dirty USSD hack on Androids


Globally, but depends on the phone and browser. I've a stock Orange San Francisco 2. It opens up the dialer, but doesn't dial
 
I read the browser is irrelevant as someone tested with Dolphin, Chrome and stock one, issue exists with all, so they suspect it's just the stock dialer that's the vulnerability.


I followed that test website link included in the SecurityWatch article and it shows my IMEI ... So I guess I'm open to this hack, or some forms of it anyway?


I cannot seem to set any new dialer apps as default either, option greyed out.. Not sure why that is, perhaps putting Go Launcher back on and using a Go dialer would work, but the Xperia Play is not too powerful so was trying to not use launcher anymore.


Might look into Cyanogenmod and see if that's stable enough yet with all features, last time I looked the WiFi and camera weren't working, which I require.
 
Well, technically it is... kind of... Though it affects (nearly) all browsers. Basically, if the webbrowser can't open the protocol within itself (in this case tel:), it'll generally pass it to the OS to parse the protocol. You could write a Java app to shell a "tel:*#06#" command, and I would expect it to do the exact same thing. More secure browsers would inform you that it doesn't support said protocol, but this prevents you from using URLs in webpages to kick off applications etc.


As with most things, it's basically a security/functionality tradeoff.


I need to root my phone at some point, so I can remove bloat like Google Search, Maps, and all the Orange apps
 
Ah I see what you mean. Cheers.


I'll just have to be careful what I click, even more so than usual.


I suspect when I get iCP2 I will upgrade my Xperia Play to a newer model and keep the iCP2 hooked on at all times ... A model that runs on latest version of Android and not vulnerable
 
Back
Top