• Special note for Samsung users (or Pixel users too!)

    If you have any of the following read on….

    Mobile devices from Samsung, including those in the S22, M33, M13, M12, A71, A53, A33, A21, A13, A12 and A04 series;
    Mobile devices from Vivo, including those in the S16, S15, S6, X70, X60 and X30 series;
    The Pixel 6 and Pixel 7 series of devices from Google;
    any wearables that use the Exynos W920 chipset; and
    any vehicles that use the Exynos Auto T5123 chipset.

    What is this about?  Google project zero have released a blog post about a security vulnerability that impacts these devices.

    What does this mean? Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim’s phone number. With limited additional research and development, we believe that skilled attackers would be able to quickly create an operational exploit to compromise affected devices silently and remotely.  So if the attacker CALLS you, they could compromise your phone.

    Note: Until security updates are available, users who wish to protect themselves from the baseband remote code execution vulnerabilities in Samsung’s Exynos chipsets can turn off Wi-Fi calling and Voice-over-LTE (VoLTE) in their device settings. Turning off these settings will remove the exploitation risk of these vulnerabilities.

    What should I do? 

    How to turn off WiFi calling on a Samsung phone

    1. Open the phone on your Samsung phone
    2. Tap the three-dot menu in the top-right corner
    3. Select Settings
    4. Find the WiFi Calling option about halfway down and toggle it off

    How to Disable VoLTE on any Samsung Galaxy Phone

    1. Head over to the Settings page on your galaxy device.
    2. Then go to the Connections section.
    3. Scroll to the Mobile network section.
    4. Within that, you should see the VoLTE Calls option. Just disable the toggle and that’s it. (note I think this should be default disabled and is probably not enabled by default)

    No patch is available at this time.  As soon as I hear word of one, I’ll add it to the master patch listing.

    Please note – each vendor of the phones can customize the deployment and thus you may not see these options in your phone.