Today, our database is accessible from any low-cost mobile device via WAP, SMS and USSD, enabling refugees to register and search for family without accessing the Internet.
The vulnerability was highlighted by Ravi Borgaonkar at the Ekoparty security conference, and makes use of USSD codes that are normally used by handsets to communicate with the carriers.
The Unstructured Supplementary Service Data (USSD) code (which we won't reproduce here) apparently only works on Samsung phones running Touchwiz, and only if you are directed to the dodgy destination while inside the stock browser (rather than Chrome, for example).