Jump to content


Photo

Orange San Diego is vulnerable to the USSD exploit. Act NOW before scrotes wipe your phone

- - - - -

  • Please log in to reply
12 replies to this topic

#1
Ribs85

Ribs85

    Regular

  • Members
  • PipPip
  • 108 posts
  • Gender:Male
  • Location:March, North Cambridgeshire
  • Devices:Nexus 4 16GB
Edit: this only affects those using Gingerbread (Android 2.3.7), Ice Cream Sandwich and above users (4.x and above) are not affected, basically, if you know you haven't updated Android on your device, you are probably vulnerable, and need to install Telstop.

There is a vulnerability in the dialer which causes the dialer to blindly run USSID codes when the browser visits a specifically crafted link. This is the same vulnerability that the Samsung Galaxy S3 has been reportedly suffering from.

To test your device:
http://dylanreeve.com/phone.php
if your phone shows an Imei number, then you're vulnerable. If you only see a code in the dialer, you're okay. My San Diego is sadly at risk. It's easy enough to fix yourself by installing another dialer (SEE EDIT BELOW FOR BETTER FIX) which will cause a choice dialog box to show, which you can then cancel. Advice is given in the above url.

I don't know if this is being used 'in the wild' yet, but you should act now before it happens.

Edit for a better fix: Install Telstop from the Google Play Market. Run the test above again, and set Telstop to be the default action when you get the choice. From now on, Telstop will 'vet' the link to make sure it's safe. If it is safe, it will proceed as normal with your normal dialler. If it thinks it's unsafe, it will warn you, so you have the choice to cancel.

Edited by Ribs85, 06 October 2012 - 05:38 PM.

  • 0

#2
jikobutsu

jikobutsu

    Hardcore

  • Members
  • PipPipPipPipPipPip
  • 3,704 posts
  • Gender:Male
  • Devices:OSD
Crap me too :angry: :(

Using touchpal dialer and it still shows IME!

Edited by jikobutsu, 28 September 2012 - 04:30 PM.

  • 0

#3
iam_smithers

iam_smithers

    Newbie

  • Members
  • Pip
  • 47 posts
  • Gender:Male
  • Devices:OMC, Orange San Diego
  • Twitter:@iam_smithers
Download an app called TelStop from off the Play Store, and that will stop the exploit from working.

  • 0
Orange Monte Carlo - Stock (refuses to root)
Orange San Diego

Previous phones: OSF, Samsung Jet, HTC Wildfire, Nokia N95, HTC S620, Motorola RAZR V3, Sharp GX10i, Nokia 3205, various other Nokias

#4
Immortal7

Immortal7

    Newbie

  • Members
  • Pip
  • 33 posts
  • Devices:Orange San Diego
I have installed tel stop, is that it? Instal and forget?

  • 0

#5
BlueMoonRising

BlueMoonRising

    Hardcore

  • Members
  • PipPipPipPipPipPip
  • 1,512 posts
  • Gender:Male
  • Location:Here, there and everywhere...
  • Devices:Orange San Diego, OSF
Cheers for the heads up. I can confirm that Go Dialer stops the exploit. You get the confirm which app to use option.

Edit :- you don't of course set the "use this option by default" tick box, but you knew that anyway didn't you?

Edited by BlueMoonRising, 29 September 2012 - 07:59 AM.

  • 0
Whoever exalts himself will be humbled, and whoever humbles himself will be exalted.

Matthew 23:12

#6
stephane75011

stephane75011

    Newbie

  • Members
  • Pip
  • 16 posts
hi i've instaled telstop and tested the link http://dylanreeve.com/phone.php
it say : telstop warning likely malicious tel:*%2306%23

is my phone still vulnerable ? sorry i'm a beginner XD

  • 0

#7
BlueMoonRising

BlueMoonRising

    Hardcore

  • Members
  • PipPipPipPipPipPip
  • 1,512 posts
  • Gender:Male
  • Location:Here, there and everywhere...
  • Devices:Orange San Diego, OSF

hi i've instaled telstop and tested the link http://dylanreeve.com/phone.php
it say : telstop warning likely malicious tel:*%2306%23

is my phone still vulnerable ? sorry i'm a beginner XD


Only if you're daft enough to click the "call" button rather than "cancel".

  • 0
Whoever exalts himself will be humbled, and whoever humbles himself will be exalted.

Matthew 23:12

#8
stephane75011

stephane75011

    Newbie

  • Members
  • Pip
  • 16 posts
Of course i cliked cancel ^^
thanks for your fast reply

  • 0

#9
xgt001

xgt001

    Regular

  • Members
  • PipPip
  • 76 posts
  • Gender:Male
  • Location:Bangalore
  • Devices:Xolo X900
Tested. The vulnerability is fixed in the latest ICS update :)

  • 0

#10
Ribs85

Ribs85

    Regular

  • Members
  • PipPip
  • 108 posts
  • Gender:Male
  • Location:March, North Cambridgeshire
  • Devices:Nexus 4 16GB
Thanks :-)

  • 0

#11
punjuk12

punjuk12

    Newbie

  • Members
  • Pip
  • 22 posts
  • Gender:Male
  • Devices:Nexus 4
Do you think that this was why they delayed the launch, so they could fix the exploit?

  • 0

#12
xgt001

xgt001

    Regular

  • Members
  • PipPip
  • 76 posts
  • Gender:Male
  • Location:Bangalore
  • Devices:Xolo X900
i think this explains the one week delay.. not too sure though

  • 0

#13
The-Bledard

The-Bledard

    Regular

  • Members
  • PipPip
  • 92 posts
  • Devices:Intel AZ210B - OSD
ICS Update from Xolo fixes the issue.

  • 0




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users