USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

http://www.exquisitetweets.com/collection/tomscott/1762

by EwanToo • 14 years ago

295 173 14 years ago

EwanToo• 14 years ago

Seems to require that the web page is trigged by an external source, e.g. a QR code, NFC, etc, but still scary stuff.

That's a pretty big flaw, there's plenty of companies with QR Codes printed on posters etc, only takes one malicious reprint or sticker overlay. I imagine Samsung will probably take fast action on it. Well, hopefully fast action.

antidoh• 14 years ago

And then the Telcos will take a year or more to roll it out incrementally around the world as they argue with Samsung over who pays for it.

headShrinker• 14 years ago

Samsung has a well documented history of not doing anything in situations like this. https://www.google.com/search?q=samsung+phone+bugs

They will likely not fix this in any phone but the Galaxy S3 and note 2 or when jelly bean is released for them.

aw3c2• 14 years ago

If I was really bored and feeling malicious, printing QR codes to point to this "exploit" and then pasting them over QR codes on random advertisements in the streets seems like a terrible idea.

asmithmd1• 14 years ago

It wouldn't affect anyone because no one has ever scanned a QR code in an ad

prof_hobart2• 14 years ago

My 6 year old daughter is absolutely fascinated by QR codes. I've been nagged into scanning ones on posters, in magazines, and even one that showed up in the middle of a TV show...

klausa• 14 years ago

http://picturesofpeoplescanningqrcodes.tumblr.com/

culturestate• 14 years ago

Every Android phone in Japan would be wiped out in a matter of hours. I see people scanning them in Tokyo constantly.

c0nsumer• 14 years ago

I do mountain bike (and thus indirectly hiking) trail development, construction, and maintenance as volunteer work. This has shown me a surprisingly useful place for QR codes: on trailhead map boards. The code just links to a (well optimized) PDF of the map itself, along with some text that says "Scan this with your phone to download a copy of the map.".

It amazes me how many people I see scanning the QR code to get a copy of the map before they head out on the trails.

mibbitier4• 14 years ago

I've yet to scan one of these codes, or see anyone scanning one. It seems like something from the 90s just came back for one last dying breath.

ljf• 14 years ago

I was in a British train station the other day and saw a poster containing 20 QR codes, one for each of a set a possible journeys from the station. Since I'm techy and had time to kill I scanned it, waiting to see the timetable information. Sadly the company who installed the posters was having some downtime, so it just errored. The annoying thing was that they were really just a URL shortening company, forwarding you on to the correct mobile friendly page of the trainline website. I really don't know why the trainline couldn't have just made some nice short, typing friendly short URLs of their own, and posted these on the poster. Or just posted the actual time tables like they used to. In the olden days.

Whilst scanning it and trying to figure out what was wrong, the station master approached me to see what I was doing - since the poster had been installed he'd yet to see anyone use it, and had been waiting to ask someone what on earth it was for.

Still - if there is someone out there that wanted to hack me, they just have to place a qr code in a place where I am likely to have nothing to do for a while... At least with this poster it was actually easy to scan the codes, unlike those on billboards or posted on the tube here in the UK.

steevdave2• 14 years ago

At FTF (Freescale Technology Forum) in 2011 at least (didn't go this year), used them on everyone's name tags and booths, so rather than passing out business cards, you used the iPod to scan them and it would send you a nicely formatted email along with the contacts for easy importing into whatever contacts you used. It was about the only time I felt they were done right.

And if you scanned the codes that were given in the different tracts, you were also sent the PDFs and slides of that tract.

Dn_Ab2• 14 years ago

I would guess the opposite. QR codes are too early. They need to be scannable by a device that doesn't require reaching into your pocket, fumbling with your phone and then trying to get the right angle.

Combining a couple projections, I see them going from utterly useless to gimmicky cool for a particular crowd within 2 years.

ColinDabritz• 14 years ago

This is pretty darn dangerous already, but I would note you may not need a website at all for this. From my understanding, the problem is in the stock dialer, and it automatically executes when the number is entered. I will quietly note here that, as part of the standard, QR codes can embed phone numbers. I do not have a samsung phone to test this with. Anyone?

TazeTSchnitzel3• 14 years ago

Used a QR code scanner on http://qr.kaywa.com/?s=8&d=tel%3A%2A%252306%2523 (QR Code of tel:*%2306%23) - was picked up as a telephone number QR code by some barcode scanning app I have. Clicked dial number. Showed IMEI.

Yeah, this would probably work.

oofabz• 14 years ago

+++ATH0

drewwwwww• 14 years ago

exactly what i thought of! except even worse.

gulbrandr2• 14 years ago

Can you explain this please?

thursley• 14 years ago

This was/is an infamous modem vulnerability: http://www.securityspace.com/smysecure/catid.html?id=10020

It could force a modem to hangup and redial a number.

dasil003• 14 years ago

This was a troll that would make dial-up modems hang up back in the day. Sort of like convincing someone to do `sudo rm -rf /`.

mikezupan• 14 years ago

That is the modem hangup string. You could send a icmp packet to a person containing just that and their modem would drop the connection. So it was common in IRC for people to ping a whole channel with that and have a bunch of people quit right after.

joezydeco• 14 years ago

Hah! A friend of mine back in the BBS days had a last name that ended in a certain pair of characters that would trigger a zmodem download. Those were fun times, weren't they?

forgotusername3• 14 years ago

Page text was:

    the USSD code to factory data reset a Galaxy S3 is *2767*3855# can be
    triggered from browser like this: <frame src="tel:*2767*3855%23" />

Achshar• 14 years ago

Looks like OP decided to pull this down to minimize damage. Makes me wonder was this a 0-day or he informed Samsung first.

Peroni• 14 years ago

https://twitter.com/pof/status/250540790491787264

andrewcooke• 14 years ago

does that mean premium rate numbers can also be triggered?

forgotusername3• 14 years ago

The special feature of these "pseudo USSD" codes on Android is that you don't have to press the call button. Simply typing the digits is enough. Note I have no idea if this particular attack actually works.

cdh• 14 years ago

I don't have a Galaxy S3 to test this, but my experience with the Galaxy S and Galaxy S2 is that for normal phone numbers, you need to specifically confirm that you want to dial the number. For the code to factory reset the phone, though, simply typing in the code is sufficient, you don't need to press dial. It might be the same here, so that only that specific USSD code can be triggered without a confirmation from the user.

teagoat• 14 years ago

It's not the end of the world though. You're browsing on your android phone and suddenly it dials an unexpected number and you can see that it starts 900XXXXXXX or 976XXXXXXX. Most people are going to hang up pretty quickly. Sure, you might be out of pocket for up to $10 (I don't actually know how much mobile carrier charge for the connection charge), but it's not the same as losing all your data.

A more common attack vector to make money on compromised accounts would be setting up a call forward to an international number and then dialing the subscribers phone number. Illegal low cost calling cards often steal service by doing this. If there was a way to also retrieve the user's phone number, I can imagine a system where you dial the calling card company, input your code and the number you want to dial.... It tells you that it's trying to connect you and that it may take a couple of minutes... It snares the next person caught out on the website, sets their call forward to the number you want to dial, then dials that subscriber for you and connects. So then it's charging the wireless subscriber for your international call, and even if they then disable the call forward on their account, until you hang up, it's still charging them for the call forward.

smcl• 14 years ago

The page no longer works (I clicked it about 30 seconds ago, it loaded successfully then I accidentally hit ctrl-w and then tried to reopen it: and now I get "404 Page Not Found")

tomscott• 14 years ago

Hello. I'm the guy who put this collection together. I've since tried to update it, and to hit 'delete' on it to avoid spreading misinformation, but Exquisite Tweets is still caching the original version. Mea culpa: I didn't do the research before passing it on.

There's been a lot of back-and-forth over whether it's true or not (check @pof's timeline for such), and a hell of a lot of people sending it on without double-checking. Myself included.

There is clearly a big security bug here (see the video linked), but it's extremely questionable as to whether it can be activated from a web page or whether it requires a bit of social engineering too!

[Edited to add: and just as I write this, @jwheare has cleared the cache and fixed the bug in Exquisite Tweets. Hopefully that should nip this in the bud.]

forgotusername3• 14 years ago

I tried reproducing it using a "USSD" that works on my venerable Nexus One (radio debug - * # * # 4636 # * # *), but on entering dialler app the input box is empty. This might simply mean the debug activity was started and got focus before the dialler app had its focus set, so if another such code triggered factory reset, might definitely still work.

jrabone6• 14 years ago

I wrote a trivial webpage (using the show IMEI USSD * #06#), served from my desktop with Lighttpd. It certainly can be executed via a simple web page using a frameset on both Chrome & Browser, and there's no prompt. Works on a Huawei running 2.3, a Galaxy S2 running ICS, and an HTC.

hpaavola• 14 years ago

http://m.youtube.com/#/watch?feature=youtu.be&v=Q2-0B04H...

demo on the issue

gulbrandr2• 14 years ago

video link: http://www.youtube.com/watch?v=Q2-0B04HPhs

estel2• 14 years ago

A clearer video showing the lack of prompt: http://tweakers.net/video/6292/html-code-laat-galaxy-s-ii-re...

molmalo2• 14 years ago

I have an S2, And I'm reading this from it. I was like "woow", then clicked the link that says "the code" instinctively and a sec later realized the stupid thing I just did (not smart reading that code from a vulnerable device). luckily, I pressed the back button before the page loaded.

That was close

lwhi5• 14 years ago

A pretty major bug; but I'm guessing you'd need to hit dial to actually run this?

darkstalker2• 14 years ago

No, as soon as you enter the last digit the code activates.

lwhi5• 14 years ago

Is that the case if the code is entered via a URL handler?

EDIT: Can anyone confirm this?

darkstalker2• 14 years ago

Does this trigger a confirmation dialog before typing the number? if not, installing another app that hooks up the dialer intent should work as a workaround.

lwhi5• 14 years ago

Looks like this thread may have been a source for the code initially [1]

[1] http://forum.xda-developers.com/showthread.php?t=1687249

kristofferR3• 14 years ago

Well, the number and similar ones like that has been known for years. The new issue here is that they can be auto-called using a <frame>-tag in HTML.

FreshCode• 14 years ago

Can anyone on HN confirm this exploit?

henriklied• 14 years ago

I just tested it on a Samsung Galaxy S3, in several forms (as src in link, script, img, video and object elements, as well as the href in an a element). Nothing happened here.

camiller3• 14 years ago

Android Central reported that the (verizon) S3 was not vulnerable to this attack.

http://www.androidcentral.com/major-security-vulnerability-s...

Edit: Found some postings on xda-dev that the GS3 is vulnerable. Could depend on firmware version, I know a system update came out recently on Sprint.

DirtyCalvinist• 14 years ago

I just tried it on the S3 test device here at work. No go on either putting it in a web page, or going through a QR code.

jitbit• 14 years ago

Correct link: https://twitter.com/pof/status/250540790491787264

level092• 14 years ago

I deployed this code on this page :

http://flasharabia.com

however the code doesn't seem to work ..

verroq2• 14 years ago

How about you use proper HTML instead of just the frame code and nothing else?

e.g.

    <!DOCTYPE html>
    <html>
    <frameset>
        <frame src="tel:*2767*3855%23">
    </frameset>
    </html>

level092• 14 years ago

yes it works now, however, you need to press the call button to initiate the format

anonymfus• 14 years ago

Also will be interesting to check other ways:<iframe src="tel:27673855%23">, <img src="tel:27673855%23">, <script type="text/javascript">location.href="tel:27673855%23";</script> and so on.

lwhi5• 14 years ago

If you want to check the functionality - it would be far more responsible to use a non-destructive USSD code.

e.g. *#06# displays the phone's IMEI number

preds3• 14 years ago

Testing this myself, any USSD code that begins with * # launches the device's dialler with no characters dialled. Looking at the list of codes: http://umitem.blogspot.com.au/2010/10/samsung-galaxy-s-i9000...

The factory reset appears to be the only USSD "auto dialled" code that doesn't begin with *#. Which is rather unfortunate.

Edit: Actually, the IMEI code works on the Galaxy S2 running 2.3 (just tested) but not the Galaxy S3 running 4.0. My above comment refers to the S3.

jrabone6• 14 years ago

<!DOCTYPE html> Seconded. This works beautifully as proof-of-concept against my S2 and a colleagues random HTC phone.

Stratoscope3• 14 years ago

Seriously? You're posting the DESTRUCTIVE version of the exploit instead of a safe test version? Shame on you.

verroq2• 14 years ago

So has anyone confirmed it working yet?

martingordon• 14 years ago

That explains this tweet from Stephen Elop: https://twitter.com/ceoStephenElop/statuses/2505601530138460...

Geee2• 14 years ago

That's not real Stephen Elop, you know? :)

Geee2• 14 years ago

Original presentation of the vulnerability with demo: http://youtu.be/Q2-0B04HPhs

potkor• 14 years ago

Works with my HTC Desire if I use the info code, the dialog for showing battery status etc pops up.

Raises interesting consumer protection questions, this is a 2010 phone with no updates recently. The law says the dealer has to fix or make up for manufacturing defects that show up years later.

camiller3• 14 years ago

Are software defects considered manufacturing defects?

BTW, read elsewhere that if you are using the Chrome browser instead of the Samsung browser this doesn't affect you. Haven't had the guts to test it myself.

joeblau• 14 years ago

Where did you see that? Someone else said the same thing.

corin_2• 14 years ago

The S3 was released four months ago, not in 2010.

zurn• 14 years ago

Read what I wrote, I wasn't talking about the S3 :)

lwhi5• 14 years ago

As far as I can tell, the problem is with the Samsung Dialler application that's part of TouchWiz.

If you install a second dialler application via the Play Store, you'll initially be asked which dialler app you want to use before the code is executed - which can prevent execution.

There's a strong possibility that other dialler applications aren't affected (i.e. stock / 3rd party).

jrabone6• 14 years ago

Also works on my colleague's HTC & Huawei phones - it's not just TouchWiz.

emehrkay2• 14 years ago

Classic case of a developer putting a backdoor in (for testing) and forgetting to take it out. I'm curious as to how long it will take to patch it and if there will be any fallout over this (they are the number 1 phone producer in the world).

dubcanada• 14 years ago

No their not lol... Apple & HTC sell more phones then they do.

emehrkay2• 14 years ago

Are you sure about that? A simple google search for "samsung sells most phones" says otherwise.

kristofferR3• 14 years ago

Here's a safe version of the exploit that displays your IMEI: http://kristofferR.com/samsung.html

Check the html in your desktop browser first, for all you know I might as well be a malicious douchebag.

The exploit seems to require a stock Samsung Galaxy dialer, works fine on my cheap Samsung Galaxy Y but not on my friend's modded S3 with a vanilla Android dialer.

JoeCortopassi2• 14 years ago

Can anyone confirm that this is not only a safe USSD, but that it triggers the exploit? I am not an owner of a S3, but would love to be able to help show some of my non-tech friends whether they are vulnerable to this or not

weszlem• 14 years ago

It looks like it does not work. It opens telephone keyboard on my S3, but except that nothing happens. EDIT: i'm using Jelly Beans

jrabone6• 14 years ago

Works on a stock Galaxy S2 with Samsung ICS, and a random stock HTC (colleague's phone). Triggers IMEI display via dialer from both Chrome and Browser :(

preds3• 14 years ago

I've tested this using both a galaxy S2 and S3. On the S2 the above page is safe and triggers the exploit to view the IMEI. On the S3 it launches the dialler however, the dialler is empty and does not display the IMEI.

After investigating further, the S3 does not launch codes that begin with * # but will trigger the factory reset code which is in the format of * 1234 * 1234 #

Edit: Those with an S3 can confirm this by visiting http://no.tl/s.html in which I've embedded * 1234 * 1234 # (which is not the reset code, but is the same format)

Stratoscope3• 14 years ago

Confirmed on a Samsung Droid Charge running a rooted version of the stock Verizon EP4 release of Android 2.3.6 Gingerbread.

julianz• 14 years ago

It is safe, and on my stock international S3 with Chrome as the browser it opens the dialer and displays my IMEI number, as advertised.

It seems to me that there's no reason at all to allow URI's beginning with tel: as the source of a frame. Surely that's a fair limitation?

WDYC2• 14 years ago

Right now, the frame's source is tel:*%2306%23

kristofferR3• 14 years ago

Yup. %23 makes the #-sign, making the number *#06# which is the default IMEI code on most phones out there.

pjonesdotca• 14 years ago

safe version confirmed to work for HTC Desire

short_circut• 14 years ago

Works on stock Galaxy Note too

makmanalp• 14 years ago

Or you could have a script that, when notices the user agent to not be mobile, shows the IMEI version, but otherwise shows the reset version :P

JoeCortopassi2• 14 years ago

Except there is no javascript on that page. They could do the same thing server side though

dattaway• 14 years ago

no script required...apache has a setenvif module that can do a special action based on browser, refer, ....

aidenn0• 14 years ago

Works on my HTC Evo Shift with Cyanogen mod 7.2

enjo• 14 years ago

Doesn't work on my Galaxy Nexus, stock 4.1...

gwillen• 14 years ago

Hm, _does_ work on my GN, stock 4.0.4.

51Cards• 14 years ago

Works on Nexus One 2.3.6 as well.

jacobr• 14 years ago

Opera mobile asks for confirmation before loading the frame.

deniska• 14 years ago

I opened it in my desktop firefox and it showed «Sent to phone» notify of firefox2phone plugin which uses chrome2phone protocol.

TazeTSchnitzel3• 14 years ago

Works fine on older Samsung Galaxy Y Pro, the budget touch-screen/keyboard (i.e. BlackBerry form-factor with touch) phone.

adambard• 14 years ago

Displayed my IMEI on an HTC Legend circa 2010, with Cyanogen 7.1, just to add to the data.

rauar• 14 years ago

Same for HTC Desire Cyanogen latest 7.2

nfriedly• 14 years ago

Works on a Verizon Thunderbolt running Cyanogenmod

finnw• 14 years ago

Works on HTC Bravo with CM7.1.0

mappu• 14 years ago

"Web page not available" using Browser on SK17i running CM9.1.0

jkn• 14 years ago

To people reporting that this works on other devices such as HTC phones, this doesn't mean your phone is vulnerable: First, the hash-star code to display the IMEI number is standard, while the reset code is device specific. Second, as I understand it the problem with the Galaxy S3 is that it doesn't ask for user confirmation after the reset code is entered.

sssparkkk• 14 years ago

This is for real. Just confirmed the auto-execution of an USSD code on a Samsung Galaxy Mini II. Try the link below to see whether your device is vulnerable:

http://www.tinyurl.com/samsungexploit

It will show your firmware version by executing *#1234#.

semenko• 14 years ago

I'm 95% sure this bug was fixed between ICS and Jelly Bean.

I'd been using the app Hidden Menus (https://play.google.com/store/apps/details?id=com.lorenx.and...) which stopped working at the ICS -> JB transition. You now need to type USSD/star codes manually.

Perhaps this puts a new face on the Android OS update/fragmentation problem.

jrabone6• 14 years ago

The only JB device I have to hand is a Nexus 7, which of course just prompts to add the number as a contact...

armis2• 14 years ago

I have samsung galaxy s i9000 Android CM9 4.0.4. Can confirm that exploit is working and shows imei popup

eloisant• 14 years ago

Is there any way to protect a phone against that? (Other than installing CM...)

marksuman2• 14 years ago

You can point your S3 friends to this website if they want to try it out: http://wipemys3.com

marksuman2• 14 years ago

Sounds like it works for S2 users as well.

GICodeWarrior6• 14 years ago

I created an Android app to intercept these requests and prevent them. https://dl.dropbox.com/s/28lk6rn09x84qqg/AutoResetBlocker.ap...

Please test it and make sure it works for you.

  1. Open the above link on your phone
  2. Install the application (it requires no special permissions)
  3. Try this IMEI test: http://jsfiddle.net/kKFn8/
  4. Check the box to make "Auto-Reset Blocker" the default action
  5. Auto-Reset Blocker will show you the malicious number
  6. Open this safe telephone number test: http://jsfiddle.net/tLHpw/
  7. Auto-Reset Blocker will show the safe number and you will be asked which dialer to use
  8. Select your normal dialer
  9. Your normal dialer will open with the safe number

Again, please give it a try. If people like it, I will see about setting up an Android Market account to distribute it.

TazeTSchnitzel3• 14 years ago

Works great. However, the immediate select app popup if it's "safe" means that the "This phone number appears safe" text is shadowed on my phone. Perhaps add a "dial" button?

Still, please set up a Market account, this would be great!

GICodeWarrior6• 14 years ago

I submitted a new version incorporating your suggestion. It should be on the market in a couple hours. :-)

molmalo2• 14 years ago

I tested it with my S2 and it works, but I had to put the files in a local web server because for some reason, the malicious code didn't work from jsfiddle.net

So I did the following:

  1- I tested the link provided by kristofferR (http://kristofferr.com/samsung.html).
  2- Made 2 local copies
  3- Edited one of the copies, replaceing the IMEI code with a normal phone number.
  4- Placed both files in a local web server.
  5- Accesed the files from my phone, and got the expected results with your App.

Thanks!

manki• 14 years ago

Please add this to Google Play store so its more trustworthy and easier to access.

GICodeWarrior6• 14 years ago

Thank you everyone for your feedback! I published my application on Google Play. https://play.google.com/store/apps/details?id=net.gicode.and...

It is still rough on the eyes, but it serves the intended purpose.

nl• 14 years ago

This seems to work, but I couldn't get the JSFiddles to make it trigger.

May I suggest pointing people to a simple webpage (like http://kristofferr.com/samsung.html) maybe more user-friendly?

GICodeWarrior6• 14 years ago

Yeah, I am not sure why the JSFiddle would work on one phone and not another, but it is definitely an issue.

I might try putting tel: links (for people to tap on) directly into the marketplace description.

mparlane• 14 years ago

Your site works on my S2. Please don't change the test number ;)

MHP47• 14 years ago

Thanks, works as intended on my S3. Any chance of releasing the source code though?

GICodeWarrior6• 14 years ago

Thanks for asking. That is the plan. I just need a bit more time to make it presentable.

GICodeWarrior6• 14 years ago

Posted! http://news.ycombinator.com/item?id=4576823

timrogers2• 14 years ago

I've just implemented this as a Rack middleware, meaning it can be added to every page in a Rails/Rack app with 3 lines of code. A bit of hacker fun, albeit scary hacker fun.

http://news.ycombinator.com/item?id=4573320

esrauch• 14 years ago

Isn't this just 1 line of code without middleware?

siaukia• 14 years ago

http://manmeng.net/fun/androidreset/ Would be great if can compile a list of affected phone (tested via safe version).

k4rulez• 14 years ago

how can i send a wap push?

USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

Related Stories