Hacker News Reader

Comment by sprkyco | Hacker News Reader

Well done I myself enjoy reading RFC's, but have yet to create something as crafty as this. Good work! Does not work on Android 4.4.2 requires application selection and then brings you to dialpad.

View on HN

Thanks a lot! I asked a friend to test it for me on android (wondering if it works) and I was glad that it doesn't. On Android it fills the phone number for you and lets you push the call button, which seems to me a much saner design.

Forgot to mention: Tested via google+ and hangouts with above mentioned android version. No FB acccount or messenger on mine to test that app so cannot speak to it but it seems the method of mitigating this attack is built in to Android.

It is. There's a separate permission for being able to initiate calls without prompting, and a separate intent -- most apps should use ACTION_DIAL[0] (which prompts), while apps with the right permissions may use ACTION_CALL[1], which doesn't.

There's yet another intent for dialling emergency numbers without prompt, which is reserved for system use -- non-system apps can only dial emergency numbers indirectly using ACTION_DIAL.

[0]: https://developer.android.com/reference/android/content/Inte... [1]: https://developer.android.com/reference/android/content/Inte...

There have been vulnerabilities related to tel: URIs before, in particular this one that let you factory reset Samsung phones.

http://www.techhive.com/article/2010562/reported-android-fla...

Reply on news.ycombinator.com