> Interesting that earlier coverage of this also indicated VoLTE as vulnerable
The initial reporting on Project Zero's findings was pretty clear that this was the case.
>"Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number," Willis wrote in a breakdown of the security flaws.
Willis suggests turning off Wi-Fi calling and Voice-over-LTE (VoLTE) to protect against baseband remote code execution, if you're using a vulnerable device powered by Samsung's silicon.
Willis suggests turning off Wi-Fi calling and Voice-over-LTE (VoLTE) to protect against baseband remote code execution, if you're using a vulnerable device powered by Samsung's silicon.
The problem is that that's a very sterile way to say "turn off all voice calling features on affected devices" unless I'm misunderstanding how modern cell networks function. Without VoLTE in pretty sure devices need to fall back to 3G (effectively off in most of the world) or 2G (not much better, though it's still around on one carrier in a lot of places for longer distance coverage as I understand it).
Maybe my understanding is completely off, but this seems like writing an article about terrible flaws in automotive wheel bearings and closing with "we recommend that everyone avoid doing things that require use of wheel bearings."
The initial reporting on Project Zero's findings was pretty clear that this was the case.
>"Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number," Willis wrote in a breakdown of the security flaws.
Willis suggests turning off Wi-Fi calling and Voice-over-LTE (VoLTE) to protect against baseband remote code execution, if you're using a vulnerable device powered by Samsung's silicon.
https://www.theregister.com/2023/03/17/android_google_projec...