Windows Phone SMS attack discovered, reboots device and disables messaging hub
Microsoft's range of Windows Phone devices suffer from a denial-of-service attack that allows attackers to disable the messaging functionality on a device. — The flaw works simply by sending an SMS to a Windows Phone user.
Context & Ripple Effects
The flaw lands at a delicate moment for Microsoft's mobile push: just a day earlier, on December 12, 2011, the company moved Andy Lees out of the Windows Phone top job and handed the platform to Terry Myerson, while separately courting developers and users with moves like offering free Windows Phones to people who report malware problems on Android devices.
That security-flavored marketing makes this disclosure awkward — a single inbound SMS is confirmed to reboot a Windows Phone handset and disable its messaging hub, meaning the platform's most basic communication function can be switched off remotely by anyone who knows a user's number.
First-order effects
- Windows Phone users are exposed immediately: any attacker with their number can force a reboot and knock out the messaging hub with one text, with no interaction required from the victim.
- Microsoft's response burden falls on Terry Myerson's newly installed Windows Phone team, which must ship a fix while the platform is still fighting for market credibility.
Second-order effects
- The disclosure undercuts Microsoft's attempt to position Windows Phone as the more secure alternative to Android — the same week it was handing out free handsets over Android malware reports, its own platform proves vulnerable to a trivially cheap attack.
- Carriers and enterprises evaluating Windows Phone for fleets now have a concrete availability risk to weigh against the platform's other selling points, pressuring Microsoft to demonstrate fast patch turnaround.
Third-order effects
- If unauthenticated network input like SMS can take down a whole handset, smartphone makers face pressure to sandbox message parsing away from core OS functions — treating carrier-delivered messages as hostile input rather than trusted traffic.
- For a third-place platform, repeated availability flaws compound the ecosystem problem: developers and buyers read instability as a signal about the platform's engineering maturity, not just a patchable bug.
The trend: Smartphone messaging stacks are emerging as a recurring denial-of-service attack surface, where a single malformed inbound message can crash or disable an entire device.