How to remotely crash a Handspring Treo

Synopsis: send ten email messages to the Treo's email address all at once. The Treo will crash with a fatal error, and be unable to make or receive phone calls or SMSes until you perform a soft reset and re-activate wireless mode.

Reproducing the crash

I have a Handspring Treo with Voicestream service and the Talk & Text plan (200 weekday minutes and 500 SMS messages per month). I use SMS frequently to gateway instant messages to and from my Treo so that I can stay in touch with my friends online, and I sometimes forward my regular email to it as well. However, there is very weak cell coverage in the building where I work, so my Treo is effectively out of coverage during the day until I leave the building at night.

What that means is that all the SMS messages which should have been delivered over the course of the day get queued up and delivered en masse when I leave work at night and my Treo picks up a signal again.

Invariably, when I have more than about six messages in the queue to be delivered, the Treo starts making the "incoming SMS" ring tone, and freezes up. No buttons I push have any effect while it's receiving those SMS messages from the network. After about four rings, the Treo will display a fatal error dialog box, with this message:

Event.c, line 191: Event queue full

(Reset)

I press the button to reset the Treo, wait for it to reboot, turn wireless mode back on, and wait for the next set of SMS messages to be delivered ... triggering the entire crash-reset-reboot cycle again, until finally all the messages are delivered.

Commentary

Needless to say, this is annoying. Once the Treo displays the fatal error dialog, it is unable to receive incoming phone calls until the unit is reset, a process that takes several minutes and manual intervention to press buttons and re-acquire a wireless signal.

This bug also enables a remote denial-of-service attack against Handspring Treos. A malicious attacker can simply send multiple emails to the Treo's email address (which is a function of its phone number) in order to cause the Treo's owner to lose phone, SMS, and PDA functionality until the unit is manually reset. The more messages that are sent, the more crash-reset cycles must be performed, taking the unit out of service for an indefinite amount of time. As far as I can tell there is no way to prevent messages sent to the Treo's email address from being delivered to the phone.

If you want to try this at home

Note that I am not responsible for any charges you incur from the use of your SMS service. Beware that some plans charge per SMS received, per SMS sent, or both. I am also not responsible for the improper use of this service. If you do not have permission to send SMS email to a Treo unit, stop reading now.

To see if your Treo has this bug, I've set up an email replybot. From your Treo, use the SMS application to send a blank SMS to the email address "sms @ crashme.com". The bot will immediately reply with 8 emails to the sending address. You can send a number on the first line of your message to control how many messages are sent to you; it will max out at 20.

Alternatively, you can simply use your regular email account to send multiple emails to your Treo.

In my tests, I can consistently reproduce the crash with 10 emails, but receive 3 with no problem. However, if Voicestream's network is being particularly slow, the messages are sometimes spaced out so that they arrive in ones or twos. The messages must be delivered simultaneously in order to trigger the crash. A sure way to cause the crash is to turn off wireless mode while the messages are sent, so that they get queued up for delivery to the Treo, and then re-enable wireless mode.

If you try this experiment, please tell me whether you can reproduce the crash, and send me your Treo PalmOS version, which carrier you use (VoiceStream, Cingular, other), and the area of the country where you live.


Last modified: 5 July 2002
Tessa Lau | tlau-treocrash at ofb.net