Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

exquisitetweets.com

Post reply on HN
Print view View original

21–30 of 186 posts

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#21

Post by forgotusername »

tomscott wrote: post #17

Hello. I'm the guy who put this collection together. I've since tried to update it, and to hit 'delete' on it to avoid spreading misinformation, but Exquisite Tweets is still caching the original version. Mea culpa: I didn't do the research before passing it on. There's been a lot of back-and-forth over whether it's true or not (check @pof's timeline for such), and a hell of a lot of people sending it on without doub…

I tried reproducing it using a "USSD" that works on my venerable Nexus One (radio debug - * # * # 4636 # * # *), but on entering dialler app the input box is empty. This might simply mean the debug activity was started and got focus before the dialler app had its focus set, so if another such code triggered factory reset, might definitely still work.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#23

Post by ljf »

mibbitier wrote: post #11
aw3c2 wrote: post #4

If I was really bored and feeling malicious, printing QR codes to point to this "exploit" and then pasting them over QR codes on random advertisements in the streets seems like a terrible idea.

I've yet to scan one of these codes, or see anyone scanning one. It seems like something from the 90s just came back for one last dying breath.

I was in a British train station the other day and saw a poster containing 20 QR codes, one for each of a set a possible journeys from the station. Since I'm techy and had time to kill I scanned it, waiting to see the timetable information. Sadly the company who installed the posters was having some downtime, so it just errored. The annoying thing was that they were really just a URL shortening company, forwarding you on to the correct mobile friendly page of the trainline website. I really don't know why the trainline couldn't have just made some nice short, typing friendly short URLs of their own, and posted these on the poster. Or just posted the actual time tables like they used to. In the olden days.

Whilst scanning it and trying to figure out what was wrong, the station master approached me to see what I was doing - since the poster had been installed he'd yet to see anyone use it, and had been waiting to ask someone what on earth it was for.

Still - if there is someone out there that wanted to hack me, they just have to place a qr code in a place where I am likely to have nothing to do for a while... At least with this poster it was actually easy to scan the codes, unlike those on billboards or posted on the tube here in the UK.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#24

Post by prof_hobart »

mibbitier wrote: post #12
prof_hobart wrote: post #10

Earlier quoted context omitted.

My 6 year old daughter is absolutely fascinated by QR codes. I've been nagged into scanning ones on posters, in magazines, and even one that showed up in the middle of a TV show...

You can pick up barcode battlers on ebay for cheap. Although they're probably antiques now.

I've got some somewhere, but I don't think they did QR codes and they certainly didn't launch a link - that's what she enjoys. No idea why, but I'm not going to discourage her from anything that gets her interested in technology. We're going to get a t-shirt printed for her with a QR code saying "If found, please ring [phone number]".

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#27

Post by steevdave »

mibbitier wrote: post #11
aw3c2 wrote: post #4

If I was really bored and feeling malicious, printing QR codes to point to this "exploit" and then pasting them over QR codes on random advertisements in the streets seems like a terrible idea.

I've yet to scan one of these codes, or see anyone scanning one. It seems like something from the 90s just came back for one last dying breath.

At FTF (Freescale Technology Forum) in 2011 at least (didn't go this year), used them on everyone's name tags and booths, so rather than passing out business cards, you used the iPod to scan them and it would send you a nicely formatted email along with the contacts for easy importing into whatever contacts you used. It was about the only time I felt they were done right.

And if you scanned the codes that were given in the different tracts, you were also sent the PDFs and slides of that tract.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#28

Post by forgotusername »

andrewcooke wrote: post #22
forgotusername wrote: post #13

Page text was: the USSD code to factory data reset a Galaxy S3 is *2767*3855# can be triggered from browser like this:

does that mean premium rate numbers can also be triggered?

The special feature of these "pseudo USSD" codes on Android is that you don't have to press the call button. Simply typing the digits is enough. Note I have no idea if this particular attack actually works.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#29

Post by timrogers »

ljf wrote: post #23
mibbitier wrote: post #11

Earlier quoted context omitted.

I've yet to scan one of these codes, or see anyone scanning one. It seems like something from the 90s just came back for one last dying breath.

I was in a British train station the other day and saw a poster containing 20 QR codes, one for each of a set a possible journeys from the station. Since I'm techy and had time to kill I scanned it, waiting to see the timetable information. Sadly the company who installed the posters was having some downtime, so it just errored. The annoying thing was that they were really just a URL shortening company, forwarding yo…

This sort of thing is common from what I've seen. More traditional businesses (like phone companies) don't know how to "do a QR code" (as it were), so they pay a company to make them for them. Such companies are just selling a glorified URL shortener, but the other businesses don't know that.

Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

#30

Post by lwhi »

darkstalker wrote: post #26
lwhi wrote: post #20

A pretty major bug; but I'm guessing you'd need to hit dial to actually run this?

No, as soon as you enter the last digit the code activates.

Is that the case if the code is entered via a URL handler?

EDIT: Can anyone confirm this?

Post reply on HN