I'm talking about a class of
old mobile phones that are not smartphones but are still (theoretically) Internet-capable, at least via 3G. Examples of such phones include Series 40 Nokia phones or the
Samsung phone featured in Spectre (OK that one at least is still available so I have to retract the 'old' word). Note these phones enable running user code via their Java thingy. Symbian phones, however, are out of the scope of my question.
Note I don't ask about browsing the Internet with such phones - these capabilities are, in my experience, often all but useless nowadays anyway. Instead, I mean carrying the phone around while it is switched on and making phone calls.
Until recently I assumed these phones were too simple and too old to be unsafe... But is this really correct? It suddenly struck me that these phones are likely directly accessible from the Internet with an IP address. Aren't these phones, therefore, under a constant scan? To make things worse, many of such phones are very unlikely to receive updates (are they even technically capable of updating themselves?)
In short, one may not wish to browse the internet with their phone, will they be a target?
This question asks about dumbphones. My question asks about phones that are in-between dumbphones and smartphones - that already provide attack vectors (Internet, user code, ...?) but not precautions (updates, app scanning, ...?) of smartphones. It would therefore seem that such phones are the worst?
And yet there is, from my experience, noticeable demand for these in-between phones: namely from older people who seek the ease of use of a dumbphone, fear they could not manage to use a smartphone, but won't use a true dumbphone because of their limited availability. This, I believe, makes my question important.