MarkBlah/smsofdeath

This is a security research proof of concept: an Android app that sends a malformed WAP Push message over SMS, causing a crash in the receiving phone's telephony process. It is intended for authorized testing on devices you own or have explicit permission to test, not as an everyday utility.

What it does and how it works

The app sends a crafted 8-byte WAP Push PDU as a data SMS to port 2948. On the receiving handset, the malformed PDU triggers a NegativeArraySizeException in WapPushOverSms.decodeWapPdu; the exception goes uncaught in InboundSmsHandler and kills com.android.phone, dropping any active call, including emergency calls, without victim interaction. The README ships the exact payload bytes and links a full writeup for the protocol-level analysis (README, writeup).

Using it

You build it with ./gradlew assembleDebug, which requires an Android SDK path in local.properties; Android Studio creates this automatically. The resulting debug APK goes on a sender device. In the app you enter or auto-fill the target number from an active SIM, choose the sending SIM, and tap the send action. Verification is done on the target through adb logcat filtered for the relevant crash lines: the author expects a fatal exception in com.android.phone within roughly 1–2 seconds and a PID change, plus a brief loss of signal (README).

Requirements and boundaries

• The app targets Android minSdk 30 and targetSdk/compileSdk 35, and requests SEND_SMS, READ_PHONE_NUMBERS, and READ_PHONE_STATE (README).
• Sending is not silent in the sense of being undetectable on the sender side: it uses the device's SMS stack, so the sender needs SMS capability and the permissions above.
• The README does not document which Android versions or telephony implementations are affected, or whether the crash is fully fixed in current releases; the expected 1–2 second crash is the author's stated observation, not a guarantee across devices.
• The author explicitly limits use to authorized security research and testing on devices you own or have explicit permission to test (README).

Licence and context

The project is Apache-2.0 licensed (repository). It was created on 2026-10-29 and appeared on HotRepo's NEW-REPOSITORY board for Java that day with 117 total stars; that is a single dated snapshot, not evidence of sustained or daily growth. There is no comparable daily-board history, so no trend conclusion is drawn.