I've just implemented this as a Rack middleware, meaning it can be added to every page in a Rails/Rack app with 3 lines of code. A bit of hacker fun, albeit scary hacker fun.
USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
161–170 of 186 posts
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#162I've just implemented this as a Rack middleware, meaning it can be added to every page in a Rails/Rack app with 3 lines of code. A bit of hacker fun, albeit scary hacker fun. http://news.ycombinator.com/item?id=4573320
Isn't this just 1 line of code without middleware?
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#163I created an Android app to intercept these requests and prevent them. https://dl.dropbox.com/s/28lk6rn09x84qqg/AutoResetBlocker.ap... Please test it and make sure it works for you. 1. Open the above link on your phone 2. Install the application (it requires no special permissions) 3. Try this IMEI test: http://jsfiddle.net/kKFn8/ 4. Check the box to make "Auto-Reset Blocker" the default action 5. Auto-Reset Blocker…
Thank you everyone for your feedback! I published my application on Google Play.
https://play.google.com/store/apps/details?id=net.gicode.and...
It is still rough on the eyes, but it serves the intended purpose.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#164I created an Android app to intercept these requests and prevent them. https://dl.dropbox.com/s/28lk6rn09x84qqg/AutoResetBlocker.ap... Please test it and make sure it works for you. 1. Open the above link on your phone 2. Install the application (it requires no special permissions) 3. Try this IMEI test: http://jsfiddle.net/kKFn8/ 4. Check the box to make "Auto-Reset Blocker" the default action 5. Auto-Reset Blocker…
This seems to work, but I couldn't get the JSFiddles to make it trigger.
May I suggest pointing people to a simple webpage (like http://kristofferr.com/samsung.html) maybe more user-friendly?
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#165I created an Android app to intercept these requests and prevent them. https://dl.dropbox.com/s/28lk6rn09x84qqg/AutoResetBlocker.ap... Please test it and make sure it works for you. 1. Open the above link on your phone 2. Install the application (it requires no special permissions) 3. Try this IMEI test: http://jsfiddle.net/kKFn8/ 4. Check the box to make "Auto-Reset Blocker" the default action 5. Auto-Reset Blocker…
This seems to work, but I couldn't get the JSFiddles to make it trigger. May I suggest pointing people to a simple webpage (like http://kristofferr.com/samsung.html ) maybe more user-friendly?
Yeah, I am not sure why the JSFiddle would work on one phone and not another, but it is definitely an issue.
I might try putting tel: links (for people to tap on) directly into the marketplace description.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#166I created an Android app to intercept these requests and prevent them. https://dl.dropbox.com/s/28lk6rn09x84qqg/AutoResetBlocker.ap... Please test it and make sure it works for you. 1. Open the above link on your phone 2. Install the application (it requires no special permissions) 3. Try this IMEI test: http://jsfiddle.net/kKFn8/ 4. Check the box to make "Auto-Reset Blocker" the default action 5. Auto-Reset Blocker…
This seems to work, but I couldn't get the JSFiddles to make it trigger. May I suggest pointing people to a simple webpage (like http://kristofferr.com/samsung.html ) maybe more user-friendly?
Your site works on my S2. Please don't change the test number ;)
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#167Earlier quoted context omitted.
The special feature of these "pseudo USSD" codes on Android is that you don't have to press the call button. Simply typing the digits is enough. Note I have no idea if this particular attack actually works.
This predates Android by years. Special "phone number" codes have been used to control firmware since the very first compute went into a phone. The reason is fairly clear: in the early devices, dialing a number was the only UI metaphor available. USSD itself is actually a standard, such as it is: http://en.wikipedia.org/wiki/Unstructured_Supplementary_Serv... Now, of course, it's just a bit of legacy nonsense that ge…
In this case, the USSD is not the bug. The fact that it can be triggered from HTML and cause a factory reset without user interaction is the bug. At least with older phones, after entry, it was necessary to hit dial before any effect was taken.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#168Earlier quoted context omitted.
This is pretty darn dangerous already, but I would note you may not need a website at all for this. From my understanding, the problem is in the stock dialer, and it automatically executes when the number is entered. I will quietly note here that, as part of the standard, QR codes can embed phone numbers. I do not have a samsung phone to test this with. Anyone?
Used a QR code scanner on http://qr.kaywa.com/?s=8&d=tel%3A%2A%252306%2523 (QR Code of tel:*%2306%23) - was picked up as a telephone number QR code by some barcode scanning app I have. Clicked dial number. Showed IMEI. Yeah, this would probably work.
Using the app Scan[1] it immediately showed the IMEI without promt. I'm not going to scan any QR codes of unknown origin any time soon.
[1] https://play.google.com/store/apps/details?id=me.scan.androi...
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#169Earlier quoted context omitted.
Can anyone confirm that this is not only a safe USSD, but that it triggers the exploit? I am not an owner of a S3, but would love to be able to help show some of my non-tech friends whether they are vulnerable to this or not
It is safe, and on my stock international S3 with Chrome as the browser it opens the dialer and displays my IMEI number, as advertised. It seems to me that there's no reason at all to allow URI's beginning with tel: as the source of a frame. Surely that's a fair limitation?
The approach of prompting the user "Do you want to call this number?" is far simpler and safer. After all, you could probably use tel: links or tel: redirects or something if the frame didn't work.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#170Earlier quoted context omitted.
This predates Android by years. Special "phone number" codes have been used to control firmware since the very first compute went into a phone. The reason is fairly clear: in the early devices, dialing a number was the only UI metaphor available. USSD itself is actually a standard, such as it is: http://en.wikipedia.org/wiki/Unstructured_Supplementary_Serv... Now, of course, it's just a bit of legacy nonsense that ge…
In this case, the USSD is not the bug. The fact that it can be triggered from HTML and cause a factory reset without user interaction is the bug. At least with older phones, after entry, it was necessary to hit dial before any effect was taken.
That's true, but sort of missing my point. Security bugs are very rarely "security bugs" in isolation. They're far more often unexpected interactions between subsystems. Here, the expectation of the browser is that it can fire a "phone number" Intent securely, because the dialer app will handle it. But the phone number intent also happens to hook to the USSD layer. It's not USSD's "fault", as the check needs to be in the browser according to the architecture. But USSD remains a booby trap because it's an unexpected legacy feature with surprising security behavior.