[HTC One X] j4n87:
In the www the info is spread that its possible to remote whipe devices with USSD codes. More info here:

Remote wipe attack not limited to Samsung phones, Android dialer may be to blame

and here:

http://dylanreeve.posterous.com/remote-ussd-attack

I immediatly took a look at our sense code on smali level and "fixed" that issue. I put that fixed into quotes because of follwing things:

Just because your Imei shows when executing this "security test" doesnt automatically mean your phone is vulnarable:

.method static handleChars(Landroid/content/Context;Ljava/lang/String;ZLandroid/widget/EditText;Landroid/content/res/Resources;)Z
.locals 2

invoke-static {p1}, Landroid/telephony/PhoneNumberUtils;->stripSeparators(Ljava/lang/String;)Ljava/lang/String;
move-result-object v0

invoke-static {p0, v0, p2, p4}, Lcom/android/htcdialer/widget/SpecialCharSequenceMgr;->handleIMEIDisplay(Landroid/content/Context;Ljava/lang/String;ZLandroid/content/res/Resources;)Z
move-result v1
if-nez v1, :cond_0

invoke-static {p0, v0}, Lcom/android/htcdialer/widget/SpecialCharSequenceMgr;->handlePinEntry(Landroid/content/Context;Ljava/lang/String;)Z
move-result v1

if-nez v1, :cond_0
invoke-static {p0, v0, p3, p4}, Lcom/android/htcdialer/widget/SpecialCharSequenceMgr;->handleAdnEntry(Landroid/content/Context;Ljava/lang/String;Landroid/widget/EditText;Landroid/content/res/Resources;)Z
move-result v1

if-nez v1, :cond_0
invoke-static {p0, v0}, Lcom/android/htcdialer/widget/SpecialCharSequenceMgr;->handleSecretCode(Landroid/content/Context;Ljava/lang/String;)Z
move-result v1

if-eqz v1, :cond_1

:cond_0
const/4 v1, 0x1

:goto_0
return v1

:cond_1
const/4 v1, 0x0

goto :goto_0
.end method

The handlechars method is called when text/numbers are entered via the dialpad. In this method you can see four submethods:

handleIMEIDisplay

handlePinEntry

handleAdnEntry

handleSecretCode

Means that the display of imei and executing the USSD Codes

(handleSecretCode method) is handled in different methods.

In the handleSecretCode there are a few hadcoded commands that are executed, like:

com.android.phone.NetworkModeSelectionActivity or com.android.phone.CallFeaturesSetting

which arent dangerous, there are two sendBroadcasts commands though

which are sending the command with a android.provider.Telephony.SECRET_CODE intent

One of those is limted to commands that are starting with

or ending with

. So if USSD commands are always starting with

, which is also said in the article, that one isnt dangerous.

Please read the update at the bottom.

The other one is just executed when the phonetype is 2:

const/4 v10, 0x2

const/4 v5, 0x1

.....

invoke-virtual {v3}, Landroid/telephony/TelephonyManager;->getPhoneType()I

move-result v7

The phonetype 2 is:

Phonetype 2

and the broadcast is also sent with the beggining string:

....so this broadcast shouldnt affect us and isnt dangerous as well.

No guaranties that im right with my guess. But for those that are still frightend, do the follwing:

.method static handleChars(Landroid/content/Context;Ljava/lang/String;ZLandroid/widget/EditText;Landroid/content/res/Resources;)Z
.locals 2

invoke-static {p1}, Landroid/telephony/PhoneNumberUtils;->stripSeparators(Ljava/lang/String;)Ljava/lang/String;
move-result-object v0

invoke-static {p0, v0, p2, p4}, Lcom/android/htcdialer/widget/SpecialCharSequenceMgr;->handleIMEIDisplay(Landroid/content/Context;Ljava/lang/String;ZLandroid/content/res/Resources;)Z
move-result v1
if-nez v1, :cond_0

invoke-static {p0, v0}, Lcom/android/htcdialer/widget/SpecialCharSequenceMgr;->handlePinEntry(Landroid/content/Context;Ljava/lang/String;)Z
move-result v1

if-nez v1, :cond_0
invoke-static {p0, v0, p3, p4}, Lcom/android/htcdialer/widget/SpecialCharSequenceMgr;->handleAdnEntry(Landroid/content/Context;Ljava/lang/String;Landroid/widget/EditText;Landroid/content/res/Resources;)Z
#move-result v1

#if-nez v1, :cond_0
#invoke-static {p0, v0}, Lcom/android/htcdialer/widget/SpecialCharSequenceMgr;->handleSecretCode(Landroid/content/Context;Ljava/lang/String;)Z
#move-result v1

if-eqz v1, :cond_1

:cond_0
const/4 v1, 0x1

:goto_0
return v1

:cond_1
const/4 v1, 0x0

goto :goto_0
.end method

its in the HtcDialier.apk,

android/htcdialer/widget/SpecialCharSequenceMgr.smali

this will deactivate the call for the handleSecretCode method where the possible dangerous commands could be executed.

This should work, from my interpretation of the code..I'm not responsible if it doesnt work and your phone data is still vulnarable.

If you comment out the call for the Imei window and start the security test again you will notice though that you imei shouldnt show anymore liek before.

I will attach my already modified version, should work on all 2.17 based roms...and also earlier.

Cheers, Jan

Update:

HTC secret codes for HTC One X

...would mean that if *#*#7780#*#* will work, theres a risk that this command is sent via the 1st broadcast I explained, means that there could be a danger.

But if you test it you will see that none of those codes affect us in any way.