Update, 09/26: Samsung has told us that the latest Galaxy S3 firmware fixes this exploit. Our own testing has shown other phones, particularly Galaxy S2 models, may still be at risk, however. If you're still concerned, you can check our USSD vulnerability test to see if your phone is vulnerable.
A major security vulnerability has been discovered in some TouchWiz-based Samsung smartphones, including the Galaxy S2 and certain Galaxy S3 models on older firmware. The bug was first demonstrated days ago by security researcher Ravi Borgaonkar at the Ekoparty security conference. It involves the use of a single line of code in a malicious web page to immediately trigger a factory reset without prompting the user, or allowing them to cancel the process. Even more serious is the possibility that this could be paired with a similar glitch to render the user's SIM card inoperable. And as the malicious code is in URI form, it can also be delivered via NFC or QR code.
Our Verizon Galaxy S3 was not reset by the malicious code embedded in a web page, though we were able to trigger a reset using similar code tied to a hyperlink. Mobile dev Justin Case tells us the issue is fixed in the latest AT&T and international Galaxy S3 firmwares, though devices that have not been updated may remain vulnerable. Others have reported that devices like the Galaxy Ace and Galaxy Beam are also affected. As far as we can tell, though, the bug does not affect Samsung phones running stock Android, like the Galaxy Nexus.
The vulnerability is the result of the way the native Samsung dialer app handles USSD codes and telephone links. USSD codes are special combinations of characters that can be entered in the keypad to perform certain functions, like enabling call forwarding, or accessing hidden menus on the device. On Samsung phones, there's also a USSD code for factory resetting the phone (and presumably another for nuking your SIM). This, combined with the fact that the dialer automatically runs telephone links that are passed to it by other apps, results in a particularly nasty issue for anyone unfortunate enough to run by a malicious web page.
There are, of course, other applications of this glitch -- for example, the ability to automatically run numbers through the dialer could be used to call premium-rate phone numbers. But the fact that just visiting a web site could factory reset your phone, wipe your internal storage and nuke your SIM is a very serious issue. So we'd advise you update your software if you're running an S3, and if you're not, we'd recommend using a third-party dialer like Dialer One until all this has blown over.
We've reached out to Samsung for comment on this issue, and we'll keep you updated with any information they provide.
We may earn a commission for purchases using our links. Learn more.
Here's why Google probably won't release a 'true flagship Pixel' next March
Google is really bad at keeping secrets and one this big is no exception. Sorry, but you're going to be waiting until next October for any new "flagship" Pixel phone.
These are the very best Android TVs you can buy in 2020
Android TV is a sleek and powerful smart TV operating system, and these TVs ship with it built right in. Here are the best Android TVs you should consider and why they're so great!
Remembering Google Play Music: A mixtape for my favorite streaming service
After years of calling the service dead, it finally happened. Google's original music service has shut down, and I believe the best way to process that grief and emotion is through another age-old musical tradition: the mixtape.
Pair that snazzy Galaxy S20 FE with an awesome case to keep it protected
Samsung unveiled the Galaxy S20 FE and the device is sure to turn plenty of heads for the next few months. With stiff competition in the mid-range market, it's clear that Samsung wants to compete and the S20 FE is fantastic. If you're picking one of these awesome new devices up, make sure you pair it with a case to keep it looking awesome.