Guest Davidoff59 Posted September 26, 2012 Report Share Posted September 26, 2012 is that on stock dialler with no other dialler installed? B940 has bugs with wifi doesn't it amongst other bugs? Link to comment Share on other sites More sharing options...
Guest Redflake Posted September 26, 2012 Report Share Posted September 26, 2012 Stock dialer no other dialer installed. No wifi or any other bugs as far as I'm concerned and seems to be the fastest of the ICS roms. Link to comment Share on other sites More sharing options...
Guest fr0do Posted September 26, 2012 Report Share Posted September 26, 2012 I'm on stock B940, full update. Failed test. (no issues with wifi here either) Link to comment Share on other sites More sharing options...
Guest Al_1604 Posted September 26, 2012 Report Share Posted September 26, 2012 Would be helpful if someone on unmodified b892 would post a photo (not a screenshot) showing both the G300 and the effect of visiting the proof of concept url. You'll need to blank out part of your imei in any uploaded pic. Sorry, can't post a photo of it but can definitely confirm 100% that totally stock unmodified B892 displays the IMEI immediately on visiting the proof of concept site. Link to comment Share on other sites More sharing options...
Guest bryfly Posted September 26, 2012 Report Share Posted September 26, 2012 (edited) Answered my own question.......deleted Edited September 26, 2012 by bryfly Link to comment Share on other sites More sharing options...
Guest Colossae3.23 Posted September 26, 2012 Report Share Posted September 26, 2012 (edited) I thought the point of the alternate dialler was to intercept remote access, which installing any extra dialler seems to do... instead of the code being automatically executed, you're prompted to choose a program to run it. Which for users is a simple choice if they didn't intend to run the dialler code. Did I get that wrong then? I thought that too at first but once I choose the dialer (in the pop up) it still gave me my imei, which means that an USSD attack would be successful. What you want to happen is for the USSD code to show on dialer, queued up sand ready to dial. That means it's not dialling automatically. So then you would just delete (backspace) the code out of the dialer. That's how I understand it... Edited September 26, 2012 by Colossae3.23 Link to comment Share on other sites More sharing options...
Guest fr0do Posted September 26, 2012 Report Share Posted September 26, 2012 I thought that too at first but once I choose the dialer (in the pop up) it still gave me my imei, which means that an USSD attack would be successful. What you want to happen is for the USSD code to show on dialer, queued up sand ready to dial. That means it's not dialling automatically. So then you would just delete (backspace) the code out of the dialer. That's how I understand it...Why the he'll would you choose the dialler if you didn't mean to launch it but some website had?? Forcing the choice is your 1st line of defence surely? Link to comment Share on other sites More sharing options...
Guest b4da55 Posted September 26, 2012 Report Share Posted September 26, 2012 So viber or anything that forces the option will alert you Link to comment Share on other sites More sharing options...
Guest Colossae3.23 Posted September 26, 2012 Report Share Posted September 26, 2012 (edited) You mean the pop up to choose which dialer, right? Yeah, I think you are right in that regard, because you could just back out of that choice. But, when I was testing it I made exdialer default, and then retested and it automatically showed the imei. So, that was no good. So, to do what you are saying, you'd have to not make any dialer default, so you always get the choice. I get that, but I don't think that's what those articles were saying. See, the way its working for me now, is it doesn't dial that test code, automatically, even if I make one of them default. The USSD code just sits there on the dialer waiting for you to push call (just like you dialled a number by hand). So you just delete it. But all that aside, that app that Cyda posted does the trick too, and it suggests whether the code may be malicous or not. That's a nice thing to have :) PS: @ frodo, I installed 940 with cwm, I wonder if that makes any difference? @ redflake how did you install it? Cause neither of us have the auto dial issue Edited September 26, 2012 by Colossae3.23 Link to comment Share on other sites More sharing options...
Guest Redflake Posted September 26, 2012 Report Share Posted September 26, 2012 (edited) I thought that too at first but once I choose the dialer (in the pop up) it still gave me my imei, which means that an USSD attack would be successful. What you want to happen is for the USSD code to show on dialer, queued up sand ready to dial. That means it's not dialling automatically. So then you would just delete (backspace) the code out of the dialer. That's how I understand it... Thats what i get with the stock dialer on stock B940. CWM install. I don't have the auto dial issue as seen below. Edited September 26, 2012 by Redflake Link to comment Share on other sites More sharing options...
Guest Colossae3.23 Posted September 26, 2012 Report Share Posted September 26, 2012 Thats what i get with the stock dialer on stock B940. yeah that's it. That's what happens to me now. But, when I tried exdialer this morning, it showed the imei number automatically. Now after uninstalling that and using the stock dialer, this is what I get too.How did you install 940? Did you flash the zip in cwm, or did you do the full update method? Link to comment Share on other sites More sharing options...
Guest Hogweed Posted September 26, 2012 Report Share Posted September 26, 2012 dialer one will not execute the code unprompted. Link to comment Share on other sites More sharing options...
Guest Colossae3.23 Posted September 26, 2012 Report Share Posted September 26, 2012 dialer one will not execute the code unprompted. yeah I got that with dialer one, also. My thing was I jumped the gun last night not really understanding it all, and went loaded both those 3rd party dialers. Thing is, it looks like my stock dialer never had the auto dial issue in the first place, just like redflake is saying. Link to comment Share on other sites More sharing options...
Guest Redflake Posted September 26, 2012 Report Share Posted September 26, 2012 yeah that's it. That's what happens to me now. But, when I tried exdialer this morning, it showed the imei number automatically. Now after uninstalling that and using the stock dialer, this is what I get too.How did you install 940? Did you flash the zip in cwm, or did you do the full update method? I installed B940 with CWM. Think I used B934 update app when I first went to ICS. Link to comment Share on other sites More sharing options...
Guest fr0do Posted September 26, 2012 Report Share Posted September 26, 2012 (edited) I think I remember 934 waiting for me to confirm dialling. What base did you cwm over Colossae3.23 I have cyda's linked app too now Edited September 26, 2012 by fr0do Link to comment Share on other sites More sharing options...
Guest Colossae3.23 Posted September 27, 2012 Report Share Posted September 27, 2012 (edited) I think I remember 934 waiting for me to confirm dialling. What base did you cwm over Colossae3.23 I have cyda's linked app too now I think its 926, that's what I jumped to, from AtomicMod Edit: sorry just re-read that. I was on Infusion before the cwm to 940. Pretty sure that was the 934 variety of Infusion Edited September 27, 2012 by Colossae3.23 Link to comment Share on other sites More sharing options...
Guest Dazzozo Posted September 27, 2012 Report Share Posted September 27, 2012 Stock ICS is not vulnerable. You don't need the protection other devices are employing. Link to comment Share on other sites More sharing options...
Guest tcpaulh Posted September 27, 2012 Report Share Posted September 27, 2012 It'll show imei (for example) in ics but I haven't found any destructive codes Anyone else? Link to comment Share on other sites More sharing options...
Guest CIM1 Posted September 27, 2012 Report Share Posted September 27, 2012 How do you get a list of implemented USSD codes for a specific phone ROM? Link to comment Share on other sites More sharing options...
Guest tcpaulh Posted September 27, 2012 Report Share Posted September 27, 2012 Top down from Google Bottom up, don't know Link to comment Share on other sites More sharing options...
Guest bryfly Posted September 28, 2012 Report Share Posted September 28, 2012 Now it has quietened down a bit, what is the best thing to do for us less expierenced users….. 1) Install telstop. 2) Install dialer one. 3) Its ok, do nothing. Link to comment Share on other sites More sharing options...
Guest wrtease Posted September 28, 2012 Report Share Posted September 28, 2012 well its just a case of doing nothing as i will . Link to comment Share on other sites More sharing options...
Guest tcpaulh Posted September 28, 2012 Report Share Posted September 28, 2012 http://m.itworld.com/security/298784/ussd-attack-not-limited-samsung-android-devices-can-also-kill-sim-cards?page=0,1 Link to comment Share on other sites More sharing options...
Guest Hogweed Posted September 28, 2012 Report Share Posted September 28, 2012 http://m.itworld.com...-cards?page=0,1 Summary: Almost all Android phones have a code used for changing the SIM card PIN. Call this several times with an invalid PUK code and it will lock the SIM permanently. The multiple calls can all be embedded on the one web page. Personally I've discovered I really like Dialer One. I changed settings for colour scheme and screen layouts and I think it is much better than the stock dialler. Really Like the old school (T9) way of entering a name from your contact list by just entering the first few letters on the NUMERIC keypad. Much faster for me anyway. Set as my default for now. Link to comment Share on other sites More sharing options...
Guest tcpaulh Posted September 28, 2012 Report Share Posted September 28, 2012 The guy who found the exploit has published more details :- http://www.isk.kth.se/~rbbo/ussdvul.html Upshot: It seems all android phones can have their sim cards deactivated permanently in a couple of seconds by visiting a malicious url Link to comment Share on other sites More sharing options...
Recommended Posts
Please sign in to comment
You will be able to leave a comment after signing in
Sign In Now