3 ms·

Interesting that earlier coverage of this also indicated VoLTE as vulnerable, but a lot of phones don't have a way to turn that off - particularly since older p

Interesting that earlier coverage of this also indicated VoLTE as vulnerable, but a lot of phones don't have a way to turn that off - particularly since older protocols that support voice directly have been turned off. I am curious whether attacks on this can be blocked at the carrier level. Worst case you could do carrier level forwarding (via website or code so the call never hits your phone) to another number that you can also use on your device independent of the modem call handling. Obvious candidates would be Google Voice, Zoom Phone or other VOIP options. Google and Zoom may be the simplest options unless you're already using a SIP provider with a decent app, standalone SIP apps seem to be a weak area for app development. Last time I looked Zoiper and Grandstream Wave seemed like the best options not tied to specific VoIP providers. Edit: Obviously this will then involve using that app for receiving calls, but you should be fine making outbound calls with your regular number. Edit2: if using Zoom keep in mind that it limits the number of devices you can be simultaneously signed in on which may impact either receiving calls on your phone or being on Zoom conferences from larger devices like tablets.

GeekyBear 4y ago
> Interesting that earlier coverage of this also indicated VoLTE as vulnerable The initial reporting on Project Zero's findings was pretty clear that this was the case. >"Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number," Willis wrote in a breakdown of the security flaws. Willis suggests turning off Wi-Fi calling and Voice-over-LTE (VoLTE) to protect against baseband remote code execution, if you're using a vulnerable device powered by Samsung's silicon. https://www.theregister.com/2023/03/17/android_google_project_zero_samsung_modems/ https://www.theregister.com/2023/03/17/android_google_projec...
- fencepost 4y ago
  Willis suggests turning off Wi-Fi calling and Voice-over-LTE (VoLTE) to protect against baseband remote code execution, if you're using a vulnerable device powered by Samsung's silicon. The problem is that that's a very sterile way to say "turn off all voice calling features on affected devices" unless I'm misunderstanding how modern cell networks function. Without VoLTE in pretty sure devices need to fall back to 3G (effectively off in most of the world) or 2G (not much better, though it's still around on one carrier in a lot of places for longer distance coverage as I understand it). Maybe my understanding is completely off, but this seems like writing an article about terrible flaws in automotive wheel bearings and closing with "we recommend that everyone avoid doing things that require use of wheel bearings."
  - Kwpolska 4y ago
    There are many countries with some 3G service still available: https://www.thingsmobile.com/2g-3g-network-sunset-dates https://www.thingsmobile.com/2g-3g-network-sunset-dates

GeekyBear 4y ago

> Interesting that earlier coverage of this also indicated VoLTE as vulnerable The initial reporting on Project Zero's findings was pretty clear that this was the case. >"Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number," Willis wrote in a breakdown of the security flaws. Willis suggests turning off Wi-Fi calling and Voice-over-LTE (VoLTE) to protect against baseband remote code execution, if you're using a vulnerable device powered by Samsung's silicon. https://www.theregister.com/2023/03/17/android_google_project_zero_samsung_modems/ https://www.theregister.com/2023/03/17/android_google_projec...

fencepost 4y ago
Willis suggests turning off Wi-Fi calling and Voice-over-LTE (VoLTE) to protect against baseband remote code execution, if you're using a vulnerable device powered by Samsung's silicon. The problem is that that's a very sterile way to say "turn off all voice calling features on affected devices" unless I'm misunderstanding how modern cell networks function. Without VoLTE in pretty sure devices need to fall back to 3G (effectively off in most of the world) or 2G (not much better, though it's still around on one carrier in a lot of places for longer distance coverage as I understand it). Maybe my understanding is completely off, but this seems like writing an article about terrible flaws in automotive wheel bearings and closing with "we recommend that everyone avoid doing things that require use of wheel bearings."
- Kwpolska 4y ago
  There are many countries with some 3G service still available: https://www.thingsmobile.com/2g-3g-network-sunset-dates https://www.thingsmobile.com/2g-3g-network-sunset-dates