see it from where they stand.

This alone doesn’t amount to a hustle, it’s simply a slick business plan. While there’s no evidence of Swoopo doing it, if they wanted to run a scam, it would be awful easy. It’s a good thing that we fine, upstanding citizens at El Reg have put our collective minds toward delivering an insightful and balanced view of the news, because if we were running the show at Swoopo, here’s how we’d do it.

Since there’s no verification to the rest of the community that the winning bidder actually collected the item he or she won, we would write a program that automatically up-bids the auctions, to keep the paying customers paying. Keep upbidding until the meatspace users give up and “collect” the item. We wouldn’t even need inventory. If users start to get wise to the swindle, plant a few fake bloggers to talk about how they got an awesome deal on a plasma TV from Swoopo or simply dial back the bot and let a few users win the auctions.

Again, it doesn’t appear as if Swoopo is doing this, but until then, happy bidding. ®