If you only disable WiFi, mobile data, NFC and Bluetooth you still leave normal telephony and SMS/<strike>MMS</strike>. MMS was for example the attack vector for exploiting the [Stagefright bug](https://en.wikipedia.org/wiki/Stagefright_(bug)) which is still not fixed on all mobile phones. Even if mobile data are switched off you'll still receive a SMS notification about the pending MMS which is spooled at the provider and will usually be automatically downloaded as soon as mobile data are available again. This means that the Stagefright exploit will not be triggered when somebody sends the message to you but only once you feel safe again to turn mobile data on again.<br> In other words, it might still be possible to hack your phone this way, only that the exploit will not be active immediately. Apart from this known bug there might be still unknown or unpublished bugs which use the ability of the attacker to send data to your phone even if most of the communication services are switched off like you do. For example there might be bugs in the handling of plain SMS messages or handling of GPS data or by processing normal calls which might be triggered for example with customized GSM stations or GPS spoofing equipment. The data processing stacks are often not developed with an attacker in mind which works at the lower protocol level which can be seen for example by the far reaching [recent exploit of Broadcom chips](https://arstechnica.com/information-technology/2017/07/broadcom-chip-bug-opened-1-billion-phones-to-a-wi-fi-hopping-worm-attack/) (which requires WiFi at least partly on).