Android phones can be hacked just by someone knowing your phone number • Graham Cluley | Crusader Tech

By Posted on

Android phones can be hacked simply by someone knowing your phone number

Properly this isn’t good.

Google has issued a warning that some Android telephones will be hacked remotely, with out the sufferer having to click on something.

If an assault is profitable, the hacker may entry knowledge passing by way of the Samsung Exynos chipsets utilized in many gadgets, amassing name and textual content message data.

And what does a hacker must find out about you to focus on your telephone?

His telephone quantity.

That is all. All they should know is the telephone variety of your Android gadget.

Frankly, that is terrible. It is easy to think about how such a safety challenge may very well be exploited by, oh, I do not know, state-sponsored hackers.

EmailSubscribe to our e-newsletter
Safety information, ideas and recommendation.

In whole, safety consultants engaged on Google’s Venture Zero staff say they’ve found a complete of 18 zero-day vulnerabilities within the built-in Exynos modem of some telephones, and 4 of the vulnerabilities are notably critical:

Testing by Venture Zero confirms that these 4 vulnerabilities permit an attacker to remotely compromise a telephone on the baseband degree with out consumer interplay, and solely requires the attacker to know the sufferer’s telephone quantity. With restricted extra analysis and improvement, we consider expert attackers may rapidly create an operational exploit to silently and remotely compromise affected gadgets.

In accordance with the researchers, the opposite vulnerabilities require a rogue cellular community operator or attacker with bodily entry to the Android gadget.

Weak gadgets embrace:

  • Samsung smartphones, together with the S22, M33, M13, M12, A71, A53, A33, A21s, A13, A12 and A04 collection;
  • Vivo smartphones, together with the S16, S15, S6, X70, X60 and X30 collection;
  • Google Pixel 6 and Pixel 7 gadgets; and
  • any car utilizing the Exynos Auto T5123 chipset.

It is value noting that some gadgets will use Qualcomm’s chipset and modem, which does not undergo from the identical vulnerabilities as Exynos’s.

In fact, Google’s Venture Zero exploit hunters don’t have any qualms about going into nice element about how safety holes will be exploited, and sometimes share such data publicly 90 days after informing the related software program or {hardware} distributors concerning the bug. drawback.

Nonetheless, on this case, the Google staff appears to acknowledge that public disclosure at this stage may trigger vital issues:

Underneath our commonplace disclosure coverage, Venture Zero discloses safety vulnerabilities to the general public a specified time after reporting them to a software program or {hardware} vendor. In some uncommon instances the place now we have assessed that attackers would profit considerably greater than defenders if a vulnerability have been disclosed, we made an exception to our coverage and delayed the disclosure of that vulnerability.

As a consequence of a really uncommon mixture of degree of entry these vulnerabilities present and the pace with which we consider a dependable operational exploit may very well be created, now we have determined to make an exception coverage to delay the disclosure of the 4 vulnerabilities that permit Web-to – distant baseband code execution.

You probably have an affected Google Pixel gadget, there’s excellent news. Google has already issued a safety patch in your smartphone with its March 2023 safety replace.

Nonetheless, if you’re the proprietor of a weak Samsung smartphone, options usually are not but accessible in accordance with at the least one Google Venture Zero researcher.

So what must you do in case your gadget hasn’t been patched?

Google’s advice is that you just change your gadget settings to show off Wi-Fi calling and Voice over LTE (VoLTE), till an answer is out there in your smartphone.

Did you discover this text attention-grabbing? Follow Graham Cluley on Twitter or Mastodon to learn extra of the unique content material we publish.

Graham Cluley is an antivirus business veteran who has labored for numerous safety firms for the reason that early Nineteen Nineties, when he wrote the primary model of Dr Solomon’s Anti-Virus Toolkit for Home windows. He’s now an impartial safety analyst, seems frequently within the media, and is a global public speaker on the subject of pc safety, hackers, and on-line privateness. Observe him on Twitter at @gcluleyin Mastodon in @[email protected]or ship him an e mail.

–


Android phones can be hacked just by someone knowing your phone number • Graham Cluley