Quick Share is the default wireless file-sharing system on Galaxy phones and tablets, and researchers recently discovered (via Help Net Security) several security vulnerabilities in it. Similar vulnerabilities were also found in Apple’s AirDrop. So, do you need to worry about your data being stolen through Quick Share?
Can an attacker steal your data through Quick Share vulnerabilities?
The short answer is no. You don’t need to worry about your personal data, such as photos, videos, and documents, being stolen through the recently discovered Quick Share vulnerabilities on Galaxy phones.
The vulnerabilities exist because both AirDrop and Quick Share expose certain background processes before verifying the identity of the person trying to send you a file. An attacker within about 30 meters (98 feet) armed with a laptop can exploit these flaws to repeatedly crash those background processes.
In practice, this means an attacker can temporarily stop Quick Share from working on your Galaxy phone or tablet. This type of attack is known as a denial-of-service (DoS) attack. However, it does not allow an attacker to access or steal the personal files stored on your device.
Researchers used a Galaxy S23 Ultra running firmware version S918BXXS8EZA1 and using Quick Share (version 13.8.01.11) and GMS (version 26.05.34) to search for Quick Share's vulnerabilities.
Following the discovery of these vulnerabilities, Apple has already fixed one of the three reported AirDrop issues, while Google has released a patch for the Quick Share app on Windows. The remaining Quick Share vulnerabilities affecting Android devices, including Galaxy phones and tablets, are expected to be addressed in an upcoming security update.
What can you do on your Galaxy device to reduce the risk?
Until that update arrives, you can take a simple precaution. Open the Settings app on your Galaxy phone or tablet, navigate to Connected devices > Quick Share, tap on Who can share with you and choose the Contacts option.
On newer versions of One UI, Quick Share automatically switches back to Contacts exactly ten minutes after you select Everyone, providing an additional layer of protection. So, you don't need to do anything additional.
Loading ... 
