USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page • Hacker News Board

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#141

Post by tedunangst » Tue, Sep 25, 2012, 5:39 PM UTC

superuser2 wrote: post #114

tedunangst wrote: post #87

Earlier quoted context omitted.

Maybe they got the idea from Google Code, which helpfully shows me a QR code for the tarball I'm about to download, for all those times I'm using the browser on my desktop and the IDE on my phone.

It's a QR code of the tarball's hash, so you can do an easy (albeit less secure) visual verification instead of comparing two text strings.

uh what? So I download the file, hash it, then pipe that into some program that's going to show me another QR code? And then eyeball that for differences? Who does that? I already have programs to compare two text strings, easily, accurately, remotely. Comparing two pngs is way more work. I was just assuming the QR code was the URL, but hash QRs make even less sense than my IDE on the phone scenario.

Actually, looking at the URL of the QR code image itself, it is for the download URL.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#142

Post by ColinDabritz » Tue, Sep 25, 2012, 5:55 PM UTC

aw3c2 wrote: post #4

If I was really bored and feeling malicious, printing QR codes to point to this "exploit" and then pasting them over QR codes on random advertisements in the streets seems like a terrible idea.

This is pretty darn dangerous already, but I would note you may not need a website at all for this. From my understanding, the problem is in the stock dialer, and it automatically executes when the number is entered. I will quietly note here that, as part of the standard, QR codes can embed phone numbers. I do not have a samsung phone to test this with. Anyone?

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#143

Post by bduerst » Tue, Sep 25, 2012, 6:11 PM UTC

klausa wrote: post #16

asmithmd1 wrote: post #6

Earlier quoted context omitted.

It wouldn't affect anyone because no one has ever scanned a QR code in an ad

http://picturesofpeoplescanningqrcodes.tumblr.com/

I chuckle every time I see this.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#144

Post by jacobr » Tue, Sep 25, 2012, 6:11 PM UTC

kristofferR wrote: post #88

Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.

Opera mobile asks for confirmation before loading the frame.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#145

Post by MiguelHudnandez » Tue, Sep 25, 2012, 6:12 PM UTC

JoeCortopassi wrote: post #133

makmanalp wrote: post #125

Earlier quoted context omitted.

Or you could have a script that, when notices the user agent to not be mobile, shows the IMEI version, but otherwise shows the reset version :P

Except there is no javascript on that page. They could do the same thing server side though

There is no reason to assume that "script" means javascript or client-side script.

(Perhaps the comment was edited after you suggested the correction)

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#146

Post by deniska » Tue, Sep 25, 2012, 6:14 PM UTC

kristofferR wrote: post #88

Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.

I opened it in my desktop firefox and it showed «Sent to phone» notify of firefox2phone plugin which uses chrome2phone protocol.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#147

Post by GICodeWarrior » Tue, Sep 25, 2012, 7:13 PM UTC

I created an Android app to intercept these requests and prevent them. https://dl.dropbox.com/s/28lk6rn09x84qqg/AutoResetBlocker.ap...

Please test it and make sure it works for you.

  1. Open the above link on your phone
  2. Install the application (it requires no special permissions)
  3. Try this IMEI test: http://jsfiddle.net/kKFn8/
  4. Check the box to make "Auto-Reset Blocker" the default action
  5. Auto-Reset Blocker will show you the malicious number
  6. Open this safe telephone number test: http://jsfiddle.net/tLHpw/
  7. Auto-Reset Blocker will show the safe number and you will be asked which dialer to use
  8. Select your normal dialer
  9. Your normal dialer will open with the safe number

Again, please give it a try. If people like it, I will see about setting up an Android Market account to distribute it.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#148

Post by TazeTSchnitzel » Tue, Sep 25, 2012, 7:27 PM UTC

ColinDabritz wrote: post #142

aw3c2 wrote: post #4

If I was really bored and feeling malicious, printing QR codes to point to this "exploit" and then pasting them over QR codes on random advertisements in the streets seems like a terrible idea.

This is pretty darn dangerous already, but I would note you may not need a website at all for this. From my understanding, the problem is in the stock dialer, and it automatically executes when the number is entered. I will quietly note here that, as part of the standard, QR codes can embed phone numbers. I do not have a samsung phone to test this with. Anyone?

Used a QR code scanner on http://qr.kaywa.com/?s=8&d=tel%3A%2A%252306%2523 (QR Code of tel:*%2306%23) - was picked up as a telephone number QR code by some barcode scanning app I have. Clicked dial number. Showed IMEI.

Yeah, this would probably work.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#149

Post by TazeTSchnitzel » Tue, Sep 25, 2012, 7:27 PM UTC

kristofferR wrote: post #88

Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.

Works fine on older Samsung Galaxy Y Pro, the budget touch-screen/keyboard (i.e. BlackBerry form-factor with touch) phone.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#150

Post by TazeTSchnitzel » Tue, Sep 25, 2012, 7:32 PM UTC

GICodeWarrior wrote: post #147

I created an Android app to intercept these requests and prevent them. https://dl.dropbox.com/s/28lk6rn09x84qqg/AutoResetBlocker.ap... Please test it and make sure it works for you. 1. Open the above link on your phone 2. Install the application (it requires no special permissions) 3. Try this IMEI test: http://jsfiddle.net/kKFn8/ 4. Check the box to make "Auto-Reset Blocker" the default action 5. Auto-Reset Blocker…

Works great. However, the immediate select app popup if it's "safe" means that the "This phone number appears safe" text is shadowed on my phone. Perhaps add a "dial" button?

Still, please set up a Market account, this would be great!