How can i prevent my phone from spying through sms

Question

Recently while reading up a article over here ,The following were the summary :

hacking suite dubbed Smurf Suite, it can hack any mobile by sending an encrypted text message

So based on the above sentence ,I can imagine the following :

Attacker sends a sms to victim-->victim either opens/reads sms -->once it opened/received by victim -->exploit will run into victim's phone

The following things i could think over regarding it

• I cant stop myself from reading text messages since its common human nature to read whatever sms was received

• AFAIK there was no method to stop my mobile from receiving message,it might be transmitted through either mobile networks/websites etc

• if websites i could contact my telecommunication and ask them to block over it,but again the attacker can send a exploit sms to me through mobile career

Apart from the above things what were the possible stuff i could do prevent myself from spying,Also note that if it's MMS i can stop it by without using internet on the phone[maybe the last solution i could think off]

Looking forward for some precautionary steps which i could do myself to prevent spying over me

Answer 1

without knowing how exactly the message initiates the attack its hard to say how to protect your self against it.

if we assume that it has to first touch your os for anything to happen then what you could do is create a small android application (simple one) which simply runs in the background as a service and isolates the message from you/the rest of the system unless it follows certain rules (i.e its from someone you know/approve)

and then if it passes the tests you set out it will forward the message onto your system and have it as a normal message.

As I said this is a difficult question to answer as smurf is a government application, I would need to know at what point the sms triggers a take over. as soon as it gets to the phone? as soon as it is read? as soon as it gets to the official inbox? its hard to say.

Answer 2

There's far too little information available about this software and it's spreading techniques. It could be even possible that the initial remote code execution is happening in the baseband. It could be possible that the "smurf suite" is a whole framework of tools which allows the attacking of many different kind of devices and operating systems.

Even though it's very unlikely you can escape a targeted operation of an intelligence agency there's a chance that some techniques become public so that anyone could abuse em.

Until we know more about this vulnerability there are only a few drastic mitigations left:

• Don't trust your phone. Handle as few as possible communication with it. Leave it at home if you don't really need it.
• Get a "dumb phone". The attack surface is smaller and it's easier to obtain and replace.
• Always remove the battery if you don't need your phone. No matter if your phone is at home or with you.

Good luck.

Answer 3

I think on android you can choose only allow sms from known sources options. That will reduce the attack surface to people that you have in your contact list... :)

Other way is request to the service provider to exclude you from that service. The bad is that you will not be able to receive sms on the phone.

The good is that some of them might have a management web page where you can read the sms messages in any browser... :) I think Vodafone allows you to send and receive messages using their website. :)

As for the message the vulnerability normally is related with the application that is parsing the text.

First you need to get rid of the sandbox where she is running and then hit the OS.

So the probability of having one exploit that works in the web browser and in the sms message program is low but not impossible...

Just have the phone patched...

Against a Government attack they usually can contact the manufacturers either hardware or software and persuade them to insert new functionalities (check Eduard Snowden publications)... or the service providers so you have no chance as a civilian... just don't use phones... if that is the case or build your own private network using citizen band (wifi) :P and use friends to bridge messages and VOIP.