Help Samsung S6 Active / AT&T hacked ? Security Issue?

[Tooobi]

Dear All,

I bought in Febuary this year a new Samsung S6 active from a dealer in Hong Kong via ebay.
(the phone is great, but not sold in Germany by Samsung)
It has an AT&T branding. It was sold as new and without net-lock.
It worked nice for 6 month with a German (non AT&T) SIM card.
I was never AT&T customer.

Then all of a sudden the phone asked last Friday for a net unlock pin.
I do not have one, the phone quit working.

I submitted the unlock request to AT&T on Saturday (01.09.2018).
I was supposed to get a response within 48h.

After 3 days I contacted them, they were very friendly, but I had the impression they do hide something.
I was concerned, they either erroneously block my phone or were themselves victim of some attack.

Yesterday, same thing. There the promised me they sorted everything out. A few hours and the phone would work again. "Take my word for it!" Someone from Hong Kong had supposedly put a netlock on my phone.

How could he lock an phone with AT&T firmware, without them authorizing it ???????
I asked, could this person have compromised my phone in other ways, do i need to root it and set it up again?

They said: No need to worry.

Still after 6 days my request was never denied or accepted.
I fear something happened to them, which they have themselves do not control.

What advise would you give me regarding the safety of my phone?
(just trash it?)
(so far i did only factory reset)
or: No need to worry.

The Hong Kong guy was powerseller on ebay.
And the phone was not sold in Germany by Samsung, thus there was likely a high demand?

Are there other victims?
Thanks a lot and Kind regards

T

 

[mikedt]

"net unlock" never heard of that term. Are we talking about a SIM lock, where it can only be used with an AT&T SIM, or is the phone IMEI/MEID blacklisted, possibly because it might have been reported stolen or has an outstanding AT&T contract on it?

FYI AT&T branded phones are not sold in Hong Kong by Samsung either. Sounds like this S6 started life in the USA where it was originally sold by AT&T(with a contract), and has now travelled around the world.

I have seen US carrier version phones turn-up in China before, like AT&T and Verizon, and myself I wouldn't touch them with a barge pole.

 

[Tooobi]

Dear Mike,

thanks a lot and sorry for the confusion!
It is the SIM unlock that prevents me to use my SIM card any longer.
I have no AT&T card, but i suppose it would work.

The rest of the phone is fine. I locked it my self, unlocked it, changed password.
Samsung tech service was my first contact a week ago.
They immediately answered and said it is an AT&T issue.

I guess the phone was produced in the US (it has all the AT&T apps on it).
But it came sealed and really looked like from the shop.
Since the guy had 1000+ sales on ebay and good reviews, i trusted him.
(and was happy for 6 month too...)

I think hardware and android are fine, just the ATnT firmware might have been hacked?
If i root it i should be fine???

Thanks and Kind regards

 

[Deleted User]

You could try reflashing the os via odin and should get rid of a hack is present

 

[Tooobi]

Thanks!
that might in the end be the best solution. I already searched for the files i need, but i could not find a link that still worked.
Any advise???

Either way i will wait a a bit longer. Otherwise AT&T might put the blame on me for rooting the phone.
Yesterday in yet another chat i asked for an email address to file a formal complaint (got it & did so)
Lets see...
I hope i get a response this time.

 

[mikedt]

I suspect AT&T won't unlock it because you're not a customer of theirs. I'm pretty sure that rooting won't help, not for SIM locks. Phones can be resealed to appear as new and unused, and I've seen dealers doing that myself in China(including Hong Kong). How did a phone that was usually only sold new by AT&T end up in Hong Kong in the first place?

In fact that's exactly what these peeps were doing with the red cartons last week. They were refurbishing and repacking phones into the red cartons to be sold online as "new".

I was only here getting a Samsung Galaxy S7 front glass replaced. And this dealer mainly does Samsung and iPhone repairs.

 

[psionandy]

Thanks!

Yesterday in yet another chat i asked for an email address to file a formal complaint (got it & did so)

Who are you complaining about?
AT&T, have no relationship with you as a customer, so there is no obligation there.
Samsung are unlikely to deal with it, as i'm pretty sure it won't have a a warranty with it (old stock, refurb, grey import, sold on ebay
Your German Phone company, can refuse to acknowlege it, as you are using a phone that was never sold in Germany (and presumably doesn't have the correct certifications
possibly the ebay seller, who was selling old equipment as new... (good luck with that)
Ebay? Paypal? your credit card company?

 

[mikedt]

Who are you complaining about?
AT&T, have no relationship with you as a customer, so there is no obligation there.
Samsung are unlikely to deal with it, as i'm pretty sure it won't have a a warranty with it (old stock, refurb, grey import, sold on ebay
Your German Phone company, can refuse to acknowlege it, as you are using a phone that was never sold in Germany (and presumably doesn't have the correct certifications
possibly the ebay seller, who was selling old equipment as new... (good luck with that)
Ebay? Paypal? your credit card company?

Yeh, an Ebay seller in China...indeed good luck with that!

EDIT:
BTW I know all about repairing, refurbishing and repacking returned and used consumer electronics items, to be restocked/resold as new. Because it's a job I was doing myself in the 1980s, the company in Bristol had contracts with Amstrad, Binatone and Baylin Trading.

 

[Hadron]

I guess the phone was produced in the US (it has all the AT&T apps on it).
But it came sealed and really looked like from the shop.
Since the guy had 1000+ sales on ebay and good reviews, i trusted him.
(and was happy for 6 month too...)

I think hardware and android are fine, just the ATnT firmware might have been hacked?
If i root it i should be fine???

The phone will have been made in Korea, with firmware customised for ATT. As far as I know this model was only ever made for ATT, so a SIM-unlocked one will not be new.

My guess is that the Hong Kong guy used some hack to unlock it in the first place, rather than the official unlock from ATT (which would only be available to an ATT customer), and something has glitched. Since we don't know how it was unlocked, what went wrong or what triggered this would be a matter of speculation only. But this seems simpler and more likely to me that assuming that the phone or ATT's systems were hacked (what would be the point of that anyway?). If ATT have been a little cagey or imprecise in their answers it's because they don't actually know what's happened here, and probably don't know the history of the phone.

 

[Tooobi]

Dear All,

thanks for the feedback.

I mainly complain that ATnT does not respond to the unlock request.
They state 2days. It is now 8.

If they say, no we have have the right to lock your phone, buy another phone.
This is not nice, but OK.
I just think this is not the case.
This should be an automated response that takes less then 5 seconds for a robot to check in a database.

If they have been hacked by the Hong Kong guy, they should ask me to send them my phone, that they can find out how and protect their other customers (even if they do not care about me, which is ok too).

So it is not that they refuse to unlock my phone for 8 days that upsets me.
It is that they do not respond at all.

Therefore I would be interested are there other cases?
But till now no one responded.
But maybe the Hong Kong Guy reads this and is careful for now...

Kind regards T

 

[mikedt]

Dear All,

thanks for the feedback.

I mainly complain that ATnT does not respond to the unlock request.
They state 2days. It is now 8.

If they say, no we have have the right to lock your phone, buy another phone.
This is not nice, but OK.
I just think this is not the case.
This should be an automated response that takes less then 5 seconds for a robot to check in a database.

If they have been hacked by the Hong Kong guy, they should ask me to send them my phone, that they can find out how and protect their other customers (even if they do not care about me, which is ok too).

I'm pretty sure it wasn't AT&T that was hacked, but rather this carrier version S6 Active was hacked by the HK guy, to defeat the AT&T SIM lock by some unauthorized unofficial means. And now it seems to have reactivated for some unknown reason. Samsung Germany won't be interested in it, not with a US variant phone that's come in via HK, i.e. grey import.

So it is not that they refuse to unlock my phone for 8 days that upsets me.
It is that they do not respond at all.

Therefore I would be interested are there other cases?
But till now no one responded.
But maybe the Hong Kong Guy reads this and is careful for now...

Kind regards T

There's been plenty reports on this board about lousy AT&T service, and that's from AT&T customers in the States....rather like "We're the phone company, we don't have to care!"

 

[lunatic59]

Mike, I think customer service in general has been in decline for a long time now. That aside, I'm not sure what AT&T is supposed to do for the OP. They may not even be able to give the OP a valid unlock code given the level of tampering originally by the HK guy. I would say you are spot on in your evaluation ... the original unlock was performed to somehow bypass the official lock and it has now reverted or corrupted.

 

[Hadron]

You've already had the most likely situation explained to you before your most recent post, and it's been reiterated since.

Instead you present two incredibly unlikely scenarios: that ATT locked your phone despite it never appearing on their network, so them having no knowledge of it; or that the Hong Kong guy hacked ATT's systems in order to lock your phone 6 months after selling it to you, despite this not benefitting him in any way. Honestly, do either of those sound plausible?

If you stop looking for some malign actor, isn't the scenario we've explained, that someone used an unauthorised means to unlock the phone and that improvised attempt to bypass the lock has failed and the lock reasserted itself, much simpler and more likely than either of those (especially the Hong Kong guy being an evil computer genius who hacked ATT's systems just to lock your phone 6 months after selling it to you, because... nope, I can't think of a reason)?

As for ATT's lack of response, they provide unlock codes for their customers and only for their customers. So as you are not a customer I doubt their systems allow them to do anything for you. And while you might think it would be polite for them to at least tell you that, you are dealing with a large, faceless corporation who have no commercial interest in your problem, so sadly it's not actually surprising. I won't bother listing all of the corporations who have stonewalled complaints and queries from me over the years even though I was their customer, but in my experience this is commonplace.

 

[Jfalls63]

Several years ago, I purchased a unlocked S5 Active from a seller through Amazon. It was my understanding that the reseller bought the phones and then purchased a batch of unlock codes for them.
I used mine with a Straight Talk Sim and never had any issues.
I also thought that once a phone is Sim unlocked, it stays Sim unlocked.

 

[lunatic59]

I also thought that once a phone is Sim unlocked, it stays Sim unlocked.

If the code is supplied by the original carrier, then yes. If, however, a code exploit is used to bypass the lock then technically the phone isn't really unlocked. That's what I expect is going on in this case.

 

[Tooobi]

Dear All,

thanks a lot! You might be right, maybe he had just bypassed the lock.

I did not see a huge profit for him in doing that. I paid for the phone roughly 200 $.
The phone is at least "as if new". In particular the battery.
I would have paid the same for a used phone in that condition.
I used PayPal and bought from an ebay Powerseller, thus i felt save.

I was afraid he had also invaded the rest of the ATnT firmware to get access to my bank account etc. But I did a factory reset.

While ATnT never responded to my request to explain me what happened to the SIM-lock they sent me yesterday an automatic response with the unlock code.

Phone works again.

What truly happened will remain a mystery.
Likely he just bypassed the lock somehow.

Kind regards & Thanks again

T

 

[Hadron]

Well I'm impressed that they sent you an unlock code. Most carriers will do nothing for someone who isn't a current customer.

BTW it's unlikely that the seller had installed malware in the system firmware, but if he had a factory reset wouldn't fix that. All a reset does is erase user-installed apps and data, and any changes to the system are unaffected by it. To overwrite any possible changes to the system you need to "reflash" the phone with a clean set of official firmware (which I think should not stop an official unlock working, but as my phones are always factory unlocked I can't say from experience).

 

[lunatic59]

should not stop an official unlock working

Correct. A valid sim unlock is permanent.

Well I'm impressed that they sent you an unlock code.

I too am impressed. I would think that the fact AT&T gave you the unlock code supports the legitimacy of the seller. The phone had to have shown up in the carrier's database as valid, active and clean for them to unlock it.