Android's
"dirty USSD" exploit allows hackers to wipe your entire phone, and all
you have to do is click the wrong link. Here's how it works, and how you
can protect yourself.
The Android ecosystem got a jolt yesterday with the revelation that
simple links — something you might merely open online — could trigger a
complete wipe of some Android devices. Researcher Ravi Borgaonkar
revealed the exploit, and (of course) the device that got all the
attention was the top-selling Samsung Galaxy S III. Samsung has
already issued a patch for the vulnerability.
But it turns out lots of other Android phones are apparently vulnerable
to the same exploit. The root of the problem lies in the standard
Android dialer; even though Google patched the problem months ago, that
fix may not have made it out to current Android devices, and many will
never will receive it.
There’s cause for concern, but not outright panic. Here’s how the
exploit works, and some tips for how Android users can protect
themselves.
What’s USSD?
The new Android exploit relies on a protocol built into most phones
called USSD, or Unstructured Supplementary Service Data. Think of USSD a
bit like a text-messaging protocol, but instead of being used to
transmit short messages between phone users, it’s intended to let both
device makers and mobile carriers build add-on services for their phones
and network. Like text messages, USSD messages are short (up to 182
characters), but unlike text messages, they can actually open a two-way
network connection between a device and a network endpoint, so they’re
more responsive than SMS messages and can be used for real-time
interactive services.
Folks who rely on pre-paid phone services have probably used USSD
services to check their remaining prepaid balance. For instance,
T-Mobile pre-paid users dial
#999# to see their balance.
That’s USSD. However, USSD can support more sophisticated applications
like mobile payment services — in fact, that’s one reason
some developing nations are further along with mobile payments than North America and Europe.
Other services have built social networking functions for Twitter,
Facebook, and other social-networking services, although those are
typically only seen on feature phones in emerging markets.
USSD is implemented in GSM phones (the standard users by carriers like AT&T and T-Mobile), but that does
not
mean you’re off the hook if you use a phone with a CDMA operator like
Verizon or Sprint. Many USSD codes trigger actions on the local device
and do
not require a mobile operator that supports USSD. Many phones built for CDMA networks will respond to those codes.
USSD is, by definition, unstructured, which means phones don’t
support the same sets of USSD codes. Different manufacturers and mobile
operators have largely followed their own instincts on how they develop
USSD features and services. A USSD code that does one thing on a Nokia
phone may do something else entirely on an LG phone — or nothing at all.
However, one commonly-used code is
*#06#, which often displays a device’s unique IMEI (International Mobile Equipment Identity) number.
Tel: me a story
USSD is nothing new, and isn’t some new threat to Android. What Ravi
Borgaonkar demonstrated was a stunningly simple combination of USSD
codes with the “tel:” URL protocol. You’ve seen URL protocols in things
like Web links and email addresses — those are
http: and
mailto:, respectively. However, there are hundreds of other URL protocols.
The
tel: protocol enables users to dial a telephone number from a Web browser:
tel:555-1212 should connect most Americans to nationwide directory assistance, for example. Borgaonkar’s demonstration combined the
tel:
URL scheme with a particular USSD code that — you guessed it — can
perform a factory reset of some Android devices. Borgaonkar dubbed this
factory reset USSD the “Samsung tragedy,” in part because Samsung’s
implementation of its wipe command involves no user interaction. Some
other devices have similar factory reset commands, but at least require
manual confirmation from the user.
In theory, all an attacker would need to do is embed a malicious URL
in a website, and any vulnerable device that loads that page would be
reset to factory defaults. (In some cases, this even includes wiping out
the SIM card.)
It’s tempting to think this is just a vulnerability with a phone’s
built-in browser, but in Android’s case it’s really in the default
Android dialer: Borgaonkar also demonstrated ways to execute the USSD
reset using QR Codes, WAP Push SMS messages, and (in the case of the
Galaxy S III) even via NFC. There’s no need to get a browser involved.
Any app that can dial a number on an Android phone can potentially
trigger a USSD command.
Not the end of the world?
The vulnerability might seem pretty dire, but Hendrik Pilz and Andreas Marx at independent German security firm firm
AV-TEST note the vulnerability probably isn’t very appealing to cybercriminals.
“We think that the majority of malware writers might not be
interested in exploiting the vulnerability, as it won’t make sense to
wipe a phone or lock out users,” they said in a statement via email.
“Malware tries to stay silent on your system, so your mobile device can
be used for some kind of malicious, possibly criminal activities. This
will only work with running and working systems.”
Is your phone vulnerable?
So far, only selected Samsung phones have been demonstrated to have a
USSD code that performs a factory reset. However, that doesn’t mean
phones from other vendors
don’t have similar codes that
attackers could use to wipe phones, cause data loss, or potentially even
sign users up for expensive services. That, after all, is a favorite
pastime of Android malware authors.
Unfortunately, there’s no sure-fire way to determine if an Android phone is vulnerable to a USSD-based attack, but users
can check if their dialers are vulnerable.
The following devices have been confirmed to be vulnerable to dialing USSD codes from a Web page:
- HTC Desire HD
- HTC Desire Z
- HTC Legend
- HTC One W
- HTC One X
- HTC Sensation (XE) (running Android 4.0.3)
- Huawei Ideos
- Motorola Atrix 4G
- Motorola Milestone
- Motorola Razr (running Android 2.3.6)
- Samsung Galaxy Ace, Beam and S Advance
- Samsung Galaxy S2
- Samsung Galaxy S3 (running Android 4.0.4)
Again, this does
not mean all these devices can be wiped via
USSD. So far, only selected Samsung phones have been confirmed to be
wipeable via a USSD command. Many other devices may dial USSD commands —
and there are even reports some devices running Symbian and Samsung’s
bada operating system will dial USSD commands using
tel: URLs.
Borgaonkar offered a test page that uses an iframe to try to convince a browser to dial a USSD code — in this case, the
*#06# that displays a device’s IMEI number:
http://www.isk.kth.se/~rbbo/testussd.html
Self-described geek Dylan Reeve also put together a quick test page
that can reveal whether your Android dialer processes USSD codes, using
the same
*#06# USSD code:
WinPoker, a new skin on the iPoker Network officially launching this
week, will debut with a unique feature: support for mobile devices.