Hidden SMS Triggers Android Phone Service Crashes and Call Blocking

En bref

• Attackers deliver hidden SMS messages to Android devices.
• The messages trigger a zero-click crash in the phone service.
• Effects include interrupted or blocked calls and unusable devices.
• Emergency calling can be blocked; Google Android devices are in scope.
• No CVE has been assigned; severity is high.

Attackers are abusing concealed text messages to trigger a crash in the phone service on Android handsets. The technique is described as zero-click, meaning a recipient does not need to open or interact with the message before the service fails. Because the failure sits in the telephony layer, it can disrupt normal calling rather than merely affecting a single app.

On impacted devices, the consequences extend beyond a brief glitch. Calls can be prevented from completing, active conversations can be cut off, and the handset may become unusable for voice service. Emergency dialing is also at risk of being blocked, which raises the stakes for students, staff, and families who rely on Android phones during urgent situations.

The scope is Android devices, and Google is the vendor associated with the affected phone service. No CVE has been assigned, so defenders should not wait for a public identifier to assess exposure. The severity is high because the attack requires no user action and targets a core function: reaching other people, including emergency responders.

For K-12 environments, the risk is not limited to district-owned hardware. Personal Android phones used by employees, students, and parents may be affected, and help desks could see reports of calls failing without an obvious cause. The hidden-message delivery method also makes the issue hard to spot through ordinary user reporting.

Watch for clusters of Android call failures, unexplained telephony crashes, and reports that emergency dialing did not work. Track vendor guidance from Google and mobile carriers, and avoid assuming that a lack of CVE means a lack of risk. Incident responders should preserve message metadata and device logs where policy allows.

À faire maintenant

1. Inventory Android devices and phone-service versions; flag district-owned and BYOD endpoints that rely on cellular voice.
2. Contact Google and carrier representatives for mitigation guidance; ask whether network-level SMS filtering or temporary service changes are available.
3. Strengthen SMS filtering and block suspicious message patterns at the carrier or MDM layer where feasible.
4. Test emergency calling on representative Android models and document failures; provide alternate dialing methods.
5. Tell users to report sudden call failures and device unresponsiveness; note that zero-click means interaction is not required.
6. Preserve logs and message metadata for affected devices; escalate to Google and the carrier.
7. Prepare a continuity plan for emergency communications using landlines, alternate phones, or radios.

Source originale

Security Affairs