Windows Phone 7 SMS Vulnerability Being Addressed by Microsoft [WP7 SMS Bug Fix Being Tested; Microsoft Says Security Problem Also Exists in Desktop Software Like Windows Live Messenger & Windows Live Mail]

Posted on TFTS by J. Angelo Racoma on Thursday, 29. December 2011 under: Mobile/Cell Phones, xFeatured

Microsoft’s Windows Phone 7 was earlier found to have an unpatched vulnerability in its SMS messaging and contacts system, which causes the phone to freeze and the user to be locked out from the messaging hub. Microsoft is now addressing these, and will soon release a fix.

Microsoft has reportedly identified the root cause of the SMS bug plaguing all Windows Phone 7 smartphones so far. Reported just this December, the messaging-based vulnerability will cause affected phones to automatically shut down. Meanwhile, the phone’s messaging hub will also lock the user out, with the only recourse being a full mobile phone restore.

In short, just a single SMS can wreak havoc in a WP7 smartphone. The vulnerability also exists in other services, such as Facebook, particularly when a user has pinned a friend as a live tile on the home screen.

Khaled Salameh, who was among the first to report the vulnerability to Microsoft, says the company’s security team contacted him to say the WP7 SMS bug has been confirmed, with the root cause being found out. The company is already testing the fix.

Microsoft also reports that a similar bug exists in desktop applications, particularly Windows Live Messenger, Windows Live Mail, Silverlight-based applications, Visual Studio 2010, Expressions Blend and Windows Presentation Foundation-based applications. With the bug, A single malicious user can theoretically block out everyone from his or her address book from logging in to Windows services. The message recipients’ desktop clients will crash upon login.

Microsoft’s senior product manager for Windows Phone, Greg Sullivan, has confirmed that the company is working with partners to fix the vulnerability. “We are working on an update to address the issue and will work with our partners to coordinate its release,” Sullivan says, although no definite timeline has been detailed.