Exploit allows calling with locked Samsung smartphones via USB

Two Italian researchers have demonstrated a method to make a locked Samsung Galaxy smartphone call via a command on a connected Linux PC. Since the hack requires physical access to the device, the consequences are limited.

The most logical exploit is that it allows attackers to make stolen devices call expensive toll-free numbers for hours on end, earning money and chasing the original owners. That trick always works, because the device can call from a locked state, the researchers report on GitHub.

The hack works because Samsung’s older devices give direct access to the phone’s modem, which is responsible for making phone calls and sending text messages. With newer phones, Galaxy’s only give access via media transfer protocol, but via a trick it is still possible to access the modem. The trick only works under Linux.

The researchers, Roberto Paleari and Aristide Fattori, tested the trick on the Galaxy S6, Note 3, S4 mini in two variants and the S4. The researchers do not know whether other firmwares or devices are also affected. They informed Samsung in November last year. End of last year tweeted Paleari a video of the exploit.