Hackers can take over out-of-date Samsung phones

Security firm Kryptowire is warning a wide range of Samsung devices are vulnerable to a major security flaw that allows hackers to take over a device.

Kryptowire makes Mobile Application Security Testing (MAST), a tool that scans for vulnerabilities, as well as security and privacy issues. According to the company, it discovered a vulnerability (CVE-2022-22292) that could allow a hacker to take a range of actions, including making phone calls, installing/uninstalling apps, weakening HTTPS security by installing unverified certificates, running apps in the background, and even factory resetting a device.

See also: What are Android security updates, and why do they matter?

The vulnerability appears to impact virtually all Samsung smartphones running Android 9 through 12, thanks to the pre-installed Phone app that has an “insecure component.” Because the Phone app runs with system privileges, this opens up an attack vector for bad actors. Malicious apps can use the Phone vulnerability to “mimic system-level activity” and access functionality that would otherwise be protected.

Alex Lisle, CTO of Kryptowire, described the implications of the vulnerability:

“Ever think someone else has access to your phone? Unfortunately, you may be right. Mobile applications are becoming the primary point of personal and professional activity, representing an increasingly attractive target for bad actors.”

Kryptowire first discovered the vulnerability in November 2021 and notified Samsung. The company released a fix in February 2022. All Samsung users are encouraged to update immediately to ensure their phones are safe.

Next: How to tell if your computer has been hacked