Like its name suggests, T-Mobile's Wi-Fi Calling feature lets users make and receive calls over a Wi-Fi network — but a vulnerability in an older version of the system could have opened users open to attack. SecurityWeek reports that UC Berkeley graduate students Jethro Beekman and Christopher Thompson discovered the certain versions of the Wi-Fi Calling software didn't properly validate the server-side security certificate used in the feature. As such, malicious individuals on the same Wi-Fi network as a user would have been able to fool a user's phone into thinking their machine was one of T-Mobile's servers. This man-in-the-middle attack would let an attacker place their computer between the user and T-Mobile, allowing them to intercept phone calls and text messages sent from the compromised device.

The researchers confirmed the attack worked on the Samsung Galaxy S Relay 4G and the Samsung Galaxy Note II — though they say an assortment of other devices were also vulnerable, including the Galaxy S II, HTC Amaze 4G, and the LG myTouch Q. Beekman and Thompson informed T-Mobile of the vulnerability on December of last year; as of March 18th, they say, all affected devices have received a software update solving the problem.