A researcher at a security conference in Berlin has shown how USSD codes can be used in cyber attacks against Samsung phones. The Galaxy S3, for instance, could have its SIM card wiped merely by browsing a malicious website.
A researcher at a security conference in Berlin has shown how Unstructured Supplementary Service Data (USSD) codes could be used in cyber attacks against mobile phones. The Samsung Galaxy S3, for instance, can be reset to factory default merely by browsing a malicious website.
Opens a File copy screen where you can back up your media files
service mode main menu
Factory Hard Reset to ROM firmware default settings
These codes can be invoked, without any user intervention, through a variety of mechanisms. Borgaonkar demonstrated the attack using an SMS message sent to the phone, holding the phone in proximity to an NFC tag, and discussed others such as a QR code.
All these vectors result in pushing the code to the phone, possibly by instructing it to visit a website that contains a "tel:" URL with the code. For example, a Samsung phone, when visiting a Web page containing <frame src="tel:*2767*3855#" />" would reset the phone to factory default. Other codes can wipe the SD and SIM cards.
Borgaonkar says that the attacks only work so far on Samsung devices. Many of the attack vectors can be disabled by the user. It's not clear that these vectors are present with all carriers.
How Enterprises Are Attacking the IT Security EnterpriseTo learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
IT Strategies to Conquer the CloudChances are your organization is adopting cloud computing in one way or another -- or in multiple ways. Understanding the skills you need and how cloud affects IT operations and networking will help you adapt.