12 ms·
USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page
- EwanToo 14y agoSeems to require that the web page is trigged by an external source, e.g. a QR code, NFC, etc, but still scary stuff.
- deleted 14y ago[deleted]
- nicholassmith 14y agoThat's a pretty big flaw, there's plenty of companies with QR Codes printed on posters etc, only takes one malicious reprint or sticker overlay. I imagine Samsung will probably take fast action on it. Well, hopefully fast action.
- antidoh 14y agoAnd then the Telcos will take a year or more to roll it out incrementally around the world as they argue with Samsung over who pays for it.
- headShrinker 14y agoSamsung has a well documented history of not doing anything in situations like this. https://www.google.com/search?q=samsung+phone+bugs https://www.google.com/search?q=samsung+phone+bugs They will likely not fix this in any phone but the Galaxy S3 and note 2 or when jelly bean is released for them.
- deleted 14y ago[deleted]
- aw3c2 14y agoIf I was really bored and feeling malicious, printing QR codes to point to this "exploit" and then pasting them over QR codes on random advertisements in the streets seems like a terrible idea.
- asmithmd1 14y agoIt wouldn't affect anyone because no one has ever scanned a QR code in an ad
- prof_hobart 14y agoMy 6 year old daughter is absolutely fascinated by QR codes. I've been nagged into scanning ones on posters, in magazines, and even one that showed up in the middle of a TV show...
- mibbitier 14y agoYou can pick up barcode battlers on ebay for cheap. Although they're probably antiques now.
- prof_hobart 14y agoI've got some somewhere, but I don't think they did QR codes and they certainly didn't launch a link - that's what she enjoys. No idea why, but I'm not going to discourage her from anything that gets her interested in technology. We're going to get a t-shirt printed for her with a QR code saying "If found, please ring [phone number]".
- GFischer 14y agoFirst thought: this might be a neat Android game Second thought: this has already been implemented And.. https://play.google.com/store/apps/details?id=com.fawepark.android.barcodebeasties https://play.google.com/store/apps/details?id=com.fawepark.a... (by the way, this displays in an awful Spanish for me, because of my default language)
- dowskitest 14y agoI have a six year old son with this same fascination. Sometimes I'll walk into my home office and find some mailer with a QR code sitting there waiting for me. His inquisitive mind just has to know what the phone will do with the code.
- oofabz 14y ago+++ATH0
- drewwwwww 14y agoexactly what i thought of! except even worse.
- gulbrandr 14y agoCan you explain this please?
- thursley 14y agoThis was/is an infamous modem vulnerability: http://www.securityspace.com/smysecure/catid.html?id=10020 http://www.securityspace.com/smysecure/catid.html?id=10020 It could force a modem to hangup and redial a number.
- quesera 14y agoNot a vulnerability, really. And the redial was a separate process, possibly automatic. (Edit: OK, yes it is. It's more a protocol vulnerability and a data handling weakness -- the modems just implemented the protocol, but that's just semantics.. ) +++ is the Hayes command set string to enter command mode. AT is the prefix for commands, and H0 means "set switchhook to zero", i.e. "hang up". (H1 means "go off hook", DT means dial using touch tones, DP means dial, using pulses, etc). The first two components (+++ and AT) are configurable, but no one ever changed them. This is really just a weakness of in-band signaling. For this to work, you need a human on the modem side to type the escape and command strings -- or a program on the modem side that takes unfiltered data from the network and sends it back out without escaping. That's the vulnerability. Accepting data from untrusted sources will always take you somewhere bad, and there are much worse things you can do to modems than make them hang up. If IRC clients would parrot tainted data back up the serial line, great havoc could be caused.
- dasil003 14y agoThis was a troll that would make dial-up modems hang up back in the day. Sort of like convincing someone to do `sudo rm -rf /`.
- forgotusername 14y agoPage text was: the USSD code to factory data reset a Galaxy S3 is *2767*3855# can be triggered from browser like this: <frame src="tel:*2767*3855%23" />
- Achshar 14y agoLooks like OP decided to pull this down to minimize damage. Makes me wonder was this a 0-day or he informed Samsung first.
- Peroni 14y agohttps://twitter.com/pof/status/250540790491787264 https://twitter.com/pof/status/250540790491787264
- andrewcooke 14y agodoes that mean premium rate numbers can also be triggered?
- forgotusername 14y agoThe special feature of these "pseudo USSD" codes on Android is that you don't have to press the call button. Simply typing the digits is enough. Note I have no idea if this particular attack actually works.
- deleted 14y ago[deleted]
- rplnt 14y agoI don't think it's "android feautre", I've seen this on a few non-smart phones in the past. I don't know which one though as I owned few of them over the years.
- deleted 14y ago[deleted]
- smcl 14y agoThe page no longer works (I clicked it about 30 seconds ago, it loaded successfully then I accidentally hit ctrl-w and then tried to reopen it: and now I get "404 Page Not Found")
- deleted 14y ago[deleted]
- tomscott 14y agoHello. I'm the guy who put this collection together. I've since tried to update it, and to hit 'delete' on it to avoid spreading misinformation, but Exquisite Tweets is still caching the original version. Mea culpa: I didn't do the research before passing it on. There's been a lot of back-and-forth over whether it's true or not (check @pof's timeline for such), and a hell of a lot of people sending it on without double-checking. Myself included. There is clearly a big security bug here (see the video linked), but it's extremely questionable as to whether it can be activated from a web page or whether it requires a bit of social engineering too! [Edited to add: and just as I write this, @jwheare has cleared the cache and fixed the bug in Exquisite Tweets. Hopefully that should nip this in the bud.]
- forgotusername 14y agoI tried reproducing it using a "USSD" that works on my venerable Nexus One (radio debug - * # * # 4636 # * # *), but on entering dialler app the input box is empty. This might simply mean the debug activity was started and got focus before the dialler app had its focus set, so if another such code triggered factory reset, might definitely still work.
- jrabone 14y agoI wrote a trivial webpage (using the show IMEI USSD * #06#), served from my desktop with Lighttpd. It certainly can be executed via a simple web page using a frameset on both Chrome & Browser, and there's no prompt. Works on a Huawei running 2.3, a Galaxy S2 running ICS, and an HTC.
- hpaavola 14y agohttp://m.youtube.com/#/watch?feature=youtu.be&v=Q2-0B04HPhs&desktop_uri=%2Fwatch%3Fv%3DQ2-0B04HPhs%26feature%3Dyoutu.be http://m.youtube.com/#/watch?feature=youtu.be&v=Q2-0B04H... demo on the issue
- gulbrandr 14y agovideo link: http://www.youtube.com/watch?v=Q2-0B04HPhs http://www.youtube.com/watch?v=Q2-0B04HPhs
- estel 14y agoA clearer video showing the lack of prompt: http://tweakers.net/video/6292/html-code-laat-galaxy-s-ii-resetten.html http://tweakers.net/video/6292/html-code-laat-galaxy-s-ii-re...
- molmalo 14y agoI have an S2, And I'm reading this from it. I was like "woow", then clicked the link that says "the code" instinctively and a sec later realized the stupid thing I just did (not smart reading that code from a vulnerable device). luckily, I pressed the back button before the page loaded. That was close
- jcitme 14y agoIt's a .png file of the code...
- lwhi 14y agoA pretty major bug; but I'm guessing you'd need to hit dial to actually run this?
- darkstalker 14y agoNo, as soon as you enter the last digit the code activates.
- darkstalker 14y agoDoes this trigger a confirmation dialog before typing the number? if not, installing another app that hooks up the dialer intent should work as a workaround.
- lwhi 14y agoLooks like this thread may have been a source for the code initially [1] [1] http://forum.xda-developers.com/showthread.php?t=1687249 http://forum.xda-developers.com/showthread.php?t=1687249
- kristofferR 14y agoWell, the number and similar ones like that has been known for years. The new issue here is that they can be auto-called using a <frame>-tag in HTML.
- deleted 14y ago[deleted]
- FreshCode 14y agoCan anyone on HN confirm this exploit?
- henriklied 14y agoI just tested it on a Samsung Galaxy S3, in several forms (as src in link, script, img, video and object elements, as well as the href in an a element). Nothing happened here.
- camiller 14y agoAndroid Central reported that the (verizon) S3 was not vulnerable to this attack. http://www.androidcentral.com/major-security-vulnerability-samsung-phones-could-trigger-factory-reset-web-browser http://www.androidcentral.com/major-security-vulnerability-s... Edit: Found some postings on xda-dev that the GS3 is vulnerable. Could depend on firmware version, I know a system update came out recently on Sprint.
- deleted 14y ago[deleted]
- DirtyCalvinist 14y agoI just tried it on the S3 test device here at work. No go on either putting it in a web page, or going through a QR code.
- jitbit 14y agoCorrect link: https://twitter.com/pof/status/250540790491787264 https://twitter.com/pof/status/250540790491787264
- level09 14y agoI deployed this code on this page : http://flasharabia.com http://flasharabia.com however the code doesn't seem to work ..
- verroq 14y agoHow about you use proper HTML instead of just the frame code and nothing else? e.g. <!DOCTYPE html> <html> <frameset> <frame src="tel:*2767*3855%23"> </frameset> </html>
- level09 14y agoyes it works now, however, you need to press the call button to initiate the format
- anonymfus 14y agoAlso will be interesting to check other ways:<iframe src="tel:27673855%23">, <img src="tel:27673855%23">, <script type="text/javascript">location.href="tel:27673855%23";</script> and so on.
- dx8 14y agoiFrame works, direct link too. I tested also things like URL encoding via # = %23, * = %2A etc. - but does not really matter, the target is the dialer, not the browser. http://pastebin.com/cGgs7T4h http://pastebin.com/cGgs7T4h << some thoughts
- lwhi 14y agoIf you want to check the functionality - it would be far more responsible to use a non-destructive USSD code. e.g. *#06# displays the phone's IMEI number
- preds 14y agoTesting this myself, any USSD code that begins with * # launches the device's dialler with no characters dialled. Looking at the list of codes: http://umitem.blogspot.com.au/2010/10/samsung-galaxy-s-i9000-ussd-codes.html http://umitem.blogspot.com.au/2010/10/samsung-galaxy-s-i9000... The factory reset appears to be the only USSD "auto dialled" code that doesn't begin with *#. Which is rather unfortunate. Edit: Actually, the IMEI code works on the Galaxy S2 running 2.3 (just tested) but not the Galaxy S3 running 4.0. My above comment refers to the S3.
- verroq 14y agoSo has anyone confirmed it working yet?
- martingordon 14y agoThat explains this tweet from Stephen Elop: https://twitter.com/ceoStephenElop/statuses/250560153013846017 https://twitter.com/ceoStephenElop/statuses/2505601530138460...
- Geee 14y agoThat's not real Stephen Elop, you know? :)
- Geee 14y agoOriginal presentation of the vulnerability with demo: http://youtu.be/Q2-0B04HPhs http://youtu.be/Q2-0B04HPhs
- deleted 14y ago[deleted]
- potkor 14y agoWorks with my HTC Desire if I use the info code, the dialog for showing battery status etc pops up. Raises interesting consumer protection questions, this is a 2010 phone with no updates recently. The law says the dealer has to fix or make up for manufacturing defects that show up years later.
- camiller 14y agoAre software defects considered manufacturing defects? BTW, read elsewhere that if you are using the Chrome browser instead of the Samsung browser this doesn't affect you. Haven't had the guts to test it myself.
- joeblau 14y agoWhere did you see that? Someone else said the same thing.
- corin_ 14y agoThe S3 was released four months ago, not in 2010.
- zurn 14y agoRead what I wrote, I wasn't talking about the S3 :)
- lwhi 14y agoAs far as I can tell, the problem is with the Samsung Dialler application that's part of TouchWiz. If you install a second dialler application via the Play Store, you'll initially be asked which dialler app you want to use before the code is executed - which can prevent execution. There's a strong possibility that other dialler applications aren't affected (i.e. stock / 3rd party).
- jrabone 14y agoAlso works on my colleague's HTC & Huawei phones - it's not just TouchWiz.
- emehrkay 14y agoClassic case of a developer putting a backdoor in (for testing) and forgetting to take it out. I'm curious as to how long it will take to patch it and if there will be any fallout over this (they are the number 1 phone producer in the world).
- dubcanada 14y agoNo their not lol... Apple & HTC sell more phones then they do.
- emehrkay 14y agoAre you sure about that? A simple google search for "samsung sells most phones" says otherwise.
- corin_ 14y agoWhich company sells the most isn't really relevant (to this particular topic) - check out what Wikipedia has to say on specifically S3 sales, with plenty of citations: http://en.wikipedia.org/wiki/Samsung_Galaxy_S_III#Commercial_reception http://en.wikipedia.org/wiki/Samsung_Galaxy_S_III#Commercial...
- kristofferR 14y agoHere's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html http://kristofferR.com/samsung.html Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag. The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.
- JoeCortopassi 14y agoCan anyone confirm that this is not only a safe USSD, but that it triggers the exploit? I am not an owner of a S3, but would love to be able to help show some of my non-tech friends whether they are vulnerable to this or not
- weszlem 14y agoIt looks like it does not work. It opens telephone keyboard on my S3, but except that nothing happens. EDIT: i'm using Jelly Beans
- jrabone 14y agoWorks on a stock Galaxy S2 with Samsung ICS, and a random stock HTC (colleague's phone). Triggers IMEI display via dialer from both Chrome and Browser :(
- preds 14y agoI've tested this using both a galaxy S2 and S3. On the S2 the above page is safe and triggers the exploit to view the IMEI. On the S3 it launches the dialler however, the dialler is empty and does not display the IMEI. After investigating further, the S3 does not launch codes that begin with * # but will trigger the factory reset code which is in the format of * 1234 * 1234 # Edit: Those with an S3 can confirm this by visiting http://no.tl/s.html http://no.tl/s.html in which I've embedded * 1234 * 1234 # (which is not the reset code, but is the same format)
- Stratoscope 14y agoConfirmed on a Samsung Droid Charge running a rooted version of the stock Verizon EP4 release of Android 2.3.6 Gingerbread.
- sssparkkk 14y agoThis is for real. Just confirmed the auto-execution of an USSD code on a Samsung Galaxy Mini II. Try the link below to see whether your device is vulnerable: http://www.tinyurl.com/samsungexploit http://www.tinyurl.com/samsungexploit It will show your firmware version by executing *#1234#.
- semenko 14y agoI'm 95% sure this bug was fixed between ICS and Jelly Bean. I'd been using the app Hidden Menus (https://play.google.com/store/apps/details?id=com.lorenx.android.hiddenmenus&hl=en https://play.google.com/store/apps/details?id=com.lorenx.and...) which stopped working at the ICS -> JB transition. You now need to type USSD/star codes manually. Perhaps this puts a new face on the Android OS update/fragmentation problem.
- eloisant 14y agoIs there any way to protect a phone against that? (Other than installing CM...)
- marksuman 14y agoYou can point your S3 friends to this website if they want to try it out: http://wipemys3.com http://wipemys3.com
- marksuman 14y agoSounds like it works for S2 users as well.
- GICodeWarrior 14y agoI created an Android app to intercept these requests and prevent them. https://dl.dropbox.com/s/28lk6rn09x84qqg/AutoResetBlocker.apk?dl=1 https://dl.dropbox.com/s/28lk6rn09x84qqg/AutoResetBlocker.ap... Please test it and make sure it works for you. 1. Open the above link on your phone 2. Install the application (it requires no special permissions) 3. Try this IMEI test: http://jsfiddle.net/kKFn8/ 4. Check the box to make "Auto-Reset Blocker" the default action 5. Auto-Reset Blocker will show you the malicious number 6. Open this safe telephone number test: http://jsfiddle.net/tLHpw/ 7. Auto-Reset Blocker will show the safe number and you will be asked which dialer to use 8. Select your normal dialer 9. Your normal dialer will open with the safe number Again, please give it a try. If people like it, I will see about setting up an Android Market account to distribute it.
- TazeTSchnitzel 14y agoWorks great. However, the immediate select app popup if it's "safe" means that the "This phone number appears safe" text is shadowed on my phone. Perhaps add a "dial" button? Still, please set up a Market account, this would be great!
- GICodeWarrior 14y agoI submitted a new version incorporating your suggestion. It should be on the market in a couple hours. :-)
- molmalo 14y agoI tested it with my S2 and it works, but I had to put the files in a local web server because for some reason, the malicious code didn't work from jsfiddle.net So I did the following: 1- I tested the link provided by kristofferR (http://kristofferr.com/samsung.html). 2- Made 2 local copies 3- Edited one of the copies, replaceing the IMEI code with a normal phone number. 4- Placed both files in a local web server. 5- Accesed the files from my phone, and got the expected results with your App. Thanks!
- manki 14y agoPlease add this to Google Play store so its more trustworthy and easier to access.
- timrogers 14y agoI've just implemented this as a Rack middleware, meaning it can be added to every page in a Rails/Rack app with 3 lines of code. A bit of hacker fun, albeit scary hacker fun. http://news.ycombinator.com/item?id=4573320 http://news.ycombinator.com/item?id=4573320
- esrauch 14y agoIsn't this just 1 line of code without middleware?
- siaukia 14y agohttp://manmeng.net/fun/androidreset/ http://manmeng.net/fun/androidreset/ Would be great if can compile a list of affected phone (tested via safe version).
- k4rulez 14y agohow can i send a wap push?