AOH :: HP Unsorted C :: B06-1283.HTM

Cantv/movilnet's web sms vulnerability.
Cantv/Movilnet's Web SMS vulnerability.
Cantv/Movilnet's Web SMS vulnerability.

Quick Summary:

Product : Movilnet's Web SMS.
Version : In-production versions.
Vendor : Movilnet - 
Class : Remote
Criticality : High
Operating System(s) : N/A.


 From Cantv's corporative webpage:
"Cantv es la compania privada m=E1s grande de Venezuela. Desde su 
en 1991, la compania ha experimentado una constante transformacion para
convertirse en una empresa competitiva, con altos niveles de calidad en la
oferta de sus productos y servicios de transmision de voz, datos, acceso a
internet, telefonia celular y directorios de informacion."

Movilnet is an affiliate of Cantv, the largest private telecomunications
company in Venezuela.

Movilnet's Web SMS is a very popular Short Messages System that allows web
surfers to send short text messages directly to Movilnet's mobile phone


The very popular Movilnet's Web SMS protects its mobile customers from SMS
bombs, and undesirable spam using the mechanism pioneered by Blum's AI 
at Carnegie Mellon University that tries to tell humans and computers apart
by using programs known as captchas. Unfortunately, Movilnet's captcha
implementation is a very weak one and it is possible to recognize its 
100% of the time. Others have previously reported breaking "scode" based 
however no proof of concept source code has ever been released to the 

Vendor Status

SNSecurity has contacted Movilnet, who already knew about the problem
and is currently dealing with the issue.

2/21/2006 Vendor is contacted about the vulnerability.
2/23/2006 Vendor informs the vulnerability was already known and asks
      for a 30 day period before publication.
3/17/2006 Vendor agrees to make the advisory public at the date agreed
3/27/2006 Advisory is made public.

Basic Explanation

There are several problems with the "scode" based captcha used by Movilnet
on their Web Short Message System. Most notoriously, the captcha's 
space is very reduced. Estimates performed by our research labs indicate 
only 16 Mb of memory would be required to store pre-calculated data that 
allow for a complete image to response map.

Additionally, several other design flaws present on Movilnet's captcha
implementation allow for the creation of heuristic algorithms that would 
require data pre-calculation at all. Most important weaknesses include: only
one font, no color variation, useless perturbation, no rotation and no

Proof Of Concept Status

No proof of Concept will be released until the provider has sorted out the

Work Around

No work around is possible to prevent abusers to spam or sms-bomb mobile
customers. If you are sms-bombed you can only turn off your mobile phone
and ask a Movilnet representative to have your entire short text message
queue deleted.

Corrective Measures

Replace the captcha module for a stronger and more robust implementation.


This vulnerability was discovered by Ruben Recabarren and Leandro Leoncini
at SNSecurity's Research Lab.

This advisory was released by SNSecurity as a matter of notification to
help administrators protect their systems and to warn mobile customers
against the described vulnerability. Exploit source code is never released
in our advisories but can be obtained under contract. Contact our sales
department at info (at) snsecurity (dot) com for further information on how
to obtain proof of concept code.


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to