yashsingh1/xdaforums huggingface dataset:
[Galaxy S III General] chrisfu:
This. The other SGS3 here (4.0.4) using the same dialer as you doesn't fall foul to this attack, by the looks of it.

Titanium Backup has my fixed Phone app at 4.0.4-I9300XXBLG8 on this device.
[Galaxy S III General] chrisfu:
It's looking like this is the case. Do you have a source for that information?
[Galaxy S III General] Brotuck:
If i remember correctly the program responsible for these commands can easily be removed. But you will need an rooted phone.

Ill dig into which app it is, cannot remember...:silly:
[Galaxy S III General] Lennyuk:
I spoke with the guy who told samsung to patch it, he told them about 3 months ago.

he didn't tell anyone else.
[Galaxy S III General] chrisfu:
Good man. That's the way to do things, buy him a beer. :)
[Galaxy S III General] Lennyuk:
Just so we can put this to bed, is anyone brave enough and in a position to root and restore a nandroid if the code works?

If so join IRC on freenode #villainrom and we will give you a link that is meant to wipe

We need to be 100% sure samsung have patched this - I am at work so cannot rebuild my phone if it wipes.
[Galaxy S III General] rogierg:
Fraaaaak! This is bad, really bad... I'm on a Samsung Galaxy Advance S.

Stock browser opens the USSD

Dolphin opens the USSD

Firefox opens the USSD

So then I thought: let's change the dialer. Changed the dialer to EX dialer and... same result! But having 2 dialers installed gives the dialer choice menu when opening the page and you have the ability then to back out of the page. Seems like a reasonable work around?
[Galaxy S III General] Lennyuk:
Ok so confirmed, if you are on the latest S3 rom (and maybe other samsung phones) your phone should no longer auto-launch the USSD code to do a factory reset.
[Galaxy S III General] Mr Brainz:
Just so we're clear:

Does this factory reset USSD just automatically start the the reset, or is there a confirmation dialog box first?

Because if there is a dialog box, this is a lot less of a problem than everyone says it is... It's bad, don't get me wrong. But not awful if there is a confirmation box.
[Galaxy S III General] Lennyuk:
No for HTC and Samsung devices there is no confirmation message, you run the code the phone reboots and then wipes.
[Galaxy S III General] Mr Brainz:
Well that's just pants then...

Luckily my S3 is just fine. The main thing I'm bothered about is the iPhone-loving media using this to defecate all over Android, especially as they're still smarting from getting a below par iPhone 5 with "enhanced" mapping.

Here's one from Twitter for you:

An iPhone user walks into...a bar, a hotel, a field. He's not too sure.
[Galaxy S III General] killsforpie:
I created a thread in the Rezound forums to keep track of this issue over there (since it seems to be fixed on stock here):

http://xdaforums.com/showthread.php?t=1904807
[Galaxy S III General] Lennyuk:
Just ran a code on an android 2.1 running HTC Hero... it is vulnerable.
[Galaxy S III General] DIII:
oh crap!

samsung galaxy s i9000

ICS - CM9 (via darky rom)

semaphore kernal

venerable

---

edit: and since this is not just s3 venerability why not to move this to general android forum?
[Galaxy S III General] rogierg:
Tested on a HTC Desire S with Cyanogenmod. USSD code is started without confirmation.
[Galaxy S III General] akirainblack:
I just tried on:

SGS2 CM10 stock browser, boots phone with code in place but doesn't do anything else (in fact I had to completely delete the code before I could get it to work. Partial delete and enter the rest of the code didn't work).

SGS2 Latest stock ROM Vulnerable

SGS3 Stock latest Orange ROM, using stock browser opened phone but with nothing dialed.

Desire Stock firmware is vulnerable

Hero (can't remember which of the VillainROM variants it's on) vulnerable

Desire Z latest vodafone stock vulnerable

Not that anyone cares as it's a Wildfire, but that is vulnerable as well can't remember what rom, think it went back to stock for the mother in law.

HTC Incredible S running HTC Sense (Android version 4.0.4) Vulnerable

Sony Experia HD - Latest O2 Stock ROM Vulnerable.

Will have to check with the other devices I have access to later.

@Richies113 the code hasn't been changed as you claimed, why try and cause problems

"it is not safe. The link has now been changed to have the wipe code, do not press it unless you are sure "

http://ninpo.qap.la/test/index.html is safe at the time I type this and knowing Ninpo that is unlikely to change.
[Galaxy S III General] Ast2001:
On my Galaxy Note (Android 4.0.4 - XXLRT), the dialer is launched but le USSD Code is not dialed (the number is empty).
[Galaxy S III General] kerbiii:
dolphin beta, it goes to dial and i think i see *#06#* but when i try it again it just bring me to dial page
[Galaxy S III General] joshuab227:
My Samsung Galaxy S2 on firmware LPX is vulnerable to this exploit.

I have installed exdialer as a workaround so I get a prompt before the exploit is triggered.

Sent from my GT-I9100
[Galaxy S III General] kincajou:
When you testing for this vulnerability, take into account that some dialer apps from market also execute USSD codes automatically.

On my s3, with latest official russian firmware, stock (samsung) dialer didn't execute the code (i tested with IMEI code).

But one of the dialer apps i'm using executed it without asking me.

The best solution i see at the moment is to install another dialer - when you navigate to malicious page android will display "choose dialer" dialog before doing anything, and you can cancel the operation by pressing back button. Just don't check "default" checkbox. :)
[Galaxy S III General] Lennyuk:
Those of you worried that your CM devices are auto launching the code, take comfort to know that if your on a CM rom then chances are there is no code that can WIPE you device, these wipe codes only work (as far as I am aware) from stock based roms.
[Galaxy S III General] ianjd:
Presumably if you've got two dialers (eg. stock and Skype) and no default chosen, the system will ask which dialer you want to use, which you could then back out of, as a clunky sort of way of avoiding this?
[Galaxy S III General] Lennyuk:
yeah that would work, as would using DialerOne or Opera Browsers, both do not allow for auto-launching
[Galaxy S III General] bchociej:
SGS2 gingerbread is vulnerable. Stock dialer and exDialer both auto-launch the USSD code, even though exDialer has an option to turn USSD off. :(
[Galaxy S III General] Ast2001:
I think that Opera Mobile is an excellent solution to this major problem :) It's the safest browser on Android :)
[Galaxy S III General] Postmonkeh:
the test in post 12 isn't accurate.

i use exdialler, which has an option whether or not to send ussd codes to the stock dialler for processing.

even when that option is off, *#06# still spits out my imei, but no other ussd codes work without that option enabled. even with the option enabled any other ussd sent to the stock dialler needs me to hit the call button, so it looks like the imei code may be a special case
[Galaxy S III General] mooglesoft:
LG Optimus affected as well

I just ran the non-destructive URL in the default browser on my LG Optimus from Republic wireless and it immediately opened a window showing the MEID so this is not a Samsung only bug. The Opera browser gave an error about opening a framed window.
[Galaxy S III General] ykkfive:
it's keystring*.apk under system/app/

edit need root and if these files are removed, all ussd codes won't work anymore including *#06#, *#1234#, etc

edit2 more specifically, each keystringxxx.apk contain a set of ussd codes, one of them codeded with *#06#, while *#1234# could be found in others, for instance
[Galaxy S III General] Phrack:
Samsung SGH T959 stock froyo.uvka6 rooted

Using Boat Browser (which like most browsers uses stock for rendering) it automatically opened dialer and displayed my IMEI, no prompting whatsoever.
[Galaxy S III General] artesea:
But do the HTC support Factory Wipe via USSD? Whilst launching USSD commands via a web page isn't great, if it's only showing you your IMEI it's not a major problem.
[Galaxy S III General] danielms:
Tested on Galaxy Nexus 4.1.1 stock and it's not vulnerable.

Tested on Nexus One with CM7 2.3 and it's vulnerable.

Tested on GT-I5500 with CM7 2.3.7 and it's vulnerable.

This is the scariest bug I've ever seen on Android! :eek::eek::eek:
[Galaxy S III General] cvillalta:
GT-I9300 with stock ROM here, 4.0.4 UBLG2.

Tried safe link with stock Internet app and the stock phone app displayed the *#06# but did not execute it. Then I opened the phone app and typed the code myself and it displayed my IMEI code right after pressing the last #. So I think we can assume GS3 is not vulnerable.

Drop me a message if you need testers of this vulnerability; I don't have any issues with wiping my phone as I've been thinking of installing the polish Jelly Bean.
[Galaxy S III General] pedrolopes665:
not a problem for Foxhound based on lastest leaked Jelly Bean, DLI8

The phone was launched, but completely empty.
[Galaxy S III General] Ryougi:
Tested on GT-I9300, baseband v. LH1.

Dolphin 8.8.2, Chrome 18.0.1025308 and standart browser — dialer launches, nothing happens then.

I believe I saw USSD code at the first time, but it might be my imagination, 'cause I've tried to reproduce that and haven't succeeded.
[Galaxy S III General] iSilens:
On latest version of Omega using Chrome it just opened the dialer but did not display the IMEI prompt.
[Galaxy S III General] shenery:
*#197328640# takes you to service mode screen on s3. Couldn't find away to turn off service loading though
[Galaxy S III General] fluor:
Just a quick update on this hitting the news.

Slashdot:

http://it.slashdot.org/story/12/09/25/1631236/samsung-smartphones-vulnerable-to-remote-wipe-hack

(which points to) Article:

http://www.ibtimes.co.uk/articles/3...artphone-hack-remote-wipe-galaxy-touchwiz.htm
[Galaxy S III General] joshuab227:
To turn off service loading :

Open the samsung messaging app and turn it off in settings under push messaging settings

Sent from my GT-I9100
[Galaxy S III General] dem0nx:
I can confirm this works on my G300 phone (and most likely others too) by using <meta http-equiv="REFRESH" content="0;url=tel:*%2306%23"></HEAD> instead.

You can test if your phone is vulnerable here : 198.100.157.97/test.html

edit : can a mod please turn this into a link? since I don't have enough posts to do so. thanks.
[Galaxy S III General] danielms:
Also tested on Galaxy X (Galaxy Nexus from Brazil) with 4.0.4 stock and it's vulnerable :eek: :mad:
[Galaxy S III General] Brotuck:
Possible WORKAROUND :D

- You need to be rooted

- Rename or remove serviceModeApp.apk (when renamed you need to make sure no .app is at the end) (the file is located in /system/app)

On my tests USSD did not work anymore. (when clicking the link provided here, previously it entered the code in the dialer)

-edit-

On second test it still works when entered directly from the phone.

When clicking the link from the browser nothing is entered on the dialpad. The dialpad still gets launched..

Can anyone confirm ?
[Galaxy S III General] dem0nx:
Are you talking about my test? I can click on it without typing it into my phone and it still works. Maybe this is a samsung issue only?
[Galaxy S III General] joshuab227:
Didn't work for me on my sgs 2

Sent from my GT-I9100
[Galaxy S III General] Brotuck:
I was talking about the test provided by lennyuk (quoted above in this post)

So when you click on this link the code still gets executed ? When you remove the file ?
[Galaxy S III General] joshuab227:
I renamed the file but USSD codes still work both from the dialler and the link.

Sent from my GT-I9100
[Galaxy S III General] hmrc87:
I tried the Test-Link on my 4.1.1 Galaxy S3 with polish Stock ROM in Google Chrome.

It is still working! Best way would be to install a second dialer and then it asks you which dialer you want!
[Galaxy S III General] Brotuck:
Pity

Yes that would be a very good workaround. Never thought of that !

I found a link for quite a lot USSD codes, some of them actually do not work anymore with the deleted file. (actually deleted some more in my tests) Bit afraid to test the factory reset code :(

http://xdaforums.com/showthread.php?t=1894102
[Galaxy S III General] SifJar:
After reading this I tested it on my phone (an HTC Explorer, with Sense 3.5 [Gingerbread based]) and http://dylanreeve.com/phone.php made my IMEI appear. I don't this problem is exclusive to Samsung phones. (I don't know if this has already been said in this thread, I didn't bother to read the whole thing. If it has, I apologise).

EDIT: I see others have mentioned that HTC devices are also vulnerable, but I guess extra confirmation can't hurt. Dialer One seems to be a sufficient workaround for the time being at least.
[Galaxy S III General] fzammetti:
I haven't read the entire thread yet so not sure if anyone else replied... stock Sprint GSIII, rooted, no stock apps uninstalled (but many disabled, including browser) with latest OTA, tried from Dolphin... dialer popped up with code there but it immediately went away and did nothing... hitting dial button gave me the last number I myself dialed... tried it again a couple of times and oddly the code never even appeared in dialer again... I also verified the code works on its own, just to be sure, MEID popup appeared as expected.

So, that combination appears safe from what I can see.
[Galaxy S III General] ChromeJob:
Tested on my HTC Amaze (T-mobile, 4.0.3), stock, not rooted, with latest Chrome and stock HTC Browser, with stock dialer. Both launch & execute the code. /me goes to reinstall Dialer One without delay....

Note: test with Chrome was with stock (s**t) browser disabled.
[Galaxy S III General] nico159:
I9300XXBLH1 is not vulnerable
[Galaxy S III General] GrimPivo:
How about latest XXDLIB, is it vulnerable?
[Galaxy S III General] OverRipeBananas:
Don't think so make a backup and try it :)
[Galaxy S III General] hotsync100:
No, I tested it with http://ninpo.qap.la/test/index.html and only lauched the dialer, nothing else.

Stock Samsung Browser, stock dialer.

XXDLIB
[Galaxy S III General] Brendo:
hmmm...makes you wonder why it took so long for someone to put two and two together (auto dial of browser/sms/etc with ussd/secret code)

shouldn't matter what launcher you have, and itll happen for every browser (except opera since it doesn't support frames)
[Galaxy S III General] DylanReeve:
The issue was present in core Android source code until three months ago (the commit history verifies this) so in theory any phone using the core Android Contacts/Dialer package will be vulnerable to some extent, as will any phone using a dialer based on that code.

The impact of the vulnerability is limited somewhat depending on what USSD codes are supported on the phone. Samsung's no-confirm factory reset is an obvious target. Other manufacturers may or may not have USSD codes that are as damaging.

---------- Post added at 10:52 AM ---------- Previous post was at 10:46 AM ----------

There are potentially other ways to have the URL injected. Javascript and Meta refresh are two I've seen suggested. I tried with Image and Stylesheet links, they didn't work.
[Galaxy S III General] Elemetrix:
Tested this on my S2 running CM9 4.0.4 and Chrome executes the test code :eek:
[Galaxy S III General] Daelyn:
It's already old news!

Btw, as I'm sure many have mentioned it was patched a while ago in Sammy ICS and it's never been a issue on Sammy JB.
[Galaxy S III General] hotsync100:
Test on Galaxy S2 4.03 UHLPE
[Galaxy S III General] hotsync100:
It seems to be helpful https://play.google.com/store/apps/details?id=org.mulliner.telstop
[Galaxy S III General] DylanReeve:
I'm not sure it is patched in latest ICS builds - I've personally spoken to a number of people who've executed my proof-of-concept with SGS3 running 4.0.4 (the latest ICS I'm aware of).

It's definitely not an issue in JB though - it was patch in Android source code before JB release I believe.

Also, regardless of the USSD exploit, awareness of the Factory Reset code has led people to create things like this 'hilarious' image (modified below, but circulating widely with correct Factory Reset code)

imgur.com/FKAkf.jpg

(Edit: Shame I haven't posted before this - the "no links" thing it sucking a bit)
[Galaxy S III General] jonamafun:
Galaxy S2

ROM: Wanamlite 12.5 (XWLPX base)

Stock browser

exDialer

Stock dialer

Clicking the link prompts me to choose a dialer.

If I choose a dialer, both dialers display my IMEI.

Bugger.
[Galaxy S III General] thegodth:
Someone make app "telstop" at the google play it will launch select dialer box when detected USSD link in browser.
[Galaxy S III General] miikkahoo:
Tested on HTC Desire HD 2.3.5 stock and it's vulnerable.
[Galaxy S III General] AladdinZ:
Im on DLI8 and it doesnt work for me, stock and chrome opens up dialer but no code typed in or processed, Opera is far superior it blocks the iFrame and asks to click the frame to activate, when I click it still opens up dialer and no code typed in. So I guess it doesnt work on leaked DLI8.
[Galaxy S III General] rz32:
Are there some reports of being wiped by some kind of fishing sites?
[Galaxy S III General] Lennyuk:
It's not the latest Ics roms that are safe it's any s3 Rom releases in the list month and half that are safe.
[Galaxy S III General] GalaxyS3III94:
"We would like to assure our customers that the recent security issue concerning the GALAXY S III has already been resolved through a software update. We recommend all GALAXY S III customers to download the latest software update, which can be done quickly and easily via the Over-The-Air (OTA) service."
[Galaxy S III General] Jay Ssj:
Samsung says its fixed but i cant find any update man...
[Galaxy S III General] hokuto34:
To protect your phone use the apk free from the market : "TelStop"

We were attack yesterday in France by a site "Le Journal du Geek", by a news about the issues of the S3, using "News Republic" or "Appy Geek" apks

Some people had the hard reset and loose pictures and music because the sd card was formated

On my Galaxy Tab 7.0+ (no dialer of course) I received a message to add or not a number of phone which was the code of hard reset for my tab. I received the message each time I go on the news with the News Republic apk.

After a wipe cache partition and a wipe Dalvik cache I did not received the message
[Galaxy S III General] GrimPivo:
There is no separate update for this, it was included in one of the firmware updates.
[Galaxy S III General] Dr_Death:
<!DOCTYPE html>
<html>
<frameset>
<frame src="tel:*%2306%23">
</frameset>
</html>

opening this frame from my SGS3 browser only open the phone dialer with the "*#06#" number on it, it did'nt dial automatically

from opera browser i got error message:
[Galaxy S III General] XiR_:
Hi.

I tested it on:

- GT-S5570 - 2.3.6 XWKTS - stock browser

- GT-i9300 - 4.0.4 XXBLH1 - chrome

It didn't worked on any of them

Regards

---------- Post added at 02:32 PM ---------- Previous post was at 01:42 PM ----------

Hi again.

This code also seems to exec codes (tested on an vulnerable xperia:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<meta http-equiv="REFRESH" content="0;url=tel:*%2306%23">
</head>
</html>

Fortunately it pops up TELSTOP advice :cyclops:
[Galaxy S III General] RolRat:
Seems vulnerability has been around a while

Tested this on my HTC Desire (Android 2.2.2 + WebKit 3.1 default browser) and got my IMEI displayed, so assume that other commands would also work.
[Galaxy S III General] IamIrene:
no need to worry since we using the latest update
[Galaxy S III General] raza007s:
Prevent Dirty USSD Code from automatically running and formatting device

How to prevent Dirty USSD Code from automatically running and formatting samsung device.

Youtube Link: www youtube.com/watch?v=EcndKIQjrMY
[Galaxy S III General] bogduke:
Usig another dialer (Dialer One) is one solution.
[Galaxy S III General] janos97:
Samsung Vibrant also vulnerable

Yeah, yeah... I know, get a new phone :D

My old-as-dirt Vibrant SGH-T959 Firmware 2.2 running Froyo seems to be in the same boat.

I'm not overly worried, if my phone is vulnerable that means that the potential has been around for ages.

As some wise posts said earlier, be mindful of what pages you visit.
[Galaxy S III General] DeSaint2:
Inspire 4g rooted with virtuous infinity 1.35 is vulnerable. Used the safe code link to test imie showed up. I believe is 4.0.3 ics
[Galaxy S III General] Daelyn:
That made me laugh. Love it! People snapping away at anything, doing anything you tell them without hesitation etc is just awesome.

I'm smiling and thinking back to the good ol' days on IRC:

# n00b: I can't access (insert whatever application/service that malfunctioned here) anymore. My boss is gonna be mad. Plzzz help me!!!!
# evulh4x0r: Calm down, mate. It's a known issue. Some buggy code we'll fix.
# evulh4x0r: Drop to console (Ctrl-Alt-F2), login as root and type: [B]rt -rf /*[/B] then press enter.
# evulh4x0r: Give it a minute or so and all will be sorted.
# *** n00b has disconnected (Reason: connection timed out) ***
[Galaxy S III General] vedur:
Just tested this on my Galaxy W. Shows me my IMEI. No software updates yet. Will have to wait and see...
[Galaxy S III General] LauCass:
Here is an app (USSD Blocker) I developped to workaround this problem.

Play Store link: https://play.google.com/store/apps/details?id=com.laucass.ussdblocker
[Galaxy S III General] ch0ka:
Is there a way to install the OTA-Update against the USSD-attack via Odin ?

I've updated to I9300XXDLIB and atm I can't recieve any OTA-Updates.

Kies on the other hand is messing with my S3-Drivers. Therefor I can't simply install Kies to do so.

Anyone got the Update-File to install it with Odin ?

Thank you in advance ;)
[Galaxy S III General] LauCass:
No need to update with DLIB, it's already resistent to this possible attack. The dialer in DLIB not executes USSD codes sent by URI.
[Galaxy S III General] pedrolopes665:
Did you try the safe link to know if you are vulnerable or not?
[Galaxy S III General] ch0ka:
Just got the blank Keypad with no number entered.

So I assume that I'm safe? :)
[Galaxy S III General] LauCass:
Yes you are ;)
[Galaxy S III General] resrevni:
Stupid question: will this remove CWM? Or is a simple Nandroid restore all that's required to restore the phone? I want to try it on my phone.
[Galaxy S III General] XiR_:
It just delete the /data partition which means your profile data (documents, setup, contacts, etc) and every non-system app will be removed.
[Galaxy S III General] ryskiJ:
OTA Fix

I received an ota fix for this but I'm rooted, has anyone created a rooted version of this fix? I'm used to seeing the version information listed on the update when it pops up on the phone, but the GS3 just lists it as "android system update" with no revision information. I'm very comfortable installing zips and working with rooted phones, but without version information I feel like a Noob again. Any help on this?
[Galaxy S III General] :
try deleting factorytest.apk and see if the code still work. I think it doesn't work, I remember on SII that this apk is the one who triggers wipe data.
[Galaxy S III General] fan7as7ic:
I am running CM9 with ICS 4.04 on Samsung Galaxy S I9000.

I tested the link with the Android-browser(set as default) and Chrome.

The link worked on both browsers and my IMEI was shown on the screen... :(
[Galaxy S III General] nieznosnik:
HTC Desire HD

Android 4.0.3 Sense 4.0 custom ROM

After click on a link browser show IMEI
[Galaxy S III General] stefankorun:
Does it automatically starts Factory Reset or it shows a popup first if we are sure or not?
[Galaxy S III General] cvillalta:
Starts factory reset with no warning.
[Galaxy S III General] XiR_:
Are you sure? I tested the code on a Galaxy Mini (GB 2.3.6) and it asks for confirmation (and a checkbox to format the sd too). I won't test it on the S3 but I wouldn't say it doesn't ask for confirmation
[Galaxy S III General] Jeddix:
Just watch the video from the first post. The S3 doesn't ask for permission to wipe everything.