Using Short Message Service (SMS) to deploy Android exploits

Short Message Service (SMS) provided by the mobile communication system is a widely used service, almost all the mobile terminals support the short message protocol. In this paper, we illustrate how to exploit the SMS as an attack vector to deploy malware on Android system. Through protocol manipulation, we select the message of type Replace Short Message Type (RS MT) as the attack vector and then we use the Software Defined Radio (SDR) to send this kind of message to the target device with a low cost. Meanwhile, due to some features of the Android security model, we have shown that injection on Android system is undetected by antivirus software. Furthermore, we implemented attacks on different smartphones using SMS to confirm the effectiveness of the approach.