http://m.youtube.com/#/watch?feature=youtu.be&v=Q2-0B04H... demo on the issue
A clearer video showing the lack of prompt: http://tweakers.net/video/6292/html-code-laat-galaxy-s-ii-re...
USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
41–50 of 186 posts
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#42Correct link: https://twitter.com/pof/status/250540790491787264
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#43+++ATH0
Can you explain this please?
That is the modem hangup string. You could send a icmp packet to a person containing just that and their modem would drop the connection. So it was common in IRC for people to ping a whole channel with that and have a bunch of people quit right after.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#44I deployed this code on this page :
however the code doesn't seem to work ..
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#45Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#46Earlier quoted context omitted.
It wouldn't affect anyone because no one has ever scanned a QR code in an ad
My 6 year old daughter is absolutely fascinated by QR codes. I've been nagged into scanning ones on posters, in magazines, and even one that showed up in the middle of a TV show...
I have a six year old son with this same fascination. Sometimes I'll walk into my home office and find some mailer with a QR code sitting there waiting for me. His inquisitive mind just has to know what the phone will do with the code.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#47Earlier quoted context omitted.
Can you explain this please?
That is the modem hangup string. You could send a icmp packet to a person containing just that and their modem would drop the connection. So it was common in IRC for people to ping a whole channel with that and have a bunch of people quit right after.
IRC pings don't use ICMP, but that could work if IRC clients would repeat data received without escaping first. Or if unaware users saw it come over the channel and tried to type it themselves.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#48Can anyone on HN confirm this exploit?
I just tested it on a Samsung Galaxy S3, in several forms (as src in link, script, img, video and object elements, as well as the href in an a element). Nothing happened here.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#49Can anyone on HN confirm this exploit?
I just tried it on the S3 test device here at work. No go on either putting it in a web page, or going through a QR code.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#50Earlier quoted context omitted.
That is the modem hangup string. You could send a icmp packet to a person containing just that and their modem would drop the connection. So it was common in IRC for people to ping a whole channel with that and have a bunch of people quit right after.
IRC pings don't use ICMP, but that could work if IRC clients would repeat data received without escaping first. Or if unaware users saw it come over the channel and tried to type it themselves.
Considering a CTCP request is just a PRIVMSG with ^A wrapped around the "command word", and a CTCP reply is just a NOTICE with the same ^A thing, you can make them "say" just about anything. It's unclear why an IRC client would need to worry about "escaping" +++, except if it's specifically been designed for people with bad modems.
Those of us with good modems back in the dialup days just laughed at this insanity. Hayes used to put "+++AT" in their press releases after a certain point just to trip up any noncompliant systems which may have passed it along.
http://en.wikipedia.org/wiki/Time_Independent_Escape_Sequenc...