Some illegal ads started showing up on my Android phone as message boxes recently. They are said to be "USSD messages" in an app recording notifications (com.evanhe.nhfree).

There is a Wikipedia article about USSD, but mostly about the protocol. It's difficult to find any information about how they are actually used in modern smartphones, and the security implications.

So my question is, who are doing this? Are they (possibly or likely) from a service provider, someone contracted with them, some random person on the internet, or maybe malwares trying to hide the real source? Are they something like the email spams that I should just ignore them, or do they involve something more serious, such as hacking into the service providers, or using fake base stations?

The latest message specifically mentions "don't take screenshots", so I suspect they are afraid of the police finding something.

And as they are related to GSM, do they require downgrading to 2G to work?

  • I feel this question might seem stupid in places where USSD is widely used. But it's never used for legitimate purposes in my country at least in recent years. – user23013 Oct 10 '18 at 14:57
  • What country is this ? (might be useful info for potential answers) AFAIK, only your service provider can send USSD messages, so my guess is that it's either: malware attempting to hide (do you still get the messages if you put the SIM card in another phone ?), or it's actually your service provider or one of their contractors. Service providers like this often have surprisingly non-existant security - maybe their server that processes these messages got hacked and is sending these out. (In Europe USSD codes are usually used to show prepay balance: dial a short number, and balance pops up) – JonasCz Oct 10 '18 at 16:06
  • @JonasCz China. Fake base stations was on the news not long ago. They have only sent 2 times, separated by about a month, making any tests difficult. – user23013 Oct 10 '18 at 21:22
  • @JonasCz Are they still in use in Europe, for 4G phones? Or are they specific to GSM? – user23013 Oct 10 '18 at 21:28
  • Yes, they are still in use in Europe, although the only thing I've seen them used for is checking remaining balance / data / options on prepay plans - you dial a short number, which will result In a USSD message displayed on your phone. When on 4g, it would drop you to 2g / 3g briefly, like any other call (no VoLTE at the time), but I think now it does work directly over 4g, but requires VoLTE to be enabled. Setting up fake base stations (just?) to send out spam with seems a bit strange - I think they'd be easily detected and taken down. But I'm not familiar with China, maybe it does happen.. – JonasCz Oct 11 '18 at 6:17

I work in a telco and can tell you that we do use USSD messages. As far as I know, users can't generate them on their own, it has to be the provider. So it's either your provider that's compromised, or your phone. I'd send an e-mail to your provider (look it up on their website, it's probably 'abuse@providerx.com' or something like that).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.