German security firm Curesec researchers have identified bugs present in Android OS that can allow malicious applications to place phone calls, even when they lack the necessary permissions.Android normally has to grant permission so that your applications can conduct actions. If your installed application does not own the right to do a phone call, the Android OS should throw a permission denied.
However this bug is circumventing the situation and allows any malicous app to do a phone call, send mmi or ussd codes or hangup an ongoing call.
This bug can be abused by a malicious application. Take a simple game which is coming with this code. The game wont ask you for extra permissions to do a phone call to a toll number - but it is able to do it.
This is normally not possible without giving the app this special permission. But not only might it be disturbing or expensive for someone to call a toll number or getting ongoing calls hung up. It is also possible to send USSD codes.
The list of USSD/SS/MMI codes is long and there are several quite powerful ones like changing the flow of phone calls(forwarding), blocking your simcard, enable or disable caller anonymisation and so on.
Please note that Curesec GmbH is not responsible for any damage your device might suffer while you try to execute such codes.
This Bug identified as CVE-2013-6272, was introduced in Android 4.1.1 Jelly Bean and it exists in all versions through Android 4.4.2 KitKat. It appears to have been fixed in the latest version, 4.4.4, but almost nobody is running that release yet.
It seems like the bug was introduced in this version and existed ever since. Another feature that is provided within this component is the ability to run SS and USSD codes. Android secret codes will not work nor *#06# to see the IMEI, for example.
For SS and USSD codes you always need to press the SEND key after entering them, so they all should work depending on your mobile provider. For manufacture defined MMI this will not work, since the code gets executed immediately with the user pressing send.
The fix is to get upgraded to version 4.4.4 as soon as possible.
