News for hackers. Stuff that matters.

A comment on USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page. Parent comment

Re:USSD code to factory data reset a Galaxy S3 can be trigge... by JoeCortopassi on Tuesday September 25, 2012 @10:46AM (#4570597)
Can anyone confirm that this is not only a safe USSD, but that it triggers the exploit? I am not an owner of a S3, but would love to be able to help show some of my non-tech friends whether they are vulnerable to this or not
[ Parent | on HN ]
Re:USSD code to factory data reset a Galaxy S3 can be trigge... by preds on Tuesday September 25, 2012 @11:22AM (#4570808)
I've tested this using both a galaxy S2 and S3. On the S2 the above page is safe and triggers the exploit to view the IMEI. On the S3 it launches the dialler however, the dialler is empty and does not display the IMEI.

After investigating further, the S3 does not launch codes that begin with * # but will trigger the factory reset code which is in the format of * 1234 * 1234 #

Edit: Those with an S3 can confirm this by visiting http://no.tl/s.html in which I've embedded * 1234 * 1234 # (which is not the reset code, but is the same format)

[ Parent | on HN ]
Re:USSD code to factory data reset a Galaxy S3 can be trigge... by jrabone on Tuesday September 25, 2012 @11:02AM (#4570690)
Works on a stock Galaxy S2 with Samsung ICS, and a random stock HTC (colleague's phone). Triggers IMEI display via dialer from both Chrome and Browser :(
[ Parent | on HN ]
Re:USSD code to factory data reset a Galaxy S3 can be trigge... by weszlem on Tuesday September 25, 2012 @10:49AM (#4570618)
It looks like it does not work. It opens telephone keyboard on my S3, but except that nothing happens. EDIT: i'm using Jelly Beans
[ Parent | on HN ]
Re:USSD code to factory data reset a Galaxy S3 can be trigge... by julianz on Tuesday September 25, 2012 @07:03PM (#4573209)
It is safe, and on my stock international S3 with Chrome as the browser it opens the dialer and displays my IMEI number, as advertised.

It seems to me that there's no reason at all to allow URI's beginning with tel: as the source of a frame. Surely that's a fair limitation?

[ Parent | on HN ]
Re:USSD code to factory data reset a Galaxy S3 can be trigge... by adr_ on Tuesday September 25, 2012 @11:01PM (#4573996)
The approach of prompting the user "Do you want to call this number?" is far simpler and safer. After all, you could probably use tel: links or tel: redirects or something if the frame didn't work.
[ Parent | on HN ]
Re:USSD code to factory data reset a Galaxy S3 can be trigge... by Stratoscope on Tuesday September 25, 2012 @12:11PM (#4571113)
Confirmed on a Samsung Droid Charge running a rooted version of the stock Verizon EP4 release of Android 2.3.6 Gingerbread.
[ Parent | on HN ]