yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note I717] rhacy:
Hi gregsarg, I'm running Saurom 2.3.6 - v7.1 too, and my Note's not directly vulnerable to the USSD exploit with GrooVe IP installed. To clarify somewhat, the stock touchwiz dialer is set to default, so the system should be vulnerable to a direct url attack. Nonetheless, when I test for the USSD exploit vulnerability with the stock browser, using a safe test like dylanreeveDOTcom/phone.php ***, the select dialer window pops up instead of the system initiating the touchwiz dialer like it normally would by default. This at least stops the exploit from being initiated unless the stock dialer's manually selected. Nevertheless, when I manually select the touchwiz dialer with dylanreeve's USSD Exploit Test url, the touchwiz dialer does show my IMEI, d'oh! This confirms that Saurom is vulnerable to the exploit without a third party dialer installed. Moreover, as you mentioned, the next step should be to test other browsers in order to see if the exploit can be stopped without the need for a third party dialer. On that note, have you found any browsers yet that prevent the USSD exploit?

*** If anyone would like to safely test for the exploit, just type dylanreeveDOTcom/phone.php with a "." instead of the "DOT" into your browser, and please post your findings, including your browser, dialer, & specific touchwiz based ROM build.

Best to all,

R
[AT&T Samsung Galaxy Note I717] gregsarg:
No concrete list at this point, however it is logical to assume that with so many browsers sharing the same engine, and simply skin changed ....that many browsers are affected .

The fact that the GB stock builds require an additional step to access the TW dialer, is at least a small safety net, unlike ICS and JB ..

These builds forward directly to the dialer, and execute the exploit.

I knew that GB was my favorite for a reason ....LOL

I know the development community is very aware of the issue, and we shouldn't have to wait long for a patch...or even a modified browser Apk to shield the exploit....

Meanwhile....Samsung is hard at work patching the issue on their end.

What I'm worried about, is the possibility that an official update will be pushed out, and to get it, we would need a return to stock option until our devs can patch around the problem ...g
[AT&T Samsung Galaxy Note I717] kevhuff:
What do you have to do for this bug i have ran the test and i am apparently vulnerable

Running flaps ics+fjmod, stock dialer/browser
[AT&T Samsung Galaxy Note I717] gregsarg:
The exploit is a crafted HTML code, that opens the stock touchwiz dial pad, and auto dials the hard reset code for samsung devices....(SGN, SGS, skyrocket ...pretty much all of the devices using a TW rom base )

It is indigenous to the touchwiz UI, and the touchwiz dialer in any current Samsung rom or it's variant.

The solution at the moment, was thought to be the use of a third party dialer, but the exploit will persist there also, but does require the user to select the dialer of choice, whether it be the stock pad , or a third party app.

Either way ...the exploit will trigger once the code runs, or the user selects a dialer option.

The result is, the device immediately wipes data, and will hard reset the contents.

Although the exploit does no permanent damage I.E. chips etcetera, it is certainly malicious in it's design and intent.

Nonetheless, its a bug that has no business in our affairs, and needs a permanent patch...g
[AT&T Samsung Galaxy Note I717] rhacy:
Thanks for thanks, heads up, & info.. Cheers! & cheers to DAGr8 for Saurom 2.3.6! Hehehe, it was the first ROM I loaded my Note, and even after testing my share of ICS & JB builds, it's still my daily driver - go to ROM, due to it's combination of stability, decent speed, built in line recording, and the ability to add in ad-hoc wifi support. Yikes... getting off topic.

As far as the USSD exploit goes, I'm not at all worried about having to revert to stock to patch or even the actual exploit hitting my Note, due to regular CWM backups, the extremely low odds of it actually happening, and faith in all the incredible developers. My concerns are mainly for the other xda members or anyone with an exploitable system, as I'm sure yours are too. Anyway, like you, I'm betting a patch will be available soon.

Best to all,

R
[AT&T Samsung Galaxy Note I717] gregsarg:
Agreed .....it will be fixed soon I'm sure ...

And you bring up an excellent point ...that is ...users must run regular backups for just such an occasion.

And I've seen countless users fail to backup anything at all..

And then are left starting over from scratch if something goes wrong like this bug.....g
[AT&T Samsung Galaxy Note I717] rhacy:
Yes... completely agree... current backups are a must have, especially for any mission critical device, and everyone should backup on a regular basis regardless. Even if it's just to save the time and trouble of having to set up from scratch again. Heck, it's mandatory for me to have current completely cloned spare drives for my laptops etc..., and on as well as off device complete backups for smartphones etc... just in case some type of system failure, data loss, or data corruption occurs. Plus, as they say, time is money, and backups have saved myself as well as millions of others plenty of both in the long run.

Best to all,

R
[AT&T Samsung Galaxy Note I717] ptgptg:
Erik Thauvin recently released an app (available for free on Google Play) that stops the USSD code from automatically being dialed. The app is called noUSSD and is free.

I am not associated with the developer and am only passing along what I found in my search.

Thanks,
[AT&T Samsung Galaxy Note I717] gregsarg:
There you have it folks .....the first of many fixes ...

Many thanks for posting ....g
[Samsung Galaxy Fit GT 5670] Raj joshi:
Hello guys can any1 port jelly for our sgf nd i hav already talked to the dev of jelly blast to port bt he doest hav a device and adviced me to request me on our forum so please do reply guys its an awsum rom my friends use it plz read the whole post its vry auwsum guyz..:) :)

Here is the post : http://xdaforums.com/showthread.php?t=1679563
[Samsung Galaxy Fit GT 5670] Crytech:
Actually i know that rom is cool...but we cant port roms from sgy lyk we can do for mini...:(

I would hv made it but sry dude no time...rough schedule...
[Samsung Galaxy Fit GT 5670] janarthanan.v:
Try by yourself quite easy but careful in meta-inf folder
[Samsung Galaxy Fit GT 5670] Raj joshi:
Sir,i will try myself surely...bt i hav a doubt that the cpu is diffrent frm that of sgy so porting must be done in the same way as we do for mini,gio,ace... i m afraid of phone getting bricked..bcz of that..help if u can..thanks..:)
[Samsung Galaxy Fit GT 5670] Raj joshi:
Sir when you get free you can try it out and if u will port for our fit plzz pm me..!!! Thank you :)

visit here for jellybean support for galaxy fit:-

http://xdaforums.com/showthread.php?t=1903321

thank you
[Samsung Galaxy Fit GT 5670] rajibie:
I'm using it on galaxy y but its not so smooth. So dont port it. For smooth rom u can try andro-id v3.3.1
[Samsung Galaxy Fit GT 5670] Harpratap:
we already have andro-id 3.3.1 by tj_style himself

and changing kernel or adding tweaks while porting can eliminate such issues.
[Verizon Samsung Galaxy S III] TokedUp:
http://www.droid-life.com/2012/09/2...at-allows-factory-resets-with-just-one-click/

Anyone care to elaborate? Wondering if u have to be running TW or just have it on our phone. I use Apex so Im hoping im safe.
[Verizon Samsung Galaxy S III] tekhna:
The Verge has confirmed it kills an AT&T Galaxy SIII. http://www.theverge.com/2012/9/25/3403928/samsung-touchwiz-reset-vulnerability

F*ck manufacturer skins, whether it's Touchwiz or Sense.
[Verizon Samsung Galaxy S III] NuclearEMP:
i haven't looked into this but thought i read that it has to do with dialer codes, in which Verizon users will be safe since they are blocked by default.
[Verizon Samsung Galaxy S III] ooofest:
I just read this:

- ooofest
[Verizon Samsung Galaxy S III] Imatoasta:
Jaxidian on rootz has confirmed that it doesn't affect asop.

http://rootzwiki.com/index.php?/topic/34484-GS3-Factory-Reset-iFrame-Exploit
[Verizon Samsung Galaxy S III] ihavenewnike:
I did it on stock routed galaxy s3. Will upload to YouTube later to show it
[Verizon Samsung Galaxy S III] Sccrluk9:
This was patched with the OTA pushed out a week or two ago so if you are running stock you're fine.
[Verizon Samsung Galaxy S III] dunderball:
I did not take the latest OTA that supposedly dumbs down searching on the device.

I plan on sticking with stock-rooted. Is there a way to flash the security fix some other way?
[Verizon Samsung Galaxy S III] ricky babalu:
I did not take the OTA either (did not want the search feature removed and Verizon snoopware installed). I am still on the original F2 (rooted, unlocked), I tested and my phone is vulnerable because it showed my IMEI number when tested. I then found this app (Telstop) which will help prevent a malicious attack via the Samsung vulnerability.

Info on Telstop
[Samsung Galaxy Nexus] goast:
Is there an app for us to use motion gestures like the s lll?
[HTC One X] H170k121:
Odd problem here... battery charges for a while but it stops always, making it unable to flash the boot.img (which is the only file missing to run it)

I have the clockwork mod latest verison installed, and it doesnt charge in recovery neither (only to that limits).

I have tried charging it with 2 or 3 cables and no luck.

Any ideas? Anything is appreciated and will be tested.
[HTC One X] lawrence750:
so just to confirm are you having an remote battery low error returned when trying to flash the boot.img?
[HTC One X] H170k121:
Exactly It appears just as I try to flash it and then it changes to remote (hex direction)

or some other errors, then i unplug and reconnect and back to battery low. I have tried some cables as well, same problem.
[HTC One X] H170k121:
Also I forgot to mention, when I connect it it first stays off (the notification led), then after some time and some presses from the Power and Volume down key (the boot sequence) it starts blinking red (kinda fast) in a short led light then off then again short led light, after some time it stars to last longer, I mean led light stays on for more time then off then again, until (sometimes only) it goes static led, but after that it turns off and stops charging.
[HTC One X] chrisjcks:
Have you tried the fastboot trickle charge script?

(can you get to bootloader/fastboot?)

I'm still a little confused what's happening with your phone.
[HTC One X] H170k121:
Ok here's the full detail:

It can enter fastboot, recovery and sometimes it shows the htc logo.

The fastboot .bat charge script works well but only until 3557 mV (weird I know) then it just stops and goes down.

The phone has a custom ROM flashed already, just waiting for the boot.img to start normally.

I can mount the sd-card in recovery which is the latest cwm at the moment, .4 something clockworkmod

Ahm... I replaced the screen since it got broken and it works just as before, so it wasn't the screen (theres no hardware problem that I know except for the non charging battery).

Before this happened the sd card stopped working in the OS randomly making lots of error messages to appear like htc.bgp.com and all those.

Actually the phone charges and gets warm then stops charging at the limit I mentioned before, so I can't flash nothing to it. I've repaired it before when it was able to charge, so I know how to go on from there I just need to charge it beyond 30%
[HTC One X] chrisjcks:
Hmm, strange - I've only ever heard of the fastboot charging script not charging 'enough' due to someone not using the official htc cable.

Can you confirm your using the official cable?

Also, I thought boot.img flashes needed just 10% including unlocking the bootloader etc.

I thought only RUU installs required 30%
[HTC One X] lawrence750:
Good point, I had the battery low error once but I was on about 3% battery at that point

Op have you tried flashing it again after running the charge script?
[HTC One X] H170k121:
Yes is the official cable, the one that came with the phone, in either way wall plugged or usb pc.

Either of the charges to the same spot 3557mV which is not enough to flash it, maybe its like 9.8%, since the last time I flashed something it was 3687mV and it worked just fine, but yeah as you said it won't go past the 10% in this case I was wrong it's not 30% its 10%, thanks for correcting me.

And I've tried also the script, not working =S and just after the script charges I try the flash stuff and always battery low message and the second try its random hex error messages. either x00030000 or x00060000 or something with 8
[HTC One X] H170k121:
I may also add... I used to charge the phone sometimes with the powermat device, and it charged perfectly, even faster sometimes than with the original cable.

So I thought that using the powermat cable would work but no luck still.. the device is unlocked, and used to be rooted before flashing it, I think it keeps the root but I don't know. Unlocked it is, it says unlocked in the main screen.

Also I added the red blinking light, it has been like that for almost 2 hours now... I connected it today here at work and it's still the same, no permanent light, I'm using the AC on the work to keep it cool, seems to be working, but dunno the battery status since I don't have fastboot here.
[HTC One X] lawrence750:
Have you tried charging from within recovery? Instead of fast boot charging

---------- Post added at 07:59 PM ---------- Previous post was at 07:57 PM ----------

Oh and btw if you look in the guide written by the last hylian (in general) you'll find a link to download the fast boot files, you only need adb.exe the adb dll whatever it's called and fastboot.exe :)

Edit:actually sorry you'll need the Android drivers as well forget that lol you already know that process lol :)
[HTC One X] H170k121:
Yes I plugged it once in recovery and started charging, but I don't know if there's something limiting the maximum charge, because it was in there for like... 4 hours and still the same result, the red light was solid red there, I placed a fan beside it because it got warm since the screen was on and the phone was plugged, but still it didn't charge.

I thought it was something with the heat, because I heard that when it goes 2 hot it stops charging and turns off.. So that's why I used the fan.
[HTC One X] lawrence750:
Solid red means charging of course, but I take it you tried flashing boot.img after that 4 hours as well?

When overheating the led should flick green and red, although I'm not sure if it does this in recovery
[HTC One X] H170k121:
Yep I tried flashing it and got the same message.

And I've never had the green and red led thing. So it may just not work out the OS.

However the phone won't get a solid red now, it just stays in the recovery window with no led. Dunno if that means something
[HTC One X] lawrence750:
Wow what a situation.

No led in recovery when using usb, and ac, and powermat?

It's weird, charging should be possible in latest Cwm, maybe try and re flash Cwm?
[HTC One X] H170k121:
xD it goes even worse... I can't flash anything... low batt
[HTC One X] lawrence750:
I've just looked at the cwm known issues, one is that the led sometimes doesn't light up when charging, but it is charging.

Try again. Keep it charging for an hour or two from ac. Ignore if the led doesn't light up

Plug into usb, do the adb reboot bootloader and try flash the kernel again. If it doesn't let us know. Paste the exact error here as well, might trigger somebody's memory :)
[HTC One X] H170k121:
Question... the command adb reboot bootloader is in recovery mode right? what does it do exactly?

and then I try to flash the boot.img again in fastboot? or what are the steps? I'm kinda new in here first smartphone I'm flashing so I just know what's in the forums.
[HTC One X] lawrence750:
Adb I think can be used even when booted into android, also works in recovery

When you type adb reboot bootloader you're basically loading adb.exe, and saying to it reboot the connected device, bootloader says what mode to boot into. You could also type adb reboot recovery, and it would boot into recovery (but that's from when booted into android I think). Also, I *think* you could just type adb reboot, and if phone was working correctly it would simply do a normal reboot.

So once it's booted into the bootloader, it'll auto detect its on usb, and go into fastboot usb mode, you'll see that on the hox screen.

Then the fastboot command will load fastboot.exe, and say to it flash the boot (which somehow translates to kernel^_^) with the boot.img you specify

I was new at one point don't worry about it :) this is my 3rd android phone and I forget these commands all the time lol.

Let me know how it goes (just charge for an hour at least from ac)
[HTC One X] H170k121:
Sure I'm letting it charge right now until I go home from work, should be around 3 or 4 more hours. then I will just plug it and check it, hope it helps ^^.

Also, I don't know if it's the battery but some times the power button won't do anything, even the combination power button + vol down. Probably due to the low batt. I hope so at least.
[HTC One X] lawrence750:
I found the vol down and power combo to be a bit un reliable. Mine doesn't always go into bootloader at least (if that's what you mean) it just boots normally mostly. I think it's to do with the timing of when they're pushed.

Holding power button for around 10 seconds should reboot the phone whatever state its in, as long as it's on of course, if it's not then like you said could be low battery causing it but seems more likely something else ain't right, it's not a software feature (the 10 second reboot) its built into the hardware AFAIK, so if that's not working maybe there's a hardware fault somewhere :-\
[HTC One X] H170k121:
Also one more thing.. Now that is plugged to the pc it shows the message Usb device not recognized in windows 7.

Could it be some hardware damage? or is it just that it has no power? it appears only some times
[HTC One X] chrisjcks:
Could just be a driver issue,

Download htc sync, it should install all necessary drivers.

As for the fastboot charging script, it should definitely work past the 10% needed to flash a boot.img - how long did you leave it?
[HTC One X] H170k121:
I've tried with lots of times to check if either does not charge enough or starts discharging earlier, from 10 mins, 20, 30, ... up to one night, and did that also on sunday but with some interruptions to check charge, and it never went over 3558, once I remember it went close to 3580 but that was like 1 week ago.

Oh and also, I have those drivers installed in my home pc. and it shows the same message, and it shows just sometimes, if it was drivers it would be displayed always I think.
[HTC One X] chrisjcks:
Hang on...

Interruptions to check charge?

That's impossible if your doing the fastboot charging using the script, as the charge shows constantly on your PC while your phone reboots to bootloader every 6 seconds.
[HTC One X] lawrence750:
Sounds like pc is catching it when it's changing between modes, does it say anything about apx device? If it's only doing it sometimes it might not mean anything

You aren't plugging the phone in via a usb hub or through your keyboard or anything are you? It is directly plugged into pc? Ideally the back usb ports.
[HTC One X] H170k121:
Its not impossible, I forgot to add that I've tried charging it in all possible ways, via ac adapter, via powermat and also usb, in usb either just plugging it or with the script.

and while the script is going, I check the voltage and it never goes up the value mentioned before.

While I charge it in the ac adapter, via usb with no script or powermat I interrupt the charging to check the values in the pc, thats what I meant.
[HTC One X] H170k121:
oh yeah exactly apx device, what is that? so then its nothing wrong... nice to know.
[HTC One X] lawrence750:
Not really sure I've only seen mentions of it here, id recommend you search the hox general and q&a for apx and see what you find

Just hope it doesn't stay in apx mode, because from what I've read that isn't a good thing, although like I say I haven't read much on it so could be wrong.
[HTC One X] chrisjcks:
I don't know what APX mode means (I've never seen it, nor read about what it is) but if his phone is in this mode - its usually bricked and needs sending in for repair.
[HTC One X] H170k121:
I saw something about Tegra 3 devices (or almost any nVidia device) being able to boot that way, and it didn't say it was like something bad, but I will continue reading, also it doesn't always shows up as an APX device. Depends on how you plug it I guess? Like the mode you're on when you plug it.

But I'll try what you say and if it doesn't work I'll try sending it, but since it's already out of warranty I prefer to try everything possible first.
[HTC One X] lawrence750:
I think the reason it isn't good at least is because it either requires hardware, or software that we don't have to actually manipulate the device in that mode(if anyone knows about apx mode here's the time to chip in!) its called nvflash is what I've heard. Someone said that was for video cards, but seeing as nvidia does both video cards and tegra 3 it would make sense that they using a similar tool to flash fw with

Did you try again? How did it go?
[HTC One X] H170k121:
Yes and sadly no luck. I managed to get a direct charger to try and charge the battery directly without the phone interface, I'll tell you how it goes.

I also called HTC and they said it has no warranty and since the problem is so strange it may need a full motherboard change in case it is damaged, so as the warranty is void for flashing it I will try everything before sending it to them. I would pay 2 shipments of around 70 USD plus the diagnostic and if necessary pieces and repair costs. So it's probably going to be more than the price I paid for the phone. Wish me luck ^^
[HTC One X] lawrence750:
ouch - i was going to suggest to do what you've done, obviously it is an extreme to have to take the phone apart, but it is an option, i hope it will do the trick, will definitely save some $
[HTC One X] H170k121:
Don't worry I'm kinda an expert tearing stuff apart xD I used to repair laptops and pcs, and I did change my LCD+Digitizer for this HOX.

Now the news... good and bad...

Good news, the direct charge did get some voltage into the battery, which was enough to flash everything back... But now I have my doubts... maybe the usb port is faulty now and is not charging the phone, I'll tell you why... after flashing it, It went into htc sense and all, with a custom rom Android Revolution HD, after this I let it "charging" during the night but it just emptied the battery, the weird thing here is that the USB does work with the pc as transfer port.

Bad news... Seems like the chipset may be damaged, since I had to press it a bit and then reconnect it so it would let me flash the device, at first some hex errors were shown, something like 19000008 and others.

Also, one more thing the leds flashed in 2 different sequences, one Red Green Red, for a little time (it was warm i guess it was the temperature) and after this it went solid red, and then again Red Green Green Red, 2 greens this time (it wasn't warm at this time). Any ideas?

Thanks a lot. Also I think I'll get a local phone now since I bought this via ebay from taiwan... but I'm considering either another HOX or the S3? I know this ain't a S3 forum... but what would you recommend? (the HOX was a pain to have everything built in, battery, sd card, etc. that's my main concern).
[HTC One X] H170k121:
WOW Something reeeeeal weird happened just now... I just turned the phone on again in fastboot and... it says LOCKED, this is impossible, since it was unlocked, and if you lock it it always says RELOCKED....

What the hell!!!!