Samsung "smart" phones susceptible to data wipe via malicious url

[MrColin]

http://www.theregister.co.uk/2012/09/25/samsung_flaw/

Careful what you tap on...

An enterprising hacker has demonstrated how a simple web page can reset various Samsung phones back to the state they left the factory - enabling a click, bump or text to take out a victim's mobe entirely.

The devastating flaw lies in Samsung's dialling software, triggered by the tel protocol in a URL. It isn't applicable to all the company's Android handsets, but those that are vulnerable can have their PIN changed or be wiped completely just by visiting a web page or snapping a bad QR code, or even bonking up against the wrong wireless NFC tag.

The tel protocol is generally used with phone numbers to provide clickable "call me" links on websites: tapping on the hyperlink in the handset's web browser opens up the dialling software and calls the number contained in the link. Such calls aren't made until the fandroid presses a "dial" button, so security is maintained - but some numbers don't require "dial" to be pressed, and it's those which are exploited in this attack.

Ouch!

 

[Auric]

Where "devastating" is defined as overcome by simply restoring from backup.

 

[MrColin]

Where "devastating" is defined as overcome by simply restoring from backup.

So just make sure you back up your phone before visiting any links and you'll be fine.

 

[zerogear]

Latest version of SGS3 firmware/ota has already been fixed of this problem. (I9300) Not sure about other models though.

This 'exploit' basically makes the dialer pre-input a USSD code.

 

[Auric]

So just make sure you back up your phone before visiting any links and you'll be fine.

"Ehh". Storage is prone to loss from various causes so not unlike a PC, backup is basic procedure.

Though to be fair it was the flaw described as devastating and not the resulting reset.