121–130 of 186 posts
Works with my HTC Desire if I use the info code, the dialog for showing battery status etc pops up. Raises interesting consumer protection questions, this is a 2010 phone with no updates recently. The law says the dealer has to fix or make up for manufacturing defects that show up years later.
The S3 was released four months ago, not in 2010.
That's a pretty big flaw, there's plenty of companies with QR Codes printed on posters etc, only takes one malicious reprint or sticker overlay. I imagine Samsung will probably take fast action on it. Well, hopefully fast action.
They will likely not fix this in any phone but the Galaxy S3 and note 2 or when jelly bean is released for them.
That's a pretty big flaw, there's plenty of companies with QR Codes printed on posters etc, only takes one malicious reprint or sticker overlay. I imagine Samsung will probably take fast action on it. Well, hopefully fast action.
Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.
Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.
Earlier quoted context omitted.
does that mean premium rate numbers can also be triggered?
The special feature of these "pseudo USSD" codes on Android is that you don't have to press the call button. Simply typing the digits is enough. Note I have no idea if this particular attack actually works.
Now, of course, it's just a bit of legacy nonsense that gets left enabled simply because it's part of an existing workflow and serves mostly as a hidden gotcha for people doing security analysis.
Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.
Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.
Can anyone confirm that this is not only a safe USSD, but that it triggers the exploit? I am not an owner of a S3, but would love to be able to help show some of my non-tech friends whether they are vulnerable to this or not
Earlier quoted context omitted.
I would guess the opposite. QR codes are too early. They need to be scannable by a device that doesn't require reaching into your pocket, fumbling with your phone and then trying to get the right angle. Combining a couple projections, I see them going from utterly useless to gimmicky cool for a particular crowd within 2 years.
Personally I think they would take off if we had some sort of large plastic dedicated device that plugged into your computer to scan these things. Perhaps shaped like a cat; people like cats.