.jpg)
Xavfsizlik tadqiqotchisi yaqinda yamalgan Android zaifligi — "SMS of Death" deb nomlangan va CVE-2026-58882 sifatida kuzatilgan — uchun isbot-konsept eksploitini e'lon qildi. Bu hujumchilarga maxsus tayyorlangan matnli xabar yuborish orqali masofadan uyali aloqa xizmatini to'xtatish yoki telefonlarni ishdan chiqarish imkonini beradi.
Bu nol-bosish (zero-click) xizmatdan voz kechish (denial-of-service) zaifligi maqsadning hech qanday aralashuvisiz davom etayotgan qo'ng'iroqlarni, jumladan favqulodda qo'ng'iroqlarni ham to'xtatishi mumkin. Eng yomoni, Android xabarni SMS qutisiga yetib borishidan oldin qayta ishlaydi, shuning uchun jabrlanuvchilarda telefonlari nima sababdan ishdan chiqqanini ko'rsatadigan hech qanday ko'rinadigan belgi qolmaydi.
Zaiflik tadqiqotchisi Mark Blahning so'zlariga ko'ra, Google zaiflikni 2026-yil oktyabr oyidagi Android xavfsizlik yangilanishlarida Android 14 dan 17 gacha bo'lgan versiyalar uchun yamagan. Biroq, bu zaiflik Google'ning oktyabr xavfsizlik byulletenida ro'yxatga olinmagan, va eski Android 12 hamda 13 qurilmalari tuzatish olmagani uchun zaif qolmoqda.
Blah zaiflikning texnik tahlilini e'lon qildi. U Android'ning WapPushOverSms.decodeWapPdu funksiyasida sarlavha uzunligi qiymatini noto'g'ri tekshirish natijasida yuzaga keladi.
Zaiflikdan foydalanish uchun hujumchi maqsadli telefonlarga quyidagi noto'g'ri tuzilgan sakkiz baytli WAP Push xabarini yuborishi mumkin:
01 06 88 80 80 80 00 BE → 2948-portga ma'lumot SMS sifatida yuboriladi Bu qiymat imzolangan 32-bitli butun songa aylantirilganda, chegaraviy tekshiruvsiz -2147483648 ga aylanadi.
Android bu salbiy qiymat yordamida xotira ajratishga uringanda, NegativeArraySizeException yuzaga keladi va bu com.android.phone jarayonini ishdan chiqaradi.
com.android.phone jarayoni uyali aloqa funksiyalarini boshqargani uchun, uning ishdan chiqishi mobil ulanishni buzadi va davom etayotgan telefon qo'ng'iroqlarini, jumladan favqulodda xizmatlarga qo'ng'iroqlarni ham uzadi.
Tadqiqotchining aytishicha, hujum operatorlar zararli xabarlarni qayta yetkazishga uringanda yoki Android telefonda allaqachon saqlangan xabarlarni qayta ishlashga uringanda ham takroriy ishdan chiqishlarga sabab bo'lishi mumkin.
Zaiflikni sinovdan o'tkazishda tadqiqotchi 20 ta zararli xabar yuborish telefonlarning qayta yuklanish tsikliga tushib qolishiga sabab bo'lishi mumkinligini aniqladi. Bitta Android 12 qurilmasida telefon taxminan har 90 soniyada tiklanish rejimiga qayta yuklandi, bu esa foydalanuvchidan qurilmani tiklash uchun zavod sozlamalariga qaytarishni talab qildi.
Sakis ismli GitHub ishtirokchisi Android Debug Bridge (ADB) yordamida zararli xabarlarni o'chirish usulini topdi, ammo bu jarayon yanada ilg'or texnik bilim va kompyuterga kirish huquqini talab qiladi.
Tadqiqotchi boshqa Android qurilmasidan zararli xabarlarni yuborishi mumkin bo'lgan isbot-konsept eksploitini e'lon qildi.
Google'ning tuzatishi, "Fix remote DoS in decodeWapPdu" deb nomlangan, noto'g'ri tuzilgan matnli xabarlarni qayta ishlashda yuzaga keladigan istisnolarni ushlab qolish orqali ishdan chiqishlarning oldini oladi.
Yamalash shuningdek, zararli xabarlarni SMS ma'lumotlar bazasidan o'chirib tashlaydi, bu esa ularning takroriy ishdan chiqishlarga sabab bo'lishining oldini oladi.
Android xavfsizlik yangilanishlari odatda qo'llab-quvvatlanadigan qurilmalarda avtomatik ravishda o'rnatiladi, ammo ularning mavjudligi qurilma ishlab chiqaruvchisi va operatorga bog'liq, va o'rnatishni yakunlash uchun qayta yuklash talab qilinishi mumkin.
Endi ishlaydigan isbot-konsept eksploit e'lon qilinganidan so'ng, Android foydalanuvchilariga qurilmalarini himoya qilish uchun eng so'nggi xavfsizlik yangilanishlarini o'rnatish qat'iy tavsiya etiladi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlarning ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyalarni o'lchaydi.
Hisobotni oling
.jpg)
A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message.
The zero-click denial-of-service flaw can interrupt ongoing calls, including emergency calls, without requiring any interaction from the target. What's worse, Android processes the message before it reaches the SMS inbox, leaving victims with no visible indication of what caused their phones to crash.
According to the vulnerability researcher, Mark Blah, Google reportedly patched the vulnerability in its October 2026 Android security updates for Android 14 through 17. However, the flaw is not listed in Google's October security bulletin, and older Android 12 and 13 devices remain vulnerable because they did not receive the fix.
Blah published a technical analysis of the flaw, caused by improper validation of a header-length value in Android's WapPushOverSms.decodeWapPdu function.
To exploit the flaw, an attacker can send the following malformed eight-byte WAP Push message to targeted phones:
01 06 88 80 80 80 00 BE → sent as a data SMS to port 2948 When this value is translated into a signed 32-bit integer without a bounds check, it becomes -2147483648.
When Android attempts to allocate memory using this negative value, it triggers a NegativeArraySizeException that crashes the com.android.phone process.
As the com.android.phone process manages cellular functions, the crash disrupts mobile connectivity and disconnects ongoing phone calls, including calls to emergency services.
The researcher says the attack can also cause repeated crashes when carriers attempt to redeliver malicious messages or Android tries to process messages already stored on the phone.
When testing the flaw, the researcher found that sending 20 malicious messages could cause phones to get stuck in reboot loops. On one Android 12 device, the phone rebooted into recovery mode approximately every 90 seconds, requiring the user to perform a factory reset to recover.
A GitHub contributor named Sakis discovered a way to remove the malicious messages using Android Debug Bridge (ADB), but the process requires more advanced technical knowledge and access to a computer.
The researcher has published a proof-of-concept exploit that can send the malicious messages from another Android device.
Google's fix, titled "Fix remote DoS in decodeWapPdu," prevents the crashes by catching exceptions triggered when Android processes the malformed text messages.
The patch also deletes malicious messages from the SMS database to prevent them from triggering repeated crashes.
Android security updates are generally installed automatically on supported devices, but their availability depends on the device manufacturer and carrier, and a restart may be required to complete installation.
Now that a working proof-of-concept exploit has been released, Android users are strongly advised to install the latest security updates to protect their devices.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report