Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

exquisitetweets.com

Post reply on HN
Print view View original

101–110 of 186 posts

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#101

Post by jrabone »

cdh wrote: post #33
andrewcooke wrote: post #22

Earlier quoted context omitted.

does that mean premium rate numbers can also be triggered?

I don't have a Galaxy S3 to test this, but my experience with the Galaxy S and Galaxy S2 is that for normal phone numbers, you need to specifically confirm that you want to dial the number. For the code to factory reset the phone, though, simply typing in the code is sufficient, you don't need to press dial. It might be the same here, so that only that specific USSD code can be triggered without a confirmation from t…

Yes, this is how it works. I tested a Galaxy S2 and HTC with Chrome and the stock Browser - both spawn the dialler and pass the code which triggers automatically on the terminating '#'.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#102

Post by [deleted] »

forgotusername wrote: post #28
andrewcooke wrote: post #22

Earlier quoted context omitted.

does that mean premium rate numbers can also be triggered?

The special feature of these "pseudo USSD" codes on Android is that you don't have to press the call button. Simply typing the digits is enough. Note I have no idea if this particular attack actually works.

[deleted]

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#103

Post by corin_ »

potkor wrote: post #72

Works with my HTC Desire if I use the info code, the dialog for showing battery status etc pops up. Raises interesting consumer protection questions, this is a 2010 phone with no updates recently. The law says the dealer has to fix or make up for manufacturing defects that show up years later.

The S3 was released four months ago, not in 2010.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#104

Post by MichaelGG »

mattdeboard wrote: post #34
mibbitier wrote: post #32

Earlier quoted context omitted.

Or you could take a picture of peoples name tags and it could just do OCR... surely?

"just do OCR" It's the future, alright.

Oh yea. If you paste an image into OneNote, it'll auto-OCR things and index them.

If you record audio into OneNote, it'll index the audio, synchronized to any other notes. I've used this on multi-hour meetings, to jump right to places where I think one party said something. Amazing.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#105

Post by jrabone »

JoeCortopassi wrote: post #89
kristofferR wrote: post #88

Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.

Can anyone confirm that this is not only a safe USSD, but that it triggers the exploit? I am not an owner of a S3, but would love to be able to help show some of my non-tech friends whether they are vulnerable to this or not

Works on a stock Galaxy S2 with Samsung ICS, and a random stock HTC (colleague's phone). Triggers IMEI display via dialer from both Chrome and Browser :(

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#106

Post by jrabone »

lwhi wrote: post #79

As far as I can tell, the problem is with the Samsung Dialler application that's part of TouchWiz. If you install a second dialler application via the Play Store, you'll initially be asked which dialler app you want to use before the code is executed - which can prevent execution. There's a strong possibility that other dialler applications aren't affected (i.e. stock / 3rd party).

Also works on my colleague's HTC & Huawei phones - it's not just TouchWiz.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#107

Post by rplnt »

forgotusername wrote: post #28
andrewcooke wrote: post #22

Earlier quoted context omitted.

does that mean premium rate numbers can also be triggered?

The special feature of these "pseudo USSD" codes on Android is that you don't have to press the call button. Simply typing the digits is enough. Note I have no idea if this particular attack actually works.

I don't think it's "android feautre", I've seen this on a few non-smart phones in the past. I don't know which one though as I owned few of them over the years.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#108

Post by Dn_Ab »

mibbitier wrote: post #70
Dn_Ab wrote: post #61

Earlier quoted context omitted.

I would guess the opposite. QR codes are too early. They need to be scannable by a device that doesn't require reaching into your pocket, fumbling with your phone and then trying to get the right angle. Combining a couple projections, I see them going from utterly useless to gimmicky cool for a particular crowd within 2 years.

Ridiculous. Doesn't it seem idiotic to duplicate what we already have? (English characters) in some arcane non human readable, punch-card-esque idiocy? In a few years, all cellphones will be able to read english characters and words. There will be no need for QR punch-cards.

Imagination. moe's got it. If as Brin suggests, Glass is available next year then scanning QR codes is one of the brain dead obvious launch apps for it. QR codes will be less variable and more reliable (under arbitrary conditions) than OCR at that point as well as being able to hold more information per square inch. They will be quickly translatable and displayed as human readable information floating in front of your face - with little to no effort required on your part.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#109

Post by SoftwareMaven »

jlgreco wrote: post #96
Dn_Ab wrote: post #61

Earlier quoted context omitted.

I would guess the opposite. QR codes are too early. They need to be scannable by a device that doesn't require reaching into your pocket, fumbling with your phone and then trying to get the right angle. Combining a couple projections, I see them going from utterly useless to gimmicky cool for a particular crowd within 2 years.

Personally I think they would take off if we had some sort of large plastic dedicated device that plugged into your computer to scan these things. Perhaps shaped like a cat; people like cats.

I still have one in my junk electronics box in the basement. It's what I always think of with QR codes.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#110

Post by jrabone »

tomscott wrote: post #17

Hello. I'm the guy who put this collection together. I've since tried to update it, and to hit 'delete' on it to avoid spreading misinformation, but Exquisite Tweets is still caching the original version. Mea culpa: I didn't do the research before passing it on. There's been a lot of back-and-forth over whether it's true or not (check @pof's timeline for such), and a hell of a lot of people sending it on without doub…

I wrote a trivial webpage (using the show IMEI USSD * #06#), served from my desktop with Lighttpd. It certainly can be executed via a simple web page using a frameset on both Chrome & Browser, and there's no prompt. Works on a Huawei running 2.3, a Galaxy S2 running ICS, and an HTC.
Post reply on HN