Step 1: Open the Calculator app

Step 2: Type (+30012012732+

The DRParser Mode app is launched



Step 3: Type *#9900#

The Service Mode app is launched. You have already a lot of cool options:

- run dumpstate/logcat/modem log

- enable silent logging from boot

- media db dump

- enable seclog

- ...

Wait why these 3 buttons are in black?



Low battery dump, tcp dump start, IMS logger, it looks like cool things 😁

tcpdump is a command-line packet analyzer, it is use a lot to capture network traffic https://www.tcpdump.org/

When I click on the "tcp dump start" button, a pop up appears. They implemented an OTP mechanism

Wait a second, my phone is not connected to Internet, so this OTP mechanism is a local mechanism. Time for some magic





I reversed the ServiceMode app and created a small proof of concept with the CheckOTP method.

Now, I can run my POC, enter the key given in the pop up and hop tcpdump is running on the phone aka all the network traffic is captured

To retrieve the capture:

1. Click on "TCP DUMP STOP"

2. Click on "COPY TO SDCARD"



The capture is available in /sdcard/log/tcpdump/tcpdump_[interface]_[timestamp].pcap

Bonus: You can also record the victim' screen for 1 hour





Step 1: Click on the "IMS LOGGER" button (one of the 3 black buttons).

IMSLogger+ is launched



Step 2: Click on "Filter Options"

Step 3: Enable the "Record screen" option and voila!

The video will be available in /sdcard/ims_logs/

These issues has been disclosed responsibly to Samsung 3 weeks ago

You can follow @fs0c131y.

____

Tip: mention @threader_app on a Twitter thread with the keyword “compile” to get a link to it.



Enjoy Threader? Sign up.



Since you’re here...



... we’re asking visitors like you to make a contribution to support this independent project. In these uncertain times, access to information is vital. Threader gets 1,000,000+ visits a month and our iOS Twitter client was featured as an App of the Day by Apple. Your financial support will help two developers to keep working on this app. Everyone’s contribution, big or small, is so valuable. Support Threader by becoming premium or by donating on PayPal. Thank you.



Download Threader on iOS.