Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google urges Android phone users to switch off Wi-Fi calling

scrippsnews.com

Post reply on HN
Print view View original

141–150 of 178 posts

Re: Google urges Android phone users to switch off Wi-Fi calling

#141

Post by ddod »

saagarjha wrote: post #131
ddod wrote: post #118

Four things of note: 1. I've not seen anyone explain whether this could be exploited by anyone with access to phone lines (i.e. Twilio users) or not and if it would be trivial to try the vuln with every phone number you could find in any DB. If those things are the case, it seems like the chances would be very high that this would be or has already been exploited and affecting every unpatched phone. 2. It seems like…

> Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number.

I read that as well, and either it's unclear or I lack the technical understandings to apply that to my question.

What does "at the baseband level" mean in terms of remote attack vector? Do they need to be physically nearby with an antenna or could they be across the world connecting through VOIP?

And why do they need to know a phone number? If it's that they need a nearby antenna + knowledge of a phone number, it sounds like this vulnerability might not be a big deal, and it would be great if they communicated that clearly. Alternatively, if the vulnerability is accessible from any remote phone connection, knowledge of a phone number wouldn't matter because attackers would spam the attack against millions of numbers.

Re: Google urges Android phone users to switch off Wi-Fi calling

#142

Post by davideg »

ggm wrote: post #87

This is extremely unhelpful headlinese 1) not all phones 2) chipsets in phones vary by where they are sold. 3) only exynos chipset phones are affected. in some economies. sold by some vendors. Not all models with a given name and code number (pixel 7, samsung 22) will be affected. "it depends" 4) not all manufacturers declare their chipset so 5) it is almost impossible for anyone but the cogniscenti to know if they a…

I greatly appreciate your nuance to cut through the FUD! I reflexively disabled Wi-Fi Calling on my Google Pixel 7 Pro phone.

A cursory Google search indicates that exynos modems don't support CDMA (apparently it's too expensive to license from Qualcomm) and are largely sold outside the USA. As a Verizon customer in the US, I believe this means I'm in the clear.

Like another commenter, a side effect of responding to this article was discovering that the March 2023 security patch is available (even though I didn't get a notification about it).

Re: Google urges Android phone users to switch off Wi-Fi calling

#143

Post by saagarjha »

ddod wrote: post #141
saagarjha wrote: post #131

Earlier quoted context omitted.

> Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number.

I read that as well, and either it's unclear or I lack the technical understandings to apply that to my question. What does "at the baseband level" mean in terms of remote attack vector? Do they need to be physically nearby with an antenna or could they be across the world connecting through VOIP? And why do they need to know a phone number? If it's that they need a nearby antenna + knowledge of a phone number, it so…

In effect, it means if they can call you, they can exploit you. The description given was what an attacker needs to hack you in particular, which means they need your phone number to determine which device to target. If they want to spam a million users they could do that too, although these kinds of things are typically not done this way because that is very noisy and reduces the effective life of the vulnerability.

Re: Google urges Android phone users to switch off Wi-Fi calling

#144

Post by Kwpolska »

wodenokoto wrote: post #115
ggm wrote: post #87

This is extremely unhelpful headlinese 1) not all phones 2) chipsets in phones vary by where they are sold. 3) only exynos chipset phones are affected. in some economies. sold by some vendors. Not all models with a given name and code number (pixel 7, samsung 22) will be affected. "it depends" 4) not all manufacturers declare their chipset so 5) it is almost impossible for anyone but the cogniscenti to know if they a…

Given 5, it sounds pretty reasonable to recommend everyone to turn it off. Given 6, it sounds difficult to follow that advice.

It doesn't sound reasonable to me to recommend disabling something without providing even minimum information on how someone could exploit it so that I can determine if it's likely to be exploited against me. I could live without VoLTE and Wi-Fi Calling, but some people live in areas with bad cell coverage, or no 2G/3G coverage, so they just can't turn it off.

Re: Google urges Android phone users to switch off Wi-Fi calling

#145

Post by pjmlp »

barbazoo wrote: post #31
mikepurvis wrote: post #21

Earlier quoted context omitted.

I guess, but it sure is nice that on Apple hardware you generally don’t need to worry about doing this calculus because they deliver updates in a timely manner to even five year old devices. It bums me out that them doing this hasn’t been effective in shaming everyone else into following suit.

According to Wikipedia the Pixel 2 received security updates for less than 3 years. None of their devices got more than 3 years 3 months of updates. That should be illegal honestly, couldn't be more clear that they don't care about sustainability. https://en.m.wikipedia.org/wiki/Google_Pixel

I still remember when phones did not receive any updates, and the few lucky models required developer tools to manually upload the firmware updates, which most of those few selected models only got one in their lifetime.

Re: Google urges Android phone users to switch off Wi-Fi calling

#146

Post by Kwpolska »

fencepost wrote: post #96
GeekyBear wrote: post #93

Earlier quoted context omitted.

> Interesting that earlier coverage of this also indicated VoLTE as vulnerable The initial reporting on Project Zero's findings was pretty clear that this was the case. >"Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number," Willis wrote…

Willis suggests turning off Wi-Fi calling and Voice-over-LTE (VoLTE) to protect against baseband remote code execution, if you're using a vulnerable device powered by Samsung's silicon. The problem is that that's a very sterile way to say "turn off all voice calling features on affected devices" unless I'm misunderstanding how modern cell networks function. Without VoLTE in pretty sure devices need to fall back to 3G…

There are many countries with some 3G service still available: https://www.thingsmobile.com/2g-3g-network-sunset-dates

Re: Google urges Android phone users to switch off Wi-Fi calling

#147

Post by starchturrets »

hulitu wrote: post #125
est31 wrote: post #22

Earlier quoted context omitted.

I've been a (happy) Lineage OS user since 2013, and Pixel 2 is still supported by them, so you can check them out. But note that the security updates provided by Lineage OS only pertain to the Android part, not the modem part. This isn't something that a third party OS vendor can fix, as the modem/firmware updates are supplied by the device vendor. And even those are reliant on their suppliers, so ultimately unless t…

> It's just such an incredibly good TCO for really good security Good security when you cannot turn WiFi and mobile data off because it has to talk to mothership ?

You can turn off WiFi and cellular data on iOS.

Re: Google urges Android phone users to switch off Wi-Fi calling

#148

Post by elaus »

ipaddr wrote: post #128
jhoechtl wrote: post #119

Earlier quoted context omitted.

Just to be sure. A Samsung Galaxy S2? This phone is like 15? years old and still in use?

My desktop has been running for longer

PCs are much easier to upgrade than phones. I ditched my Galaxy S2 many many years ago, but my PC is still fine after a few upgrades (e.g. SSDs).

Re: Google urges Android phone users to switch off Wi-Fi calling

#149

Post by hbossy »

jhoechtl wrote: post #119
22c wrote: post #107

Earlier quoted context omitted.

It's also not crystal clear which Exynos chipsets are affected. I have a Samsung Galaxy S10e and a Samsung Galaxy S2 which both have Exynos chipsets, but I can't tell if there's simply no mention of these being affected because they're older models, or if it's explicitly only the newer models that are affected.

Just to be sure. A Samsung Galaxy S2? This phone is like 15? years old and still in use?

There's not a single feature added to phones during that time worth replacing working device for average user.
Post reply on HN