https://www.theverge.com/2023/3/16/23644013/samsung-exynos-modem-security-issue-project-zero Skip to main content The Verge logo.The Verge homepage * The Verge homepageThe Verge logo./ * Tech/ * Reviews/ * Science/ * Entertainment/ * MoreMenu The Verge logo. Menu * Samsung/ * Tech/ * Security Google says hackers could silently own your phone until Samsung fixes its modems Google says hackers could silently own your phone until Samsung fixes its modems / It found 18 vulnerabilities in Samsung's modems, four of which could give hackers a way in with just your phone number. By Mitchell Clark Mar 17, 2023, 1:23 AM UTC| Share this story * * * Illustration of two smartphones sitting on a yellow background with red tape across them that reads "DANGER" Photo by Amelia Holowaty Krales / The Verge Project Zero, Google's team dedicated to security research, has found some big problems in the Samsung modems that power devices like the Pixel 6, Pixel 7, and some models of the Galaxy S22 and A53. According to its blog post, a variety of Exynos modems have a series of vulnerabilities that could "allow an attacker to remotely compromise a phone at the baseband level with no user interaction" without needing much more than a victim's phone number. And, frustratingly, it seems like Samsung is dragging its feet on fixing it. The team also warns that experienced hackers could exploit the issue "with only limited additional research and development." Google says the March security update for Pixels should patch the problem -- though 9to5Google notes that it's not available for the Pixel 6, 6 Pro, and 6a yet (we also checked on our own 6a and there was no update). The researchers say they believe the following devices may be at risk: * Mobile devices from Samsung, including those in the Galaxy S22, M33, M13, M12, A71, A53, A33, A21, A13, A12 and A04 series * Mobile devices from Vivo, including those in the S16, S15, S6, X70, X60 and X30 series * any wearables that use the Exynos W920 chipset * any vehicles that use the Exynos Auto T5123 chipset It is worth noting that, in order for devices to be vulnerable, they have to use one of the affected Samsung modems. For a lot of S22 owners, that could be a relief -- the phones sold outside of Europe and some African countries have a Qualcomm processor and also use a Qualcomm modem, and thus should be safe from these specific issues. But phones with Exynos processors, like the popular midrange A53, and European S22, might be vulnerable. In theory, the S21 and S23 are safe -- Samsung's most recent flagships use Qualcomm worldwide, and the older ones with Exynos chips use a modem that doesn't appear on Samsung's list of affected chips. If you know your phone uses one of the vulnerable modems, and you're concerned about it being exploited (remember, attacks could "compromise affected devices silently and remotely"), Project Zero says you can protect yourself by turning off Wi-Fi calling and Voice-over-LTE. Yes, your calls will be worse, but it's probably worth it. Traditionally, security researchers will wait until a fix is available before announcing that they've found the bug, or until it's been a certain amount of time since they reported it without any fix in sight. It seems like it's the latter case here -- as TechCrunch notes, Project Zero researcher Maddie Stone tweeted that "end-users still don't have patches 90 days after report," which appears to be a prod at Samsung and other vendors that they need to deal with the issue. Samsung didn't immediately reply to The Verge's request for comment on why there doesn't appear to have been a patch yet. In total, Project Zero found 18 vulnerabilities in the modems. Four are the really bad ones that allow "Internet-to-baseband remote code execution," and Google says it's not sharing additional information on those right now, in spite of its usual disclosure policy. (Again, due to the fact that it believes they could very easily be exploited.) The rest were more minor, requiring "either a malicious mobile network operator or an attacker with local access to the device." To be clear, that's still not great -- we've seen how flimsy carrier security can be -- but at least they're not quite as bad as the others. Most Popular 1. VW beats Tesla to the punch and unveils an affordable electric vehicle ----------------------------------------------------------------- 2. Microsoft announces Copilot: the AI-powered future of Office documents ----------------------------------------------------------------- 3. Best printer 2023: just buy this Brother laser printer everyone has, it's fine ----------------------------------------------------------------- 4. Pornhub is under new ownership ----------------------------------------------------------------- 5. Microsoft's new Copilot will change Office documents forever ----------------------------------------------------------------- Verge Deals / Sign up for Verge Deals to get deals on products we've tested sent to your inbox daily. Email (required)[ ]Sign up By submitting your email, you agree to our Terms and Privacy Notice. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. From our sponsor Advertiser Content FromSponsor logo Sponsor thumbnail More from Samsung * Venus beside a crescent Moon on July 15th, 2018.Venus beside a crescent Moon on July 15th, 2018. The night sky is always getting faked * A relatively detailed photo of the Moon.A relatively detailed photo of the Moon. Samsung responds to fake Moon controversy * The Galaxy A34 in lime (left) and A54 in purple (right).The Galaxy A34 in lime (left) and A54 in purple (right). Samsung's midrange A-series phones get a Galaxy S23 facelift * Samsung Galaxy S23 Ultra in lavender, black, green, and cream shown from the rear.Samsung Galaxy S23 Ultra in lavender, black, green, and cream shown from the rear. Samsung's Moon photos are fake -- but so is a lot of mobile photography * Advertiser Content FromSponsor logo The Verge logo. * Terms of Use * Privacy Notice * Cookie Policy * Do Not Sell Or Share My Personal Info * Licensing FAQ * Accessibility * Platform Status * How We Rate and Review Products * Contact * Tip Us * Community Guidelines * About * Ethics Statement The Verge is a vox media network * Advertise with us * Jobs @ Vox Media (c) 2023 Vox Media, LLC. All Rights Reserved