6 ms·

Thanks a lot! I asked a friend to test it for me on android (wondering if it works) and I was glad that it doesn't. On Android it fills the phone number for you

Thanks a lot! I asked a friend to test it for me on android (wondering if it works) and I was glad that it doesn't. On Android it fills the phone number for you and lets you push the call button, which seems to me a much saner design.

sprkyco 12y ago
Forgot to mention: Tested via google+ and hangouts with above mentioned android version. No FB acccount or messenger on mine to test that app so cannot speak to it but it seems the method of mitigating this attack is built in to Android.
- andrewaylett 12y ago
  It is. There's a separate permission for being able to initiate calls without prompting, and a separate intent -- most apps should use ACTION_DIAL[0] (which prompts), while apps with the right permissions may use ACTION_CALL[1], which doesn't. There's yet another intent for dialling emergency numbers without prompt, which is reserved for system use -- non-system apps can only dial emergency numbers indirectly using ACTION_DIAL. [0]: https://developer.android.com/reference/android/content/Intent.html#ACTION_DIAL https://developer.android.com/reference/android/content/Inte... [1]: https://developer.android.com/reference/android/content/Intent.html#ACTION_CALL https://developer.android.com/reference/android/content/Inte...
tveita 12y ago
There have been vulnerabilities related to tel: URIs before, in particular this one that let you factory reset Samsung phones. http://www.techhive.com/article/2010562/reported-android-flaw-could-wipe-your-samsung-galaxy-s-iii.html http://www.techhive.com/article/2010562/reported-android-fla...