Certain Samsung Phones Susceptible to 18 Zero-Days Vulnerabilities
As far as security flaws go, zero-day vulnerabilities are among the worst. These vulnerabilities were unknown to the developer of the software, opening the risk that bad actors could find an exploit before a patch could be created. Samsung is currently dealing with a zero-day crisis in its smartphones, as some are susceptible to a whopping 18 zero-days. Researchers at
As far as security flaws go, zero-day vulnerabilities are among the worst. These vulnerabilities were unknown to the developer of the software, opening the risk that bad actors could find an exploit before a patch could be created. Samsung is currently dealing with a zero-day crisis in its smartphones, as some are susceptible to a whopping 18 zero-days.
Researchers at Google Project Zero discovered the 18 zero-day vulnerabilities between last last 2022 and early 2023. These zero-days affect Samsung phones with an Exynos modem, which is good news for Samsung users in the US, since the company opts for Qualcomm parts over Exynos. For much of the world, however, where Exynos Samsung smartphones are hugely popular, this is a major concern.
The group of 18 vulnerabilities includes four that allow for “internet-to-baseband remote code execution,” which would allow bad actors to issue a zero-click attack if they knew the victim’s phone number. A zero-click attack means the victim doesn’t have to do anything on their end to trigger the attack, making them incredible dangerous. And, since the attack deals with the phone’s modem, hackers would have access to things like calls and texts.
Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction and require only that the attacker know the victim’s phone number … With limited additional research and development, we believe that skilled attackers would be able to quickly create an operational exploit to compromise affected devices silently and remotely.
Tim Willis, head of Project Zero
The following devices are reportedly affected by the vulnerabilities:
- Exynos 850
- Exynos 980
- Exynos 1080
- Exynos 1280
- Exynos 2200
- Exynos Modem 5123
- Exynos Modem 5300
- Exynos Auto T5123
- Mobile devices from Samsung: S22, M33, M13, M12, A71, A53, A33, A21, A13, A12 and A04 series
- Mobile devices from Vivo: S16, S15, S6, X70, X60 and X30 series
- Mobile devices from Google: Pixel 6 and Pixel 7 series
- Any wearables that use the Exynos W920 chipset
- Any vehicles that use the Exynos Auto T5123 chipset
If your device is affected, the current advice is to turn off Wi-Fi calling and Voice-over-LTE (VoLTE) in your phone’s settings. Samsung will likely issue a patch for these issues soon.
Photo by Daniel Romero on Unsplash
Share This
