Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

exquisitetweets.com

Post reply on HN
Print view View original

51–60 of 186 posts

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#51

Post by quesera »

thursley wrote: post #39
gulbrandr wrote: post #38

Earlier quoted context omitted.

Can you explain this please?

This was/is an infamous modem vulnerability: http://www.securityspace.com/smysecure/catid.html?id=10020 It could force a modem to hangup and redial a number.

Not a vulnerability, really. And the redial was a separate process, possibly automatic. (Edit: OK, yes it is. It's more a protocol vulnerability and a data handling weakness -- the modems just implemented the protocol, but that's just semantics.. )

+++ is the Hayes command set string to enter command mode. AT is the prefix for commands, and H0 means "set switchhook to zero", i.e. "hang up". (H1 means "go off hook", DT means dial using touch tones, DP means dial, using pulses, etc).

The first two components (+++ and AT) are configurable, but no one ever changed them.

This is really just a weakness of in-band signaling. For this to work, you need a human on the modem side to type the escape and command strings -- or a program on the modem side that takes unfiltered data from the network and sends it back out without escaping.

That's the vulnerability. Accepting data from untrusted sources will always take you somewhere bad, and there are much worse things you can do to modems than make them hang up. If IRC clients would parrot tainted data back up the serial line, great havoc could be caused.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#52

Post by GFischer »

mibbitier wrote: post #12
prof_hobart wrote: post #10

Earlier quoted context omitted.

My 6 year old daughter is absolutely fascinated by QR codes. I've been nagged into scanning ones on posters, in magazines, and even one that showed up in the middle of a TV show...

You can pick up barcode battlers on ebay for cheap. Although they're probably antiques now.

First thought: this might be a neat Android game Second thought: this has already been implemented

And..

https://play.google.com/store/apps/details?id=com.fawepark.a...

(by the way, this displays in an awful Spanish for me, because of my default language)

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#53

Post by quesera »

rachelbythebay wrote: post #50
quesera wrote: post #47

Earlier quoted context omitted.

IRC pings don't use ICMP, but that could work if IRC clients would repeat data received without escaping first. Or if unaware users saw it come over the channel and tried to type it themselves.

Considering a CTCP request is just a PRIVMSG with ^A wrapped around the "command word", and a CTCP reply is just a NOTICE with the same ^A thing, you can make them "say" just about anything. It's unclear why an IRC client would need to worry about "escaping" +++, except if it's specifically been designed for people with bad modems. Those of us with good modems back in the dialup days just laughed at this insanity. Ha…

Sorry, I should have been more clear. The modem could also guard the sequence by requiring interstitial pauses, but I believe this was patented by Hayes in the 80s.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#57

Post by lwhi »

level09 wrote: post #44

I deployed this code on this page : http://flasharabia.com however the code doesn't seem to work ..

If you want to check the functionality - it would be far more responsible to use a non-destructive USSD code.

e.g. *#06# displays the phone's IMEI number

Post reply on HN