The vulnerability was disclosed last week


Vulnerability researchers of Context has discovered a flaw in Samsung’s Galaxy S4, S4 Mini, S5 and Note 4 smartphones that could be exploited by remote attackers to reboot targeted devices.

The security hole, already patched by Samsung , could be exploited via WAP configuration messages, pushed to targeted devices with minimum user interaction:

…usually such malicious messages are blindly accepted without proper checking regarding their origin or content…

What is WAP Push?

The Wireless Application Protocol (WAP) suite has been in public operation since 1999. 
The Wireless Datagram Protocol (WDP) which forms part of the WAP suite provides a UDP-like layer to transport data between two endpoints on specific ports.

WDP itself can be transported over many protocols, including SMS

WAP Push is transported on WDP and allows content to be pushed to the device with minimal (or no) user intervention. The data is encoded using WAP Binary XML (WBXML).

The proof-of-concept

In this video, Context’s researchers showed how an Android phone could be attacked:

[embed]https://www.youtube.com/watch?v=hL3gA8IMO-w[/embed]

So, check your your smartphone updates ASAP!

The disclosure

[embed]https://www.contextis.com/resources/blog/wap-just-happened-my-samsung-galaxy/[/embed]

Official Samsung Patch

[embed]https://www.contextis.com/resources/blog/wap-just-happened-my-samsung-galaxy/[/embed]