No more worries for the Samsung Galaxy S III smartphone owners while browsing the internet, as Samsung has patched the “Dirty USSD” vulnerability. Samsung dialer and Touchwiz’s stock Android browser are the only two that faced this dirty USSD vulnerability.
Ravi Borgaonkar demonstrated the way he wiped out the Samsung Galaxy SIII. He opens a website containing an HTML tag for a call function, and replaced the telephone number with the USSD code for a factory reset. USSD codes are commands that are executed by entering them in keypad. Let’s have a look to an example, one can access certain menu settings by simply dialing #*#INFO”*”. Every Samsung phones running on Touchwiz, has a unique set of USSD codes that performs various commands.
Borgaonkar also noted that the USSD code can be sent from a website or pushed to the handset by a Charlie Miller-like NFC attack, or through a malicious QR code, in which case entirely no user interface is needed.
The vulnerability was disclosed to manufacturers and carriers in June by Borgaonkar, as he had told the Security Watch, and a patch for the firmware was quickly released. But so far, only Google and certain European carriers have sent the update to device owners through OTA. Now the update to the phones has been applied by certain hardware manufacturers, which includes Samsung as well. Buying an unlocked Samsung Galaxy S III from a Samsung store today is safe.
Now the carrier-tied Samsung owners seem to be relief. Well Samsung Galaxy S III can now update their phones to Android Jelly Bean without any fear!
Via: Engadget