Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

exquisitetweets.com

Post reply on HN
Print view View original

151–160 of 186 posts

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#151

Post by c0nsumer »

asmithmd1 wrote: post #6
aw3c2 wrote: post #4

If I was really bored and feeling malicious, printing QR codes to point to this "exploit" and then pasting them over QR codes on random advertisements in the streets seems like a terrible idea.

It wouldn't affect anyone because no one has ever scanned a QR code in an ad

I do mountain bike (and thus indirectly hiking) trail development, construction, and maintenance as volunteer work. This has shown me a surprisingly useful place for QR codes: on trailhead map boards. The code just links to a (well optimized) PDF of the map itself, along with some text that says "Scan this with your phone to download a copy of the map.".

It amazes me how many people I see scanning the QR code to get a copy of the map before they head out on the trails.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#152

Post by adambard »

kristofferR wrote: post #88

Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.

Displayed my IMEI on an HTC Legend circa 2010, with Cyanogen 7.1, just to add to the data.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#153

Post by gwillen »

enjo wrote: post #131
kristofferR wrote: post #88

Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.

Doesn't work on my Galaxy Nexus, stock 4.1...

Hm, _does_ work on my GN, stock 4.0.4.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#154

Post by molmalo »

GICodeWarrior wrote: post #147

I created an Android app to intercept these requests and prevent them. https://dl.dropbox.com/s/28lk6rn09x84qqg/AutoResetBlocker.ap... Please test it and make sure it works for you. 1. Open the above link on your phone 2. Install the application (it requires no special permissions) 3. Try this IMEI test: http://jsfiddle.net/kKFn8/ 4. Check the box to make "Auto-Reset Blocker" the default action 5. Auto-Reset Blocker…

I tested it with my S2 and it works, but I had to put the files in a local web server because for some reason, the malicious code didn't work from jsfiddle.net

So I did the following:

  1- I tested the link provided by kristofferR (http://kristofferr.com/samsung.html).
  2- Made 2 local copies
  3- Edited one of the copies, replaceing the IMEI code with a normal phone number.
  4- Placed both files in a local web server.
  5- Accesed the files from my phone, and got the expected results with your App.
Thanks!

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#155

Post by dattaway »

makmanalp wrote: post #125
kristofferR wrote: post #88

Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.

Or you could have a script that, when notices the user agent to not be mobile, shows the IMEI version, but otherwise shows the reset version :P

no script required...apache has a setenvif module that can do a special action based on browser, refer, ....

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#156

Post by nfriedly »

kristofferR wrote: post #88

Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.

Works on a Verizon Thunderbolt running Cyanogenmod

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#157

Post by manki »

GICodeWarrior wrote: post #147

I created an Android app to intercept these requests and prevent them. https://dl.dropbox.com/s/28lk6rn09x84qqg/AutoResetBlocker.ap... Please test it and make sure it works for you. 1. Open the above link on your phone 2. Install the application (it requires no special permissions) 3. Try this IMEI test: http://jsfiddle.net/kKFn8/ 4. Check the box to make "Auto-Reset Blocker" the default action 5. Auto-Reset Blocker…

Please add this to Google Play store so its more trustworthy and easier to access.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#158

Post by finnw »

kristofferR wrote: post #88

Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.

Works on HTC Bravo with CM7.1.0

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#160

Post by julianz »

JoeCortopassi wrote: post #89
kristofferR wrote: post #88

Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.

Can anyone confirm that this is not only a safe USSD, but that it triggers the exploit? I am not an owner of a S3, but would love to be able to help show some of my non-tech friends whether they are vulnerable to this or not

It is safe, and on my stock international S3 with Chrome as the browser it opens the dialer and displays my IMEI number, as advertised.

It seems to me that there's no reason at all to allow URI's beginning with tel: as the source of a frame. Surely that's a fair limitation?

Post reply on HN