Hacker News: MarkBlah

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 19:11:48 +0000

triage seems outsourced for android, messages like "we will forward this to the android team". This seems to have been a communication issue, they set it as Will Not Fix, they 'fixed' the bug by adding try/catches further up the chain in upcoming release, i missed that before i submitted.

they did set it as a duplicate of a ticket they disregarded.

I found the Chrome team the easiest to communicate with, devs would actually respond.

page updated to reflect.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 16:25:45 +0000

I’m not going to sit there ensuring css aligns right so ofcourse I automated that, the content is all accurate, it was reworded by LLM, bug is real.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 16:20:50 +0000

Sounds like a you problem, I’m just sharing information that’ll hopefully force Google’s hand in fixing a bug.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 16:17:30 +0000

App dies mid write corrupting db, code is available for review, it’s small.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 16:14:24 +0000

I’m certain others have found the same bug, I’d like an answer too, hence the post.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 16:13:05 +0000

A wordpress page would be more believable, right?

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 16:11:58 +0000

I guess if you just use the torch on your android phone then it wouldn’t be serious.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 16:07:31 +0000

You sound like android triage team.

Apk provided can be installed on an attackers phone, you specify the msisdn (phone number) of victims phone, click send and it crashes telephony app of the victim.

Multiple messages may create a race condition that corrupts an SQLite database that stores message which stops telephony from functioning as a phone. WiFi will still work so I guess you can use it as a tablet as long as you don’t mind the constant dialogs popping up.

Tested in AU, US, DE and UK with 100% success rate.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 14:42:00 +0000

To recover I deleted the telephony.db, 2 minutes later carrier resent the messages…

Only fix is to place sim/esim into non Android device

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 14:33:46 +0000

Huh, Yes victims phone number, bug is in android. Carriers just send messages.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 13:49:04 +0000

Load apk, select which sim you want to use, enter Android victims phone number, hit send, it will crash telephony app and it’ll restart.. carrier will resend the text message as there was no acknowledgment crashing it again in a loop.

Only “fix” for this attack is to place SIM card in a non-Android phone to ack the inbound messages, or wait a few days of constant disconnects.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 11:41:50 +0000

Ah before www, gopher was used to try arrange information, similar to this page. Prior to that there were bbs’s where you dialed up to another computer.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 11:36:36 +0000

Slop and real issue. Wap-push is a legacy format for sending urls via sms. Bug is a stupid one but it exists.

Google are rather vague in their triage, they just said temporary DoS does not qualify, then rejected to investigate further.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 11:05:23 +0000

wap-push is a legacy protocol, it predates mms's, android can send it fine, ios just ignores them.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 11:02:38 +0000

I just wanted a home for it to share, llm just polished it up.

the message is silent, no notification notifying of the attackers origin, doesn't matter if it's locked, or connected to mobile data, so i stand by what is written.

I don't care about the credit, i have enough CVE's under my belt which are higher severity, none which have dedicated write-ups. i care that this gets fixed and give answers to those who are experiencing their phones constantly disconnecting from carrier.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 08:54:28 +0000

feel free to curl it, or review the repo https://github.com/MarkBlah/smsofdeath/

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 08:53:08 +0000

mind boggles, issue is they're swamped with AI slop and high number of findings, they're using AI assistance operated by a 3rd party to handle researcher submissions so many legitimate findings slip through the cracks.

New comment by MarkBlah in "Zero click, silent, remote Android DoS"

MarkBlah — Thu, 29 Oct 2026 08:48:05 +0000

agreed, we should all use gopher and block all web traffic, go back to text based systems, use single threaded operating systems and use token ring NIC's

Zero click, silent, remote Android DoS

MarkBlah — Thu, 29 Oct 2026 07:08:50 +0000

Article URL: https://smsofdeath.com/

Comments URL: https://news.ycombinator.com/item?id=50285452

Points: 298

# Comments: 169