The great combined Smrtphone OS thread - Page 292

sky_ · 26th September 2012, 13:19

What a horrible, nasty bug. Tested on Jellybean, not vulnerable as said above.

http://dylanreeve.posterous.com/remote-ussd-attack

Install TelStop, which adds a handler for the "tel:" URI. If that URI is used, android will prompt what app to use (which in itself is pretty good).

Or install a new dialler like Dialler One (not vulnerable to this).

Test link to show imei: tel:*%2306%23
Dialler will always launch. If you're vulnerable, you'll see your imei though.

TnT · 26th September 2012, 13:22

So basically the fix is either have Jellybean or install a different dialler? I'm not sure why I care anymore.

Spink · 26th September 2012, 13:26

Quote:

Originally Posted by p01s0n

um android is the OS for that demographic where 'poors' overlaps with 'idiots'

I can confirm this is true, I saw an infographic about it.

p01s0n · 26th September 2012, 13:30

Quote:

Originally Posted by sky_

What a horrible, nasty bug. Tested on Jellybean, not vulnerable as said above.

http://dylanreeve.posterous.com/remote-ussd-attack

Install TelStop, which adds a handler for the "tel:" URI. If that URI is used, android will prompt what app to use (which in itself is pretty good).

Or install a new dialler like Dialler One (not vulnerable to this).

Test link to show imei: tel:*%2306%23
Dialler will always launch. If you're vulnerable, you'll see your imei though.

what about this loller?
https://github.com/timrogers/rack-galaxy-s3-exploit

Quote:

rack-galaxy-s3-exploit is a Rack middleware which adds the code on every page to activate an exploit for (at least some) Samsung Galaxy S3 devices (and perhaps others) which causes them to be returned to factory settings.

sky_ · 26th September 2012, 13:35

Quote:

Originally Posted by p01s0n

what about this loller?
https://github.com/timrogers/rack-galaxy-s3-exploit

What about it?

sky_ · 26th September 2012, 13:36

Quote:

Originally Posted by TnT

So basically the fix is either have Jellybean or install a different dialler? I'm not sure why I care anymore.

Oh fuck yeah. It's damn horrible.

p01s0n · 26th September 2012, 13:38

Quote:

Originally Posted by sky_

What about it?

can you pls confirm/deny that it is in fact as hilarious as it sounds on paper?

sky_ · 26th September 2012, 13:47

I don't understand? It's just a very silly way to do the attack?

p01s0n · 26th September 2012, 13:48

you used to be cool

sidbo · 26th September 2012, 14:11

Quote:

Originally Posted by sky_

What a horrible, nasty bug. Tested on Jellybean, not vulnerable as said above.

http://dylanreeve.posterous.com/remote-ussd-attack

Install TelStop, which adds a handler for the "tel:" URI. If that URI is used, android will prompt what app to use (which in itself is pretty good).

Or install a new dialler like Dialler One (not vulnerable to this).

Test link to show imei: tel:*%2306%23
Dialler will always launch. If you're vulnerable, you'll see your imei though.

I just emailed this to myself, and clicked the link on my phone (HTC One X) and it displayed the IMEI... that means that this is not just Samsung specific? Or is it the USSD code that's specific to the S3 devices?

[fake edit] never mind, the link above confirms the HTC is also vulnerable, joy.

sky_ · 26th September 2012, 14:12

Awww, sorry =)

sky_ · 26th September 2012, 14:13

Quote:

Originally Posted by sidbo

I just emailed this to myself, and clicked the link on my phone (HTC One X) and it displayed the IMEI... that means that this is not just Samsung specific?

Sorry, should have mentioned - this ain't samsung specific. Many, many android devices will be vulnerable to this. It's all about dodgy dialler app code. If it accepts USSD codes from a remote source, it's screwed. Seen another HTC which we think is vulnerable too..

Also note: the workarounds work for remote exploitation via tel: - but it can be triggered via emergency dialler. That's fixed in JellyBean too...

Bring up emergency dialler and put in the code to trigger imei. If it pops up, don't leave you phone near drunken geeks.

sky_ · 26th September 2012, 14:26

Sidbo - does this link trigger it too?
http://dylanreeve.com/phone.php

sky_ · 26th September 2012, 14:59

Edit: nm

BaM · 26th September 2012, 15:02

sidbo · 26th September 2012, 15:04

Quote:

Originally Posted by sky_

Sidbo - does this link trigger it too?
http://dylanreeve.com/phone.php

Yep. Popped up the IMEI (once I told it to use the standard dialer to action the link).

sky_ · 26th September 2012, 15:16

Ah bugger.

BaM: fucking love it =)

Savage · 26th September 2012, 15:23

(BaM) ^ awesome

Must resist urge to post that on Facebook

blur^ · 26th September 2012, 15:29

if you run chrome you are safe, the TEL uri is not handled by chrome

Cyberbob · 26th September 2012, 15:31

Quote:

Originally Posted by Savage

Must resist urge to post that on Facebook

Done. awaiting replies.

sky_ · 26th September 2012, 15:35

Quote:

Originally Posted by blur^

if you run chrome you are safe, the TEL uri is not handled by chrome

Firefox supports it =/

You can trigger it via other means including SMS (WAP PUSH message), QR code (as nicely demonstrated above), NFC... bleh...

blur^ · 26th September 2012, 15:38

yeah it looks like it depends on your phone/dialer
my s3 w/ chrome seems to be ok, have tried a bunch of the test sites in the xda thread

blur^ · 26th September 2012, 16:04

if your phone is rooted you can remove keystring*.apk from system/app/
will stop the codes from executing but then you cant use any other codes

Ab · 26th September 2012, 16:20

Jesus what a clusterfuck.

blur^ · 26th September 2012, 16:32

the guy who found the vulnerability apparently told samsung 3 months ago
so 4.0.4 ont he s3 appears to have been patched

didnt tell anyone else though. gg

Cyberbob · 26th September 2012, 16:35

<AndroidVersionsInTheWildPieGraph.jpg>

blur^ · 26th September 2012, 16:40

a lot of the blame is with the user

if you are going to use an old unpatched operating system on the tubes
you are going to have a bad time

p01s0n · 26th September 2012, 16:42

Quote:

Originally Posted by blur^

a lot of the blame is with the user

if you are going to use an old unpatched operating system on the tubes
you are going to have a bad time

this is priceless

Trigger · 26th September 2012, 16:42

hey guys don't forget about BlackBerry

here is a song
http://www.youtube.com/watch?v=WlsahuZ_4oM

Rince · 26th September 2012, 16:43

Quote:

Originally Posted by sky_

What a horrible, nasty bug. Tested on Jellybean, not vulnerable as said above.

http://dylanreeve.posterous.com/remote-ussd-attack

Install TelStop, which adds a handler for the "tel:" URI. If that URI is used, android will prompt what app to use (which in itself is pretty good).

Or install a new dialler like Dialler One (not vulnerable to this).

Test link to show imei: tel:*%2306%23
Dialler will always launch. If you're vulnerable, you'll see your imei though.

First time I clicked on it, just got the dialer, second time for the imei. Fuck

Ab · 26th September 2012, 16:45

Right, off to kinkos to print a few thousand QR code stickers and go wild, brb

blur^ · 26th September 2012, 16:46

Quote:

Originally Posted by p01s0n

this is priceless

because im a droid user and i admit there are idiots out there that use droids?

i like taking snipes at apple as much as anyone, but the world is full of stupid people regardless of what brand they buy

Rince · 26th September 2012, 16:48

Telstop seems to stop it. Thanks

p01s0n · 26th September 2012, 16:48

Quote:

Originally Posted by blur^

because im a droid user and i admit there are idiots out there that use droids?

this is a pretty redundant statement because the chart clearly shows that only idiots use droids

Cyberbob · 26th September 2012, 16:49

Geniune question from a non droid user: Is every affected device eligible for a 4.0.4 upgrade? Or are some screwed.

Saladin · 26th September 2012, 16:50

Quote:

Originally Posted by p01s0n

only idiots use droids

In before someone mentions the Woz.

blur^ · 26th September 2012, 16:52

Quote:

Originally Posted by p01s0n

this is a pretty redundant statement because the chart clearly shows that only idiots use droids

you are a redundant statement

Quote:

Originally Posted by Cyberbob

Geniune question from a non droid user: Is every affected device eligible for a 4.0.4 upgrade? Or are some screwed.

pretty sure everyone can get it, if not directly from their maker they can flash it themselves

BaM · 26th September 2012, 16:57

Cool, because everyone is going to know or care enough to do that.

End result: there are going to be a fuckload of pissed off Android users out there.

Saladin · 26th September 2012, 16:59

Quote:

Originally Posted by blur^

pretty sure everyone can get it, if not directly from their maker they can flash it themselves

Let's pick a random droid phone.. Huawei Ideos X5 - was promoted fairly heavily on 2degrees last year.

Right, let's see if you can flash one to JB.

http://forum.xda-developers.com/show....php?t=1742757

Quote:

What Works:

ADB
Touchscreen(thanks dzo)
Hardware Acceleration
Notification LED
SMS
Accelerometer
Charging
Maybe More

What Doesn't work:

Wi-Fi/Bluetooth
Audio
Camera
MTP
Storage
Maybe more

Oh.

p01s0n · 26th September 2012, 17:00

Quote:

Originally Posted by Saladin

In before someone mentions the Woz.

woz is a huge idiot lol, he's like king of the idiots.

26th September 2012, 16:42	#11669
Trigger Laserman	hey guys don't forget about BlackBerry here is a song http://www.youtube.com/watch?v=WlsahuZ_4oM __________________ Are you slow? The alleged lie that you might have heard, me saying, allagedly moments ago... That's a parasite that lives in my neck.

26th September 2012, 16:48	#11673
Rince SLUTS!!!!!!!	Telstop seems to stop it. Thanks __________________ Slow internet is worse than no internet. It's like putting your penis in once and then being required to make out for 2 hours --Matt "The Oatmeal" Inman

26th September 2012, 13:19	#11641
sky_	What a horrible, nasty bug. Tested on Jellybean, not vulnerable as said above. http://dylanreeve.posterous.com/remote-ussd-attack Install TelStop, which adds a handler for the "tel:" URI. If that URI is used, android will prompt what app to use (which in itself is pretty good). Or install a new dialler like Dialler One (not vulnerable to this). Test link to show imei: tel:%2306%23 Dialler will always launch. If you're vulnerable, you'll see your imei though. Last edited by sky_ : 26th September 2012 at 13:22.*

26th September 2012, 13:22	#11642
TnT	So basically the fix is either have Jellybean or install a different dialler? I'm not sure why I care anymore.

26th September 2012, 13:47	#11648
sky_	I don't understand? It's just a very silly way to do the attack?

26th September 2012, 13:48	#11649
p01s0n	you used to be cool __________________ \|\|hellameke.com Image host of NZG pro's\|\|Tu meke Tu much\|\|

26th September 2012, 14:26	#11653
sky_	Sidbo - does this link trigger it too? http://dylanreeve.com/phone.php

26th September 2012, 15:16	#11657
sky_	Ah bugger. BaM: fucking love it =)

26th September 2012, 15:23	#11658
Savage	(BaM) ^ awesome Must resist urge to post that on Facebook Last edited by Savage : 26th September 2012 at 15:26.

26th September 2012, 15:29	#11659
blur^	if you run chrome you are safe, the TEL uri is not handled by chrome

26th September 2012, 15:38	#11662
blur^	yeah it looks like it depends on your phone/dialer my s3 w/ chrome seems to be ok, have tried a bunch of the test sites in the xda thread

26th September 2012, 16:04	#11663
blur^	if your phone is rooted you can remove keystring*.apk from system/app/ will stop the codes from executing but then you cant use any other codes

26th September 2012, 16:20	#11664
Ab A mariachi ogre snorkel	Jesus what a clusterfuck.

26th September 2012, 16:32	#11665
blur^	the guy who found the vulnerability apparently told samsung 3 months ago so 4.0.4 ont he s3 appears to have been patched didnt tell anyone else though. gg

26th September 2012, 16:35	#11666
Cyberbob	<AndroidVersionsInTheWildPieGraph.jpg> __________________ ɹǝʌo sᴉ ǝɯɐƃ ʎɥʇ

26th September 2012, 16:40	#11667
blur^	a lot of the blame is with the user if you are going to use an old unpatched operating system on the tubes you are going to have a bad time

26th September 2012, 16:45	#11671
Ab A mariachi ogre snorkel	Right, off to kinkos to print a few thousand QR code stickers and go wild, brb

26th September 2012, 16:49	#11675
Cyberbob	Geniune question from a non droid user: Is every affected device eligible for a 4.0.4 upgrade? Or are some screwed. __________________ ɹǝʌo sᴉ ǝɯɐƃ ʎɥʇ

26th September 2012, 16:57	#11678
BaM Freeloader	Cool, because everyone is going to know or care enough to do that. End result: there are going to be a fuckload of pissed off Android users out there.