karit: I happens on my Nexus One with 2.3.6.

https://dylanreeve.posterous.com/remote-ussd-attack has a link to http://dylanreeve.com/phone.php which will utilise the same security flaw but show you the IMEI number instead of wiping your phone. This will indicate if you are at risk when you visit that URL on your phone.

Current mitigation is to install an alternate dial e.g. https://play.google.com/store/apps/details?id=kz.mek.DialerOne is suggested in link above and is what I currently have in place as a mitigation strategy.

Now just waiting for the QR codes and dodgy links to be placed around the place and start wiping phones. Hopefully this is exploited heavily and in the media so the Cellcos and Google start doing updates. Even minor patches e.g. 2.3.7 for instance. From what I read they fix/patch was written three months ago.............

juha: I've got to say given the number of affected devices - and we don't yet know what a creative attacker can do with USSD codes that vary from device to device - the industry response has been remarkably casual. Good on Samsung for stepping up and issuing patches, but what about the rest?

johnr: If anyone is that worried about it just do a backup of the data on your handset

johnr: If anyone is that worried about it just do a backup of the data on your handset

kawaii:

johnr: If anyone is that worried about it just do a backup of the data on your handset

Why don't' the carriers pull finger and approve the fix straight away? if the confidence in Samsung releasing an update that doesn't screw things up is that low then maybe questions should be asked whether the carriers should sell Samsung in the first place given the lack of confidence said organisations have in Samsung's own QA process.

old3eyes:

kawaii:

johnr: If anyone is that worried about it just do a backup of the data on your handset

Why don't' the carriers pull finger and approve the fix straight away? if the confidence in Samsung releasing an update that doesn't screw things up is that low then maybe questions should be asked whether the carriers should sell Samsung in the first place given the lack of confidence said organisations have in Samsung's own QA process.

I believe it's not only a Samsung thing..

karit:

johnr: If anyone is that worried about it just do a backup of the data on your handset

Seriously that is VF response? I am so glad I am no longer with you.

Will you be increasing everyone data plans to allow for realtime backup of everything?

If there is a hole in Windows I am sure MS wouldn't say make sure you backup and leave it at that, they would release a patch and all the ISPs would heavily encourage their userbase to update as quickly as possible.

Carriers say it might break our network (or bloatware) can someone please post me to a link where the firmware on a phone had broken a cell network? As I don't know of any instances and currently this is FUD and my assumption is it more about getting people to buy new phones than "protecting" their network kit. I challenge you to prove me wrong. Preferable with an Android example; a 1g phone example from the 80s won't really cut it.