Injecting SMS Messages into Smart Phones for Security Analysis

The Short Message Service (SMS) is one of the building blocks of the mobile phone service. It is used for text messaging by users as well as for services that work under the hood of every mobile phone. The security of SMS-implementations is critical because attacks can be carried out remotely without any user interaction and because SMS can not be disabled or filtered on current mobile phones. This paper presents a novel method for vulnerability analysis of SMS-implementations. The presented approach is independent from any service operator, does not produce costs, and guarantees reproducible results. Our approach was able to identify previously unknown security flaws that can be used for Denial-of-Service attacks against current smart phones.