sandi garrulity: Major security vulnerability in Samsung phones could trigger factory reset via web page

Reset

A major security vulnerability has been discovered in some TouchWiz-based Samsung smartphones, including the Galaxy S3. The bug, was first demonstrated by security expert Ravi Borgaonkar at the Ekoparty security conference. It can be triggered via a single line of code in a malicious web page, immediately triggering a factory reset without prompting the user, and without allowing them a way to cancel the process. Even more serious is the possibility that this could be paired with a similar glitch that can render the user's SIM card inoperable. As the malicious code is in URL form, it can also be delivered via NFC or QR code.

We've confirmed that the malicious code does indeed trigger an immediate factory reset on our Verizon Galaxy S3 running Ice Cream Sandwich. Presumably, because the built-in browser is common to all S3 models, other versions will also be affected. Others have reported that the Galaxy S2, Galaxy Ace and Galaxy Beam are susceptible, too. As far as we can tell, though, the vulnerability does not seem to affect Samsung phones running stock Android, like the Galaxy Nexus. Similarly, Google Chrome on Samsung handsets is not susceptible to the bug, nor are other browsers we tested.

The vulnerability is the result of the way native Samsung browser and dialer app handle USSD codes and telephone links. USSD codes are special codes that can be entered in the keypad to perform certain functions, like enabling call forwarding, or accessing hidden menus on the device. On Samsung phones, there's also a USSD code for resetting the phone (and presumably another for nuking your SIM). That, combined with a glitch in the browser which allows phone numbers to be automatically dialed, results in a particularly nasty issue for anyone unfortunate enough to run by a malicious web page.

There are, of course, other applications of this glitch for vulnerability. The ability to automatically run numbers through the dialer could be used to call premium-rate phone numbers, for example.

But the fact that just visiting a web site could trigger your phone to factory reset itself, and nuke your SIM in the process, is a very serious issue. Until it's addressed, we'd recommend switching to Google Chrome immediately, and as an added precaution, disabling the built-in "Internet" app through Settings > Apps > All, if you're using an affected Samsung phone.

We've reached out to Samsung for comment on this issue, and we'll keep you updated with any information they provide.

Source: @Paul Olvia; via SlashGear