Hacking

QR Code: USSD attack

May 29, 2013 by Bhavesh Naik

The QR code or Quick Response code was originally designed for industrial applications, and has quickly gained popularity in the advertising industry. With the huge popularity and sales in smartphone and tablets every year, these QR codes are beloved by marketers.

What a typical QR contains

  • A QR code can contain an electronic version of the contact information.
  • A QR code can contain event information. Scan the code on a poster and the app automatically adds its name and location to the agenda on your smartphone.
  • A QR code can contain WIFI configuration data.

In my previous article: https://resources.infosecinstitute.com/what-is-behind-that-qr-code/ , I mentioned how attackers depend on human curiosity and the innate obfuscation of the QR codes to craft an attack. Various protocols invoking service set commands on the mobile devices are misused by exploiting vulnerabilities on mobile platform. QR codes are used as an attack vector to harm mobile users.


https://resources.infosecinstitute.com/what-is-behind-that-qr-code/

In this article, I shall demonstrate how QR codes can be misused to execute a remote attack on an Android device. There are tons of service list commands, also known as USSD (Unstructured Supplementary Service Data), which can be executed using this attack starting from displaying IMEI number to factory reset service command. But as far as this article is concerned, I will be limiting it to executing a USSD command to display IMEI number, since I do not want our readers to execute a factory reset command and wipe off their important data and settings on their own smart devices.

Here is a list of things we will require to perform a USSD attack. First of all we need an android smartphone. The one I will be using is an Android device with Froyo (2.2) platform. You can test it on the newer versions like 2.x, 3.x or 4.x series. There are plenty of vulnerable devices out there; you just need to find one which is susceptible to this attack.

Secondly, you need a QR code generator. There are plenty of generators available as Android apps, desktop applications, and online generators. Make sure whichever you use, it supports embedding a phone number in the QR code.

Third, you need a barcode scanner for your smart device. We will use this to scan QR code and to test if our device is susceptible to USSD attack. Select your favorite 2D/QR barcode scanner from the Android play store.

Finally, you will need the USSD code to display the IMEI number. The USSD service command is *#06#.

Let’s get started with our experiment. Install you favorite QR code generator and fire it up. Click on the option which says “CALL” or “TELEPHONE NUMBER” and enter the USSD service command: *#06#. Finally, click on “Generate QR code“.

Personally, I found http://goqr.me easy to use. This is an online QR code generator and does not require end users to download anything.

Head over to the above mentioned website, and click on the “Call” tab. Click on the text field stating “Telephone number:” and enter the USSD service command: *#06#. Automatically, a QR code will be generated on the right hand side of the browser screen. Click on the “Download” button.

You will have a downloaded QR code that looks like this:

Now you require some social engineering skills to distribute this QR code to as many people as possible and make them scan it. One possible way is to tell them that this QR code is for free Android games or this QR code is my contact number. Try posting it on some public places; I am quite sure people out of sheer curiosity will scan the QR code. This is the biggest risk —that people cannot control their curiosity and you can use this to your own advantage and evil intent. You can find out ‘n’ number of ways to make people scan your malicious QR code; you just need to figure out the best one.

Fire up your QR code scanner on your smart android device and scan the QR code that you just downloaded. You will probably see a pop-up box showing a title named: “IMEI” followed by your 15 digit IMEI number.

See below:

If you do not see the IMEI number like the above picture, consider yourself lucky. What does it mean? Well, in your case, your Android device is not susceptible to the USSD attack and your device is secure from such attacks. Cheers!

What if you do see the above screen and the IMEI number?

In this case, you need to update your Android device to the latest firmware. If there are no latest updates available for your device currently, download and install a dialer other than the default one, thus stopping the auto execution of any malicious USSD code.

After installing the new dialer, head over to http://mobtest.indianhans.org from your mobile’s default browser or re-scan the QR code which you have generated and see if the problem still persists.

So what is happening?

We are trying to make the Android user execute the “tel” protocol which is available on mobile platform followed by the USSD code *#06# to display the pop-up box containing the mobile’s IMEI number.

You can try various USSD service commands by embedding it in the QR code using the above procedure and see for yourself if they get executed.

The most harmful USSD code would be the Factory Reset command code. As soon as the victim scans the QR code, the tel protocol will get invoked followed by factory reset code and thus your all of your settings and data will be wiped out in matter of seconds.

Note:

  1. Only some devices or versions will be vulnerable to this attack. Some devices only execute the tel protocol and display a ” *
    ” on the dialer screen.
  2. Don’t try the factory reset code by embedding it in the QR code; you may lose your valuable information.
  3. The author is not liable to any harm done to whomsoever and to whatsoever. This article is intended only for educational purposes.

References:

  1. https://resources.infosecinstitute.com/what-is-behind-that-qr-code/
  2. http://goqr.me
  3. http://mobtest.indianhans.org
  4. http://www.techexperiments.in/2012/12/telpic-android-qr-code-exploit.html
Posted: May 29, 2013
Author
Bhavesh Naik
View Profile

Bhavesh is a Certified Ethical Hacker and Security + certified. Currently, he is pursuing Final year BSc in Information Technology. The upcoming goal for him is CISSP. He is interested in cyber forensics, pentesting, information security. He wishes to do his Masters in Information Security in upcoming years.

6 responses to “QR Code: USSD attack”

  1. ron says:

    It didn’t work with my old android cell phone but it did work on symbian

    • Bhavesh says:

      try changing the ussd code to *%2306%23 in the telephone number field & try again.
      Thank you for letting us know that it worked on symbian too.

  2. Tyson Matthews says:

    How is this a security issue? If you want to figure out the IMEI number of the device using this technique, you require physical access to the device. And if you already physical access to the device, you can just retrieve the IMEI number directly.

    • Bhavesh says:

      Hi Tyson,
      The article has been limited to executing a USSD attack to reveal IMEI. You can increase the severity of this attack by using a factory reset code in place of the IMEI USSD code.
      You can also remotely attack user by combing this attack with something called as “Atagging” or SE.

  3. jazz says:

    The code in comment works.

  4. John Hurley says:

    This entire article is based on a misunderstanding of what USSD actually is.

    The Man-Machine Interface (MMI) of a mobile phone defines how certain calls and codes should be handled.
    It is the MMI that determines what input is acceptable in address fields etc. when you write a text message or when you dial a number.
    When you open the Phone application on your phone you will notice that it automatically shows you digits 0-9 and three other characters +, * and #.

    If the string you dial begins with “+” or any of digits, the phone interprets this as a suitable address for a voice call or an SMS.

    If the string you type begins with “*” or “#”, the phone’s MMI interprets it as a trigger for special handling.
    Depending on the characters that follow a “*”, the phone may interpret the string in one of 3 ways:
    – A handset command
    – A Supplementary Service command
    – An unstructured Supplementary Service command

    1. Handset commands are executed entirely on the handset without exchanging any signalling or data with the wireless network. Such commands display the handset’s IMEI, Software version, the IMSI of the SIM card etc. Some are common to all handsets while others are specific to one manufacturer. There are many websites that purport to list these “secret” codes and their nefarious purposes.
    eg. http://www.saveondish.com/forum/T-All-Mobile-Handset-Secret-Codes
    There are some others that make claims so outrageous, they are funny:
    http://urbanlegends.about.com/od/business/a/cellphone_tips.htm

    2. Supplementary Services are services defined in the standards of ETSI and other bodies and can be activated on the HLR of the wireless network. Examples of such Supplementary services are:
    – Call Divert
    – Call Barring (outbound)
    – Call Baring (inbound)
    – Call Waiting
    For more information see http://en.wikipedia.org/wiki/Call_forwarding
    When a code entered on the handset matches one of the defined supplementary services, the MMI sends it to the HLR in the network. The HLR reads the code and executes the service request associated with that string or code.

    3. USSD stands for Unstructured Supplementary Service Data. (It is a GSM only service)
    In contrast with Structured Supplementary Services, described in section 2 above, USSD services are not pre-defined in standards (but the format of their codes are).
    They must being with a “*” and end with a “#” and the initial “*” must be followed by 3 or 4 digits.
    Additional parameters can be added as input to a request by entering additional “*” characters.
    eg. *127*98727467364724# (Top up my credit in accordance with pre-paid voucher 98727467364724)

    The MMI of the handset treats unstructured supplementary services just like structured ones. It passes them to the HLR.
    If the HLR receives a request to a code it does not recognise as a supplementary service, it assumes it is an unstructured supplementary service and routes it onwards to a USSD Gateway. The USSD gateway has connections of one or more application servers associated with one or more service codes. If the appropriate application is connected, the USSD Gateway routes the request to that application and an interactive session is established between handset and application.

    Because USSD is “unstructured”, the variety of services is unlimited.
    GSM operators can provide as man or as few services as they want:

    Customer Self Care: Check Credit Balance, Top-Up Credit
    AirTime Transfer: Balance Transfer, Balance Request, Emergency credit loan
    VoiceCall Stimulation: Please Call Requests, Collect Call requests, Roamer Call-back requests
    Bundle Management: Data bundles (eg. *220*50# for 50MB *220*200# for 200MB etc.)
    RBT Registration:
    InfoTainment: News, Sports News, Music News, Gossip, Daily Horoscope
    Social Networking: FaceBook USSD, Twitter via USSD etc.
    Mobile Banking: Interactive session based transactions

    USSD can service more data than SMS (182 chars per request) and can structure these as menus with each item assigned a number. Once the mobile subscriber responds with the number of one of the menu items, the appropriate action or sub-menu can be served.

    Anyway, I guess the people who are dumb enough to scan QR codes may also be dumb enough to execute the factory reset code if that is what the QR evokes but that has NOTHING to do with USSD.
    Blocking USSD is misguided.

Leave a Reply

Your email address will not be published.