[Android Q&A, Help & Troubleshooting] Deleted member 5013759:
Well... where do I start?

A couple of days ago I read a newspaper article about so called "Stealth Ping" aKa "Silent SMS" aKa "SMS Ping". Never heard? Please see Wikipedia (Cannot link, sorry) or use Google please. (It might be important to say that I am German)

I started collecting information about those kind of sms when I found the App "HushSMS" which can actually send Pings. I have two mobile phones (Nexus S with Codename Android and Air Kernel / Sony Xperia Arc S with 4.0.4) so I used my Arc S to ping my Nexus whilst having Catlog powered up.

Here is a normal SMS (not only radio-dump / *REMOVED* means that I removed a number due to possible privacy issues):

12-16 16:20:17.937 E/RIL(s) ( 133): ************************INCOMING SMS************************
12-16 16:20:17.937 E/RIL(s) ( 133): msg_tpid = 12
12-16 16:20:17.937 E/RIL(s) ( 133): RxSMS_NotiIncomingMsg: Incoming SMS-DELIVER (PDU routed).
12-16 16:20:17.937 E/RIL(s) ( 133): simIndex[0] = ff, simIndex[1] = ff, incoming_noti->sim_index= ffff
12-16 16:20:17.937 E/RIL(s) ( 133): incoming_noti->data_len = 25
12-16 16:20:18.148 W/SMSListener(9674): Got broadcast...
12-16 16:20:18.125 I/am_create_service(295): [1103206920,com.handcent.nextsms/com.handcent.sms.transaction.ca,act=android.provider.Telephony.SMS_RECEIVED,7978]
12-16 16:20:17.937 E/RIL(s) ( 133): SMSC Length = 07
12-16 16:20:18.148 W/SMSListener(9674): Got SMS message...
12-16 16:20:18.148 I/binder_sample(7978): [android.app.IActivityManager,16,21,com.handcent.nextsms,4]
12-16 16:20:17.937 E/RIL(s) ( 133): firstbyte = 24
12-16 16:20:18.214 W/SMSProcessor(9674): Not one of ours
12-16 16:20:17.937 E/RIL(s) ( 133): addrLength = 0d
12-16 16:20:18.218 W/SMSListener(9674): Incoming call details: null
12-16 16:20:17.937 E/RIL(s) ( 133): posPid = 12
12-16 16:20:18.218 W/SMSProcessor(9674): Not a verifier challenge...
12-16 16:20:17.937 E/RIL(s) ( 133): Protocol_Id = 00
12-16 16:20:17.937 E/RIL(s) ( 133): Dcs = 00
12-16 16:20:17.937 E/RIL(s) ( 133): hasMessageClass = 00
12-16 16:20:17.937 E/RIL(s) ( 133): Dcs = 00
12-16 16:20:17.937 E/RIL(s) ( 133): sms_pdu: *REMOVED* , strlen(sms_pdu) = 74
12-16 16:20:17.937 E/RIL(s) ( 133): Message Not Saved in SIM
12-16 16:20:17.937 E/RIL(s) ( 133): RIL_onMultiClientUnsolicitedResponse:
12-16 16:20:17.937 E/RIL(s) ( 133): unsupported multiclient unsolicited response code 1003
12-16 16:20:17.937 E/RIL(s) ( 133): set_wakelock: on 0 id: secril_fmt-interface
12-16 16:20:18.218 E/RIL(s) ( 133): onRequest: SMS_ACKNOWLEDGE
12-16 16:20:18.218 E/RIL(s) ( 133): CreateRequest(): req(0x*REMOVED*), id(37), tok(0x*REMOVED*) - FUNC(0x*REMOVED*)
12-16 16:20:18.218 E/RIL(s) ( 133): [EVT]:Req(1), RX(0)
12-16 16:20:18.218 E/RIL(s) ( 133): requestSMSAcknowledge()
12-16 16:20:18.218 E/RIL(s) ( 133): ackSuccess = 1, failCause = 0
12-16 16:20:18.218 E/RIL(s) ( 133): TxSMS_ExecDeliverReport()
12-16 16:20:18.218 E/RIL(s) ( 133): msg_tpid = 12
12-16 16:20:18.218 E/RIL(s) ( 133): get_msg_sequence()
12-16 16:20:18.218 E/RIL(s) ( 133): IPC_send_singleIPC ipc hdr len =12
12-16 16:20:18.218 E/RIL(s) ( 133): TX: Time: 2756519982 / 88989393
12-16 16:20:18.218 E/RIL(s) ( 133): TX: (M)IPC_SMS_CMD (S)IPC_SMS_DELIVER_REPORT (T)IPC_CMD_EXEC (len:0x0C mseq:0xF1 aseq:0x00) [ 02 00 00 0C 00 ]
12-16 16:20:18.218 E/RIL(s) ( 133): WaitForExpectedCmd(): cur_time: 88989393, cur_req->timeout: 89039393, ph->near_timeout: 89039393
12-16 16:20:18.218 E/RIL(s) ( 133): One dram crespo ReaderLoop
12-16 16:20:18.218 E/RIL(s) ( 133): set_wakelock: on 1 id: secril_fmt-interface
12-16 16:20:18.218 E/RIL(s) ( 133): ReaderLoop buf->size=12 id=0 cmd=0
12-16 16:20:18.218 E/RIL(s) ( 133): processIPC: size 12
12-16 16:20:18.218 E/RIL(s) ( 133): ro.secure = 0

And here is a ping (HushSMS Recommended):

12-16 07:42:48.789 E/RIL(s) ( 133): ************************INCOMING SMS************************
12-16 07:42:48.789 E/RIL(s) ( 133): msg_tpid = 5
12-16 07:42:48.789 E/RIL(s) ( 133): RxSMS_NotiIncomingMsg: Incoming SMS-DELIVER (PDU routed).
12-16 07:42:48.789 E/RIL(s) ( 133): simIndex[0] = ff, simIndex[1] = ff, incoming_noti->sim_index= ffff
12-16 07:42:48.789 E/RIL(s) ( 133): incoming_noti->data_len = 39
12-16 07:42:48.789 E/RIL(s) ( 133): SMSC Length = 07
12-16 07:42:48.789 E/RIL(s) ( 133): firstbyte = 64
12-16 07:42:48.789 E/RIL(s) ( 133): addrLength = 0d
12-16 07:42:48.789 E/RIL(s) ( 133): posPid = 12
12-16 07:42:48.789 E/RIL(s) ( 133): Protocol_Id = 00
12-16 07:42:48.789 E/RIL(s) ( 133): Dcs = 04
12-16 07:42:48.789 E/RIL(s) ( 133): hasMessageClass = 00
12-16 07:42:48.789 E/RIL(s) ( 133): Dcs = 04
12-16 07:42:48.789 E/RIL(s) ( 133): hasUserDataHeader is present
12-16 07:42:48.789 E/RIL(s) ( 133): sms_pdu: *REMOVED* , strlen(sms_pdu) = 114
12-16 07:42:48.789 E/RIL(s) ( 133): Message Not Saved in SIM
12-16 07:42:48.793 E/RIL(s) ( 133): RIL_onMultiClientUnsolicitedResponse:
12-16 07:42:48.793 E/RIL(s) ( 133): unsupported multiclient unsolicited response code 1003
12-16 07:42:48.793 E/RIL(s) ( 133): set_wakelock: on 0 id: secril_fmt-interface
12-16 07:42:48.808 W/GSM (659): 1 - Unsupported SMS data coding scheme 4
12-16 07:42:48.855 E/RIL(s) ( 133): onRequest: SMS_ACKNOWLEDGE
12-16 07:42:48.855 E/RIL(s) ( 133): CreateRequest(): req(0x*REMOVED*), id(37), tok(0x*REMOVED*) - FUNC(0x*REMOVED*)
12-16 07:42:48.855 E/RIL(s) ( 133): [EVT]:Req(1), RX(0)
12-16 07:42:48.855 E/RIL(s) ( 133): requestSMSAcknowledge()
12-16 07:42:48.855 E/RIL(s) ( 133): ackSuccess = 1, failCause = 0
12-16 07:42:48.855 E/RIL(s) ( 133): TxSMS_ExecDeliverReport()
12-16 07:42:48.855 E/RIL(s) ( 133): msg_tpid = 5
12-16 07:42:48.855 E/RIL(s) ( 133): get_msg_sequence()
12-16 07:42:48.855 E/RIL(s) ( 133): IPC_send_singleIPC ipc hdr len =12
12-16 07:42:48.855 E/RIL(s) ( 133): TX: Time: 2725470619 / 57940030
12-16 07:42:48.859 E/RIL(s) ( 133): TX: (M)IPC_SMS_CMD (S)IPC_SMS_DELIVER_REPORT (T)IPC_CMD_EXEC (len:0x0C mseq:0xA9 aseq:0x00) [ 02 00 00 05 00 ]
12-16 07:42:48.859 E/RIL(s) ( 133): WaitForExpectedCmd(): cur_time: 57940030, cur_req->timeout: 57990030, ph->near_timeout: 57990030
12-16 07:42:48.859 E/RIL(s) ( 133): One dram crespo ReaderLoop
12-16 07:42:48.859 E/RIL(s) ( 133): set_wakelock: on 1 id: secril_fmt-interface
12-16 07:42:48.859 E/RIL(s) ( 133): ReaderLoop buf->size=12 id=0 cmd=0
12-16 07:42:48.859 E/RIL(s) ( 133): processIPC: size 12
12-16 07:42:48.859 E/RIL(s) ( 133): ro.secure = 0

and another one (Empty MMSN):

12-17 17:15:15.175 E/RIL(s) (16188): ************************INCOMING SMS************************
12-17 17:15:15.175 E/RIL(s) (16188): msg_tpid = 20
12-17 17:15:15.175 E/RIL(s) (16188): RxSMS_NotiIncomingMsg: Incoming SMS-DELIVER (PDU routed).
12-17 17:15:15.175 E/RIL(s) (16188): simIndex[0] = ff, simIndex[1] = ff, incoming_noti->sim_index= ffff
12-17 17:15:15.175 E/RIL(s) (16188): incoming_noti->data_len = 24
12-17 17:15:15.175 E/RIL(s) (16188): SMSC Length = 07
12-17 17:15:15.175 E/RIL(s) (16188): firstbyte = 60
12-17 17:15:15.175 E/RIL(s) (16188): addrLength = 0d
12-17 17:15:15.175 E/RIL(s) (16188): posPid = 12
12-17 17:15:15.175 E/RIL(s) (16188): Protocol_Id = 00
12-17 17:15:15.175 E/RIL(s) (16188): Dcs = 04
12-17 17:15:15.175 E/RIL(s) (16188): hasMessageClass = 00
12-17 17:15:15.175 E/RIL(s) (16188): Dcs = 04
12-17 17:15:15.175 E/RIL(s) (16188): hasUserDataHeader is present
12-17 17:15:15.179 E/RIL(s) (16188): sms_pdu: *REMOVED* , strlen(sms_pdu) = 72
12-17 17:15:15.179 E/RIL(s) (16188): Message Not Saved in SIM
12-17 17:15:15.183 E/RIL(s) (16188): RIL_onMultiClientUnsolicitedResponse:
12-17 17:15:15.183 E/RIL(s) (16188): unsupported multiclient unsolicited response code 1003
12-17 17:15:15.183 E/RIL(s) (16188): set_wakelock: on 0 id: secril_fmt-interface
12-17 17:15:15.195 W/GSM (659): 1 - Unsupported SMS data coding scheme 4
12-17 17:15:15.214 E/SMS (659): Exception dispatching message
12-17 17:15:15.214 E/SMS (659): java.lang.ArrayIndexOutOfBoundsException: length=1; index=1
12-17 17:15:15.214 E/SMS (659):	at com.android.internal.telephony.WapPushOverSms.dispatchWapPdu(WapPushOverSms.java:141)
12-17 17:15:15.214 E/SMS (659):	at com.android.internal.telephony.SMSDispatcher.dispatchNormalMessage(SMSDispatcher.java:498)
12-17 17:15:15.214 E/SMS (659):	at com.android.internal.telephony.gsm.GsmSMSDispatcher.dispatchMessage(GsmSMSDispatcher.java:234)
12-17 17:15:15.214 E/SMS (659):	at com.android.internal.telephony.SMSDispatcher.handleMessage(SMSDispatcher.java:264)
12-17 17:15:15.214 E/SMS (659):	at com.android.internal.telephony.gsm.GsmSMSDispatcher.handleMessage(GsmSMSDispatcher.java:117)
12-17 17:15:15.214 E/SMS (659):	at android.os.Handler.dispatchMessage(Handler.java:99)
12-17 17:15:15.214 E/SMS (659):	at android.os.Looper.loop(Looper.java:137)
12-17 17:15:15.214 E/SMS (659):	at android.app.ActivityThread.main(ActivityThread.java:4896)
12-17 17:15:15.214 E/SMS (659):	at java.lang.reflect.Method.invokeNative(Native Method)
12-17 17:15:15.214 E/SMS (659):	at java.lang.reflect.Method.invoke(Method.java:511)
12-17 17:15:15.214 E/SMS (659):	at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:791)
12-17 17:15:15.214 E/SMS (659):	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:558)
12-17 17:15:15.214 E/SMS (659):	at dalvik.system.NativeStart.main(Native Method)
12-17 17:15:15.226 E/RIL(s) (16188): onRequest: SMS_ACKNOWLEDGE
12-17 17:15:15.226 E/RIL(s) (16188): CreateRequest(): req(0x*REMOVED*), id(37), tok(0x*REMOVED*) - FUNC(0x*REMOVED*)
12-17 17:15:15.226 E/RIL(s) (16188): [EVT]:Req(1), RX(0)
12-17 17:15:15.226 E/RIL(s) (16188): requestSMSAcknowledge()
12-17 17:15:15.226 E/RIL(s) (16188): ackSuccess = 0, failCause = ff
12-17 17:15:15.226 E/RIL(s) (16188): TxSMS_ExecDeliverReport()
12-17 17:15:15.226 E/RIL(s) (16188): Unspecified Error!!!
12-17 17:15:15.226 E/RIL(s) (16188): msg_tpid = 20
12-17 17:15:15.226 E/RIL(s) (16188): get_msg_sequence()
12-17 17:15:15.226 E/RIL(s) (16188): IPC_send_singleIPC ipc hdr len =12
12-17 17:15:15.226 E/RIL(s) (16188): TX: Time: 2846216989 / 178686400
12-17 17:15:15.226 E/RIL(s) (16188): TX: (M)IPC_SMS_CMD (S)IPC_SMS_DELIVER_REPORT (T)IPC_CMD_EXEC (len:0x0C mseq:0x99 aseq:0x00) [ 02 6F 80 14 00 ]
12-17 17:15:15.226 E/RIL(s) (16188): WaitForExpectedCmd(): cur_time: 178686400, cur_req->timeout: 178736400, ph->near_timeout: 178736400
12-17 17:15:15.226 E/RIL(s) (16188): One dram crespo ReaderLoop
12-17 17:15:15.226 E/RIL(s) (16188): set_wakelock: on 1 id: secril_fmt-interface
12-17 17:15:15.226 E/RIL(s) (16188): ReaderLoop buf->size=12 id=0 cmd=0
12-17 17:15:15.226 E/RIL(s) (16188): processIPC: size 12
12-17 17:15:15.226 E/RIL(s) (16188): ro.secure = 0

As you can see a ping causes the warning "W/GSM (659): 1 - Unsupported SMS data coding scheme 4".

So I opened up tasker and created a "ping monitor" which basically saves a dump of the radio debug buffer to the sdcard and searches it for "Unsupported SMS data coding".

I wanted to keep the app runing until noon next day and then trigger a ping with my Arc S. but at 3:26AM suddenly a notification popped up.

I was pretty shocked and examined the saved logfile. Here's the excerpt:

12-18 03:25:52.058 E/RIL(s) ( 133): ************************INCOMING SMS************************
12-18 03:25:52.058 E/RIL(s) ( 133): msg_tpid = 4
12-18 03:25:52.058 E/RIL(s) ( 133): RxSMS_NotiIncomingMsg: Incoming SMS-DELIVER (PDU routed).
12-18 03:25:52.058 E/RIL(s) ( 133): simIndex[0] = ff, simIndex[1] = ff, incoming_noti->sim_index= ffff
12-18 03:25:52.058 E/RIL(s) ( 133): incoming_noti->data_len = 24
12-18 03:25:52.058 E/RIL(s) ( 133): SMSC Length = 07
12-18 03:25:52.058 E/RIL(s) ( 133): firstbyte = 60
12-18 03:25:52.058 E/RIL(s) ( 133): addrLength = 0d
12-18 03:25:52.058 E/RIL(s) ( 133): posPid = 12
12-18 03:25:52.058 E/RIL(s) ( 133): Protocol_Id = 00
12-18 03:25:52.058 E/RIL(s) ( 133): Dcs = 04
12-18 03:25:52.058 E/RIL(s) ( 133): hasMessageClass = 00
12-18 03:25:52.058 E/RIL(s) ( 133): Dcs = 04
12-18 03:25:52.058 E/RIL(s) ( 133): hasUserDataHeader is present
12-18 03:25:52.058 E/RIL(s) ( 133): sms_pdu: *REMOVED* , strlen(sms_pdu) = 72
12-18 03:25:52.058 E/RIL(s) ( 133): Message Not Saved in SIM
12-18 03:25:52.058 E/RIL(s) ( 133): RIL_onMultiClientUnsolicitedResponse:
12-18 03:25:52.058 E/RIL(s) ( 133): unsupported multiclient unsolicited response code 1003
12-18 03:25:52.058 E/RIL(s) ( 133): set_wakelock: on 0 id: secril_fmt-interface
12-18 03:25:52.062 D/RILJ ( 646): [UNSL]< UNSOL_RESPONSE_NEW_SMS
12-18 03:25:52.101 W/GSM ( 646): 1 - Unsupported SMS data coding scheme 4
12-18 03:25:52.101 E/SMS ( 646): Exception dispatching message
12-18 03:25:52.101 E/SMS ( 646): java.lang.ArrayIndexOutOfBoundsException: length=1; index=1
12-18 03:25:52.101 E/SMS ( 646):	at com.android.internal.telephony.WapPushOverSms.dispatchWapPdu(WapPushOverSms.java:141)
12-18 03:25:52.101 E/SMS ( 646):	at com.android.internal.telephony.SMSDispatcher.dispatchNormalMessage(SMSDispatcher.java:498)
12-18 03:25:52.101 E/SMS ( 646):	at com.android.internal.telephony.gsm.GsmSMSDispatcher.dispatchMessage(GsmSMSDispatcher.java:234)
12-18 03:25:52.101 E/SMS ( 646):	at com.android.internal.telephony.SMSDispatcher.handleMessage(SMSDispatcher.java:264)
12-18 03:25:52.101 E/SMS ( 646):	at com.android.internal.telephony.gsm.GsmSMSDispatcher.handleMessage(GsmSMSDispatcher.java:117)
12-18 03:25:52.101 E/SMS ( 646):	at android.os.Handler.dispatchMessage(Handler.java:99)
12-18 03:25:52.101 E/SMS ( 646):	at android.os.Looper.loop(Looper.java:137)
12-18 03:25:52.101 E/SMS ( 646):	at android.app.ActivityThread.main(ActivityThread.java:4896)
12-18 03:25:52.101 E/SMS ( 646):	at java.lang.reflect.Method.invokeNative(Native Method)
12-18 03:25:52.101 E/SMS ( 646):	at java.lang.reflect.Method.invoke(Method.java:511)
12-18 03:25:52.101 E/SMS ( 646):	at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:791)
12-18 03:25:52.101 E/SMS ( 646):	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:558)
12-18 03:25:52.101 E/SMS ( 646):	at dalvik.system.NativeStart.main(Native Method)
12-18 03:25:52.105 D/RILJ ( 646): [0248]> SMS_ACKNOWLEDGE false 255
12-18 03:25:52.105 E/RIL(s) ( 133): onRequest: SMS_ACKNOWLEDGE
12-18 03:25:52.105 E/RIL(s) ( 133): CreateRequest(): req(0x*REMOVED*), id(37), tok(0x*REMOVED*) - FUNC(0x*REMOVED*)
12-18 03:25:52.105 E/RIL(s) ( 133): [EVT]:Req(1), RX(0)
12-18 03:25:52.105 E/RIL(s) ( 133): requestSMSAcknowledge()
12-18 03:25:52.105 E/RIL(s) ( 133): ackSuccess = 0, failCause = ff
12-18 03:25:52.105 E/RIL(s) ( 133): TxSMS_ExecDeliverReport()
12-18 03:25:52.105 E/RIL(s) ( 133): Unspecified Error!!!
12-18 03:25:52.105 E/RIL(s) ( 133): msg_tpid = 4
12-18 03:25:52.105 E/RIL(s) ( 133): get_msg_sequence()
12-18 03:25:52.105 E/RIL(s) ( 133): IPC_send_singleIPC ipc hdr len =12
12-18 03:25:52.105 E/RIL(s) ( 133): TX: Time: 2882853868 / 10733286
12-18 03:25:52.105 E/RIL(s) ( 133): TX: (M)IPC_SMS_CMD (S)IPC_SMS_DELIVER_REPORT (T)IPC_CMD_EXEC (len:0x0C mseq:0x09 aseq:0x00) [ 02 6F 80 04 00 ]
12-18 03:25:52.105 E/RIL(s) ( 133): WaitForExpectedCmd(): cur_time: 10733286, cur_req->timeout: 10783286, ph->near_timeout: 10783286
12-18 03:25:52.105 E/RIL(s) ( 133): One dram crespo ReaderLoop
12-18 03:25:52.105 E/RIL(s) ( 133): set_wakelock: on 1 id: secril_fmt-interface
12-18 03:25:52.105 E/RIL(s) ( 133): ReaderLoop buf->size=12 id=0 cmd=0
12-18 03:25:52.105 E/RIL(s) ( 133): processIPC: size 12
12-18 03:25:52.105 E/RIL(s) ( 133): ro.secure = 0

This looks pretty much like a ping but I did not send a ping at this time. And I also didn't receive a SMS. WTF? Funny thing - the same happened today at 9:25AM. Am I being pinged by my authorities? Or do you know what could cause a log like this? Can I contact my provider and ask who sent me a SMS at this time?