Android 'Message of Death' Flaw Can Crash Phones Remotely

A security researcher has disclosed a new Android vulnerability, nicknamed "Message of Death", that allows a malicious text-style message to disable a phone remotely. The victim does not need to open the message or tap a link.

The flaw abuses the way Android handles a specific type of message. It can knock out calling services, cut off calls in progress and, in some cases, push the device into a repeating restart loop.

How the attack works

The problem lies in WAP Push messages, which the operating system processes automatically and which do not normally appear in the standard SMS inbox. According to the researcher, a message that is deliberately malformed can cause a fault inside Android's telephony system.

What makes it more worrying is that the crash can occur as soon as the message reaches the device. If the network keeps sending the message, the phone can remain stuck in continuous reboots.

Patches and who is at risk

Google has prepared a fix, and protection has already reached some devices running recent Android versions through the latest security updates. Older phones that no longer receive regular security patches may remain more exposed.

The flaw is aimed at disrupting phone services. So far there is no confirmed evidence that it has been used to steal passwords or personal data, and no large-scale attacks exploiting it have been observed against Android users.

Users are advised to check their security patch level and install the latest Android update available for their device. The case is another reminder not to postpone updates: a routine security patch can be the difference between a normally working phone and one that fails suddenly without warning.