CVE-2014-8610
Android < 5.0.0 - Unauthenticated SMS Transmission via Broadcast Intent
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-8610. PoCs published by eddieoz.
AI-analyzed exploit summary This repository contains an educational proof-of-concept for the Dual_EC_DRBG backdoor (CVE-2014-8610), demonstrating how the NSA allegedly backdoored a NIST standard. It includes a Jupyter notebook and scripts to simulate the attack, showing state recovery from observed output.
Description
AndroidManifest.xml in Android before 5.0.0 does not require the SEND_SMS permission for the SmsReceiver receiver, which allows attackers to send stored SMS messages, and consequently transmit arbitrary new draft SMS messages or trigger additional per-message charges from a network operator for old messages, via a crafted application that broadcasts an intent with the com.android.mms.transaction.MESSAGE_SENT action, aka Bug 17671795.
Exploits (1)
This repository contains an educational proof-of-concept for the Dual_EC_DRBG backdoor (CVE-2014-8610), demonstrating how the NSA allegedly backdoored a NIST standard. It includes a Jupyter notebook and scripts to simulate the attack, showing state recovery from observed output.