[Androidme2018]- Yesterday, an Android security problem was discovered which has turned out to be more serious than we had originally thought. Not only Samsung but a number of other Android smartphone manufacturers are affected. Here, we give you an overview of the situation.
Patient 0:
On the 21st of September, the Indian developer Ravi Borgaonkar held a security conference in Buenos Airies, titled "the Abuse of USSD codes on mobile networks." To demonstrate the serious security problems associated with USSD codes, he wiped a Galaxy S2, simply by clicking on a link on a malicious website.
Link to Video
How did it happen?
Borgaonkar entered the USSD code *2767*3855# on his Galaxy S2, which reset his phone to its factory settings; a process which is performed differently on different Android models. On some, like the HTC One X, the device asks you whether or not you want to delete all your apps and restore your phone to its factory settings or if you want to do that AND delete all your pictures, music, and personal files saved to the SD card. On the Galaxy S3, the process (just) deletes all your apps, system application data and settings.
The factory reset page on the Galaxy S3 (left) and HTC One X (right). Notice the HTC One X offers users the ability to also erase the SD card.
What is a USSD Code Anyway?
A USSD code is entered into phones to perform actions. They are mainly used by network operators to provide customers with easy access to pre-configured services, including call-forwarding, balance inquiries and multiple SIM functions. These shortcuts are also used by many manufacturers to control system functions. But they are mainly intended for internal use and thus rarely communicated to the user.
Where is the Security Hole?
Normally, when entering a USSD code, you must enter it into the keypad of your phone and tap the call button. But Borgaonkar's code skips this step and automatically runs in the background, without the user noticing anything.
The USSD code links the browser to the phone app. That means: When I click on a telephone number in my browser, the phone App opens with the previously clicked number and I only have to hit the "call" button.
The HTML code to execute such an action is as follows:
Click here to call us directly
Now, I only need to replace the "xyz" with the USSD code *2767*3855#, and the HTML code becomes far more nefarious:
Click here to call us directly
The command above assumes that the user clicks on the link, so that the phone app is launched. Borgaonkar has embedded this command in a frame, which looks like this:
Patient 0:
On the 21st of September, the Indian developer Ravi Borgaonkar held a security conference in Buenos Airies, titled "the Abuse of USSD codes on mobile networks." To demonstrate the serious security problems associated with USSD codes, he wiped a Galaxy S2, simply by clicking on a link on a malicious website.
Link to Video
How did it happen?
Borgaonkar entered the USSD code *2767*3855# on his Galaxy S2, which reset his phone to its factory settings; a process which is performed differently on different Android models. On some, like the HTC One X, the device asks you whether or not you want to delete all your apps and restore your phone to its factory settings or if you want to do that AND delete all your pictures, music, and personal files saved to the SD card. On the Galaxy S3, the process (just) deletes all your apps, system application data and settings.
The factory reset page on the Galaxy S3 (left) and HTC One X (right). Notice the HTC One X offers users the ability to also erase the SD card.
What is a USSD Code Anyway?
A USSD code is entered into phones to perform actions. They are mainly used by network operators to provide customers with easy access to pre-configured services, including call-forwarding, balance inquiries and multiple SIM functions. These shortcuts are also used by many manufacturers to control system functions. But they are mainly intended for internal use and thus rarely communicated to the user.
Where is the Security Hole?
Normally, when entering a USSD code, you must enter it into the keypad of your phone and tap the call button. But Borgaonkar's code skips this step and automatically runs in the background, without the user noticing anything.
The USSD code links the browser to the phone app. That means: When I click on a telephone number in my browser, the phone App opens with the previously clicked number and I only have to hit the "call" button.
The HTML code to execute such an action is as follows:
Click here to call us directly
Now, I only need to replace the "xyz" with the USSD code *2767*3855#, and the HTML code becomes far more nefarious:
Click here to call us directly
The command above assumes that the user clicks on the link, so that the phone app is launched. Borgaonkar has embedded this command in a frame, which looks like this:
0 Response to "Best Security Briefing: All the Information We Know About the USSD Exploit -Androidme2018"
Post a Comment