794257 - Protect against remote USSD attack

Status: RESOLVED DUPLICATE of bug 794034

(Firefox for Android Graveyard :: General, defect)

Description

[Mark Finkle (:mfinkle) (use needinfo?)]

See details of the attack vector here:
http://dylanreeve.posterous.com/remote-ussd-attack

This attack depends on the type of dialer used on the phone. Some dialers, like the stock Galaxy Nexus dialer, will not actually dial the number, only display it waiting for the user to 'send'.

Others, like older Samsung and DroidX, will attempt to dial the number.

Maybe we could add a check for the USSD style number and display a prompt before sending to the dialer.

Not marking as confidential since the attack is public and not a problem in Firefox.

Comment 1

[Marty Rosenberg [:mjrosenb]]

Another option is to just not honor those requests when the user did not explicitly click on a link.