up what should i do now Cm9 on HP touch pad... I think it's safe. It doesn't show an IMEI just asks if I want to add #06# to my contact list... if the device does not have cellular, is there any risk? No dialer application, no way to dial the reset code right? Just wanted to let you know that we (Bitdefender) already released a tool on the Play Store that protects against this vulnerability. Now, once you would tap on a exploiting link, Bitdefender will intercept the wipe command and ask you to decide what to do next. You may, if unsure, dismiss the USSD command. Android Default Browser - runs the script and IS INFECTED - show IMEI (1) (2) Maxthon Browser as default - don't run the script, so its safe to use (3) Observations: (1) before default browser run the script the system ask to me an default application to run it, the options are: avast! Number Validator, SMS Messenger or Phone Dialer. In other words, the script only runs if you clicked on "Phone Dialer" option. (2) avast! is installed but don't catch this flaw... big mess, big fault... (3) my preferred browser is Maxthon and its set as complete default with an app called Default App Manager Lite, so this is my suggested workaround to avoid the problem Reproduction in whole or in part in any form or medium without express written permission of IDG Communications is prohibited. Copyright 2011 IDG Communications. ABN