Page text was: the USSD code to factory data reset a Galaxy S3 is *2767*3855# can be triggered from browser like this:
Looks like OP decided to pull this down to minimize damage. Makes me wonder was this a 0-day or he informed Samsung first.
USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
71–80 of 186 posts
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#72Works with my HTC Desire if I use the info code, the dialog for showing battery status etc pops up.
Raises interesting consumer protection questions, this is a 2010 phone with no updates recently. The law says the dealer has to fix or make up for manufacturing defects that show up years later.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#73I deployed this code on this page : http://flasharabia.com however the code doesn't seem to work ..
How about you use proper HTML instead of just the frame code and nothing else? e.g.
Also will be interesting to check other ways:27673855%23">, 27673855%23">, location.href="tel:27673855%23"; and so on.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#74Works with my HTC Desire if I use the info code, the dialog for showing battery status etc pops up. Raises interesting consumer protection questions, this is a 2010 phone with no updates recently. The law says the dealer has to fix or make up for manufacturing defects that show up years later.
Are software defects considered manufacturing defects?
BTW, read elsewhere that if you are using the Chrome browser instead of the Samsung browser this doesn't affect you. Haven't had the guts to test it myself.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#75Earlier quoted context omitted.
At FTF (Freescale Technology Forum) in 2011 at least (didn't go this year), used them on everyone's name tags and booths, so rather than passing out business cards, you used the iPod to scan them and it would send you a nicely formatted email along with the contacts for easy importing into whatever contacts you used. It was about the only time I felt they were done right. And if you scanned the codes that were given…
Or you could take a picture of peoples name tags and it could just do OCR... surely?
COULD do that, or you could have all the information that they already submitted (it was more than just a vCard). I would rather not have to proof read all the OCR (there are hundreds of people at FTF)
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#76+++ATH0
Hah! A friend of mine back in the BBS days had a last name that ended in a certain pair of characters that would trigger a zmodem download. Those were fun times, weren't they?
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#77Can anyone on HN confirm this exploit?
I just tested it on a Samsung Galaxy S3, in several forms (as src in link, script, img, video and object elements, as well as the href in an a element). Nothing happened here.
Android Central reported that the (verizon) S3 was not vulnerable to this attack.
http://www.androidcentral.com/major-security-vulnerability-s...
Edit: Found some postings on xda-dev that the GS3 is vulnerable. Could depend on firmware version, I know a system update came out recently on Sprint.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#78Earlier quoted context omitted.
At FTF (Freescale Technology Forum) in 2011 at least (didn't go this year), used them on everyone's name tags and booths, so rather than passing out business cards, you used the iPod to scan them and it would send you a nicely formatted email along with the contacts for easy importing into whatever contacts you used. It was about the only time I felt they were done right. And if you scanned the codes that were given…
Or you could take a picture of peoples name tags and it could just do OCR... surely?
The Heartland Developers Conference did the same thing this year. The QR code included more info than just the text on the badge so OCR would not have gotten the email address.
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#79As far as I can tell, the problem is with the Samsung Dialler application that's part of TouchWiz.
If you install a second dialler application via the Play Store, you'll initially be asked which dialler app you want to use before the code is executed - which can prevent execution.
There's a strong possibility that other dialler applications aren't affected (i.e. stock / 3rd party).
Re: USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
#80Classic case of a developer putting a backdoor in (for testing) and forgetting to take it out. I'm curious as to how long it will take to patch it and if there will be any fallout over this (they are the number 1 phone producer in the world).