Re: Nokia 7110 Wap Browser Hole

[tink () TINK ORG (Tink)]

At 00:15 21-7-00 +0200, Roelof Temmingh wrote:
> On Thu, 20 Jul 2000, Vitaly Osipov wrote:
>
> +So i am very curious on what address you scanned to get the phone hung - it
> +really is very interesting.
>
> I (also?) made the mistake of scanning the WAP gateway (see my post
> on Nokia WAP GW), but I figured my cellphone is not running NetBIOS :))), and
> realised that I was scanning the GW.
>
> Then, I configured the WAP GW on my phone (Siemens S35) to an address that
> points to a server within my network, and did a tcpdump to see what IP number
> is sending requests to "my WAP GW". (UDP port 9201/2).
>
> This IP number corresponds with my cellphone. I pinged it, and it seems as
> though the pings times out when I drop the line. Not sure if this is
> really the
> phone...is it?

Yes, it is. The Nokia has a TCP stack, and answers pings. As I said, we
portscanned it,
and found bootp (UDP) open.... We did not scan the WAP GW. We used nmap
2.53beta with -O option. (nmap did not recognise the OS).

--Ralph