BINARY SMSs >> so far this is the coolest thing since me ok or rather this security Lab [Part 1]

BINARY SMSs

Basically SMSs are small number of packed bytes sent over the operator networks. Many people will speculate the Text Messages are the only types of SMSs that exist, well they are one of the many types that ideally exist, hence the term ‘texting’

So how do SMSs work and what are the basic constructs of an SMS

SMSs use the concept of ‘ports’ just as a standard internet sockets does;

SMS messages have limits of 140-160 characters (depending on encoding type);

The body is not the only thing you can edit in SMSs, there’s also UDH (User Header Data)

So J Those Ports

Say you go to the my website http://0x7678.com/  you basically called to port 80 of the webserver by convention. The connection will be initialized on port 80 and then switched to a higher port to let other users access the same port of the web server. Port 80, as stated by IANA refers to the HTTP protocol, this means that a server, which is able to understand HTTP protocol request, will be awakened and will be ready to answer and process HTTP requests. The same happens with SMS messages. You can send an SMS to a specific port of a phone and you will wake up a specific service on that device. Now, just as , not all computers have a standard service (e.g web server) also not all mobile devices have services listening to ports. (this is manufacturer specific, so you will need to check your phone what is enabled to accept.

NOW >> BORING STUFF OUT … WE GO ON TO BINARY SMSs

Ok long story short going through the whole bit about how SMSs work is too tedious

But here we go ….

Ok so SMSs on default use 7 bits to handle a character. This means that you can write in an SMS only characters on the basic ASCII char table … i.e 127 characters. If you want to go onto more complex stuff and send more ‘interesting’ characters , then a group of 8 bits is needed and the table of available chars get bigger. The available space is 1120 bits per SMS, no more, no less. You can have 160 chars using 7 bits or 140 chars using 8 bits.

NB: note this carefully … you will find this letters looking alike but are very different, " É "  and this " È " are very very different the first is contained in the 7 bit basic ASCII and the second contained in the 8 bit larger ‘interesting’ table, so if you  use it without checking it, you wont have enough space so be very precise.

UDH (User Data Header)

The UDH is what a ‘high level developer’ can set while to do something more than a simple “text message”. A UDH is very useful because you can send “invisible text messages” to mobile application (where to “mobile applications” I mean those running on mobile devices for example) or you can tell a device that the message will contain special information. It’s very similar to an XML file: you have to tell the parser what you are sending, and the content following the prolog which will be handled by the parser itself.

The UDH is mainly used to specify what ports our client (phone) will send SMS to. Its made by a set of hex number which describe:

<how long the UDH is><the format used to specify ports numbers><the port number length><destination port number><source port number>

As a practical example, say I want to create a UDH to send a WAP PUSH. Where the standard destination port for WAP pushes is 2948, the UDH will be:

06 05 04 0B 84 23 F0

Where:

06 means “hey the read the following 6 bytes”

05 is the format for numbers, in this case hexadecimal numbers

04 will tell the UDH that each port is represented using 4 characters

0B84 is the destination port, 2948 (decimal representation) or 0B84 (hexadecimal representation)

23F0 is the source port, 9200 (decimal representation) or 23F0 (hexadecimal representation).

NOTE: Use a simple calculator to convert decimal numbers to hex: select “Dec”, put 2948 in the calculator, then press the button “Hex”.

NOW REALLY >> BINARY SMSs

A binary SMS is an XML-formatted textual SMS, which has been transformed with WBXML (a tag transformer), this means that for each XML tag, a binary byte is associated. E.g , the tag <SI> is converted as the binary character &#x0005;

When you think WHY WBXML?

WBXML transformation is smaller in the number of generated bytes than the verbose textual XML file itself.

Note: many tags are converted to bytes, but sometimes also contents (such as URL addresses

) e.g the URL http://www.0x7678.com can be written in WBXML as 0D0x7678.com, where “0D” stands for http://www.

“OC” is more generic and stands for http:// so you can write the URL in two ways.

<span>0D0x7678.com </span>

or

<span>0Cwww.0x7678.com</span>

The first uses 9 chars (0D is one byte), the second 13 chars

So far so good ….. ?

·       Decide what we want to send

·       Find the docs about that topic

·       Find the XML structure of the message to be sent

·       Customize the XML

·       Convert the XML to WBXML

·       Prepare the UDH

·       Send the UDH and the BODY

NB

Binary SMSs have two indicators whilst been sent, either a “Service Indication <SI>” or “Service Load <SL>” the two have a difference only in <SI> prompts the owner to the phone that content is coming through and you need to authorize it...

[Cont. in Part 2....]