The Google Issue Tracker link [0] on the site shows access denied for me. Not sure if this is due to it being reappraised or because I specifically don't have access
I remember there was a tel: link than when I clicked it wipes everything on my samsung phone
grandfunction 37 minutes ago [-]
This is going to cause absolute havoc. I hope carriers move fast to block this payload.
soltanov 21 minutes ago [-]
Golden Era of AI exploits began few days ago. Close the doors, otherwise you will get cooked.
yellow_lead 60 minutes ago [-]
> The attack is remote, needs only the victim's number, and shows them nothing.
err, how can I send an SMS like this? Would a mobile network even accept/forward such an SMS?
Little hard reading through the vibe slop here
rustyhancock 47 minutes ago [-]
Looks like the website offers an APK.
But not all SMS are text messages for the user.
snitch182 29 minutes ago [-]
carriers can reset access points via messages for example. Learned it the hard way when my 1st grader suddenly had internet...
klhs 1 hours ago [-]
How could they possibly give this a "won't fix" if it can do what is reported here?
anonymous908213 30 minutes ago [-]
The "if" is doing a lot of heavy lifting. Can it do what it claims to do? LLMs are always hallucinating that they've found the most severe bug in software history.
MarkBlah 1 hours ago [-]
mind boggles, issue is they're swamped with AI slop and high number of findings, they're using AI assistance operated by a 3rd party to handle researcher submissions so many legitimate findings slip through the cracks.
klhs 52 minutes ago [-]
That's unfortunate. They need to do some kind of triage then, I hope this doesn't mean that they're constantly busy now with equally bad or worse bugs, but I guess it wouldn't be too surprising.
01 06 88 80 80 80 00 BE → sent as a data SMS to port 2948
I'm not familiar with WAP Push and how it works, but is it possible to disable it or block that port on a non-rooted phone?
3 hours ago [-]
0xcrypto 2 hours ago [-]
Can we stop vibecoding a new website for every next vulnerability we find please? Thank you.
solyin 2 hours ago [-]
Blame heartbleed for the practice, which long predates ChatGPT and vibecoding. Human psychology is to blame. Only nerds are going to find CVE-2014-0160 triggering, but if I say heartbleed everyone who was there remembers.
autoexec 1 hours ago [-]
> Only nerds are going to find CVE-2014-0160 triggering, but if I say heartbleed everyone who was there remembers.
That has more to do with the severity of heartbleed than the fact that it had a name and a logo. I've since seen a lot of vulnerabilities try to market themselves with websites, cute names, and stupid logos but I still don't remember them because they still just weren't big enough to actually be memorable.
rustyhancock 46 minutes ago [-]
I think it's a good idea when there is no CVE and a don't fix status.
Before this practice in general you simply released the exploit and see if enough chaos triggers a fix.
exploderate 23 minutes ago [-]
If people can't be responsible, let's just create a mailing list, call it "full-disclosure" and post everything there.
__m 2 hours ago [-]
Why? I like the presentation.
MarkBlah 1 hours ago [-]
agreed, we should all use gopher and block all web traffic, go back to text based systems, use single threaded operating systems and use token ring NIC's
EdwardDiego 53 minutes ago [-]
Omfg I am interested in this, I'm interested in wtf a WAP push is, but all I'm getting on this website is Claude-speak "not this, but that" and tables of irrelevant numbers, because Claude fucking loves a table.
Look at this Claude shit:
> Zero-click. The victim does nothing. No tap, no open, no notification.
> Silent. Nothing appears in Messages; the attacker's number is never shown.
Congrats, now you sound like yet another AI YouTube advertisement. "You control when we... ...woohoo"...
OP, please, if you think you have important information, please write it up yourself, I am so sick and tired of being sent LLM generated Markdown files with zero human input, and now you're just publishing that on a website.
FFS.
Oh you had Claude publish your name presumably so you'd get credit for "your" "discovery".
Mark Blaszczyk, please do better.
hard_times 21 minutes ago [-]
are you ok?
20 minutes ago [-]
Rendered at 09:56:46 GMT+0000 (Coordinated Universal Time) with Vercel.
[0] https://issuetracker.google.com/issues/509520497
err, how can I send an SMS like this? Would a mobile network even accept/forward such an SMS?
Little hard reading through the vibe slop here
But not all SMS are text messages for the user.
I'm not familiar with WAP Push and how it works, but is it possible to disable it or block that port on a non-rooted phone?
That has more to do with the severity of heartbleed than the fact that it had a name and a logo. I've since seen a lot of vulnerabilities try to market themselves with websites, cute names, and stupid logos but I still don't remember them because they still just weren't big enough to actually be memorable.
Before this practice in general you simply released the exploit and see if enough chaos triggers a fix.
Look at this Claude shit:
> Zero-click. The victim does nothing. No tap, no open, no notification.
> Silent. Nothing appears in Messages; the attacker's number is never shown.
Congrats, now you sound like yet another AI YouTube advertisement. "You control when we... ...woohoo"...
OP, please, if you think you have important information, please write it up yourself, I am so sick and tired of being sent LLM generated Markdown files with zero human input, and now you're just publishing that on a website.
FFS.
Oh you had Claude publish your name presumably so you'd get credit for "your" "discovery".
Mark Blaszczyk, please do better.