Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A stranger walks up to you on the street. They say they lost their phone and need to make a phone call (has happened to me twice, and maybe to you). What's the worst a phone call could do?

Let's assume they don't run, don't plug any devices into the phone, they just dial a number and do whatever, and hang up.

I know this is an open ended question. Hopefully some intriguing ideas come from it before it's closed?

share|improve this question
8  
For what it's worth, if a stranger needed to borrow my phone, I'd dial the number myself and put it on speaker. This would reduce the chance of them running off, and also prevent most of the scams and schemes listed below, yet still allow me to be a good Samaritan to someone with a genuine need. –  aslum Dec 21 '12 at 16:11
    
It wouldn't prevent the premium rate dial scheme if there was someone there to answer. –  DelvarWorld Dec 24 '12 at 20:57
    
@DelvarWorld: Hopefully, you would notice that it's a premium number. –  SLaks Dec 24 '12 at 21:38

10 Answers 10

up vote 52 down vote accepted

A few scams I've seen making the rounds:

  • Use it to dial a premium rate number owned by the group. In the UK, 09xx numbers can cost up to £1.50 per minute, and most 09xx providers charge around 33%, so a five minute call syphons £5 into the group's hands. If you're a good social engineer, you might only have a 10 minute gap between calls as you wander around a busy high-street, so that's £15 an hour (tax free!) - almost triple minimum wage.
  • Use it to send premium rate texts. The regulations on there are tighter, but if you can get a premium rate SMS number set up, you can charge up to £10 per text. A scammer would typically see between £5 and £7 of that, after the provider takes a cut. It's also possible to set up a recurring cost, where the provider sends you messages every day and charges you up to £2.50 for each one. By law the service provider must automatically cancel it if they send a text sayin STOP, but every extra message you send gains you money.
  • Set up an app in the app store, then buy it on peoples' phones. This can be very expensive for the victim, since apps can be priced very high - some up to £80. In-app purchases also work. This is precisely why you should be prompted for your password on every app purchase and in-app purchase, but not all phones do so!
  • Install a malicious app, such as the mobile Zeus trojan. This can then be used to steal banking credentials and email accounts. This seems to be gaining popularity on Android phones.
share|improve this answer
    
Some very good updated points here! –  Henning Klevjer Dec 21 '12 at 9:02
3  
Bullet point #1: I have found my true calling. –  Thomas Dec 21 '12 at 10:15
    
+1 for the first two points, as the OP assumes that they "dial a number and do whatever, and hang up". I know whatever is broad, but I'm assuming that is akin to talk to or listen to the call, and not Install arbitrary software. –  Joshua Drake Dec 21 '12 at 19:27
4  
+1 Appears to be the only real attempt at answering this. Also, your picture is perfect for your "hat". –  Byte56 Dec 21 '12 at 19:35
1  
When I ran into some bad charges on my PAYG phone, it was very difficult to dispute them. It may be easier on contract, but I don't know. It's a YMMV thing. As far as links go, I don't have any atm (I'm using my tablet right now) but I can try to dig some yup later. –  Polynomial Dec 22 '12 at 12:25

with a USB rubber on android the pin password could be hacked (brute forced) http://hakshop.myshopify.com/products/usb-rubber-ducky

they could then create a backup of your device, they could analyse already created backups, they could download all of your saved data, media etc and use this to further penetrate other areas of interest.

https://santoku-linux.com

they could run the phone through a smartphone pentest framework, and infect it for botnet purposes.

http://georgiaweidman.com/wordpress/

they could hawk it for cash

http://www.cashamerica.com/

on a side note, if your lucky they could;

  1. correct any duplicate contacts you have
  2. organize your mobile media
  3. finishing posting your facebook post you left open
  4. beat that hard level on Angry birds for you
  5. Call your most called numbers to return your phone
  6. Call the carrier to report it lost/stolen
  7. etc
share|improve this answer

They could dial a USSD to get supplimental information about you or your device. Some UUSD codes have been documented to have the capability of doing a factory reset on your phone. Source

share|improve this answer

While detonating a bomb or EMP would be the most harmful, I think the following scenarios are much more likely to happen.

If you have a smartphone, it's very likely you have some kind of weather widget on the homescreen which tells the attacker what is your hometown. Also, I yet have to see a smartphone without news widget, which again, tells the attacker what kind of person you are. Are you following a finance news? Sport? IT? The very same thing can be done by just looking at your installed apps. Do you have any games? Which ones? Do you have any kind of booking apps? Does this kind of app keeps any sort of history? Well, in short, within just few second attacker can make pretty reliable profile of you. Do you have anykind of notebook app? What have you written in it?

The second threat is... Well, most likely you just gave him full access to all of your e-mail accounts and with a few presses on the screen, he could forward all of your mails to his account.

The last thing which I can remember are pranks. While this doesn't sound like anything danger, it can be really unpleasantly. The attacker could send to a random contact of opposite sex SMS - "Hey, I'm thinking about you...". Just imagine if this random contact is your wife's friend (now, the scenario of detonating nuclear weapon is not so scary, isn't it?). Or even more explicit message to a contact saved as your family member (e.g. Mother). He could also update your Facebook status, leave a message on a Twitter or upload some of your private photos to a public service.

share|improve this answer

Not very likely to most people here but they could detonate an IED on the other side of the world. A phone can do a lot of harm.

share|improve this answer
5  
I highly doubt a terrorist would borrow someone else's phone, leaving their DNA and fingerprints all over the device, and have a member of the public see their face. Especially when you can buy a cheap pay-as-you-go phone, top it up with cash, use it once, then throw it in a river. –  Polynomial Dec 21 '12 at 10:20
    
You are right. It is highly doubtable. –  Phil Dec 21 '12 at 12:58
1  
Why was this answer voted down to -1 while Mike Scott's very similar one was at +3? –  Dan Neely Dec 21 '12 at 14:33
    
Because someone was having a bad day and no humour/imagination. –  Phil Dec 21 '12 at 15:47
2  
@DanNeely - because providing the very same answer as already posted shouldn't be encouraged. While Mike's answer is not likely to happen and it's more of a joke, it's still has a point. –  StupidOne Dec 21 '12 at 20:36

With some phones it is possible to call system commands or even to lock the SIM card, just by visiting a prepared website. There was an article some time ago on Heise security about this problem.

share|improve this answer

Some mobile networks in the world allow users to transfer prepaid balances from one account to another. Alternatively, they might send some sort of incriminating SMS from your phone which may cause you issues with law enforcement officer.

share|improve this answer

They could use it to send the detonation signal to that nuclear weapon they've secreted in a warehouse in Manhattan. That's pretty much the worst-case scenario.

share|improve this answer
2  
this actually does seem like the worst thing they could do –  DelvarWorld Dec 21 '12 at 7:20
    
Possibly, but then he wouldnt need your phone, right? –  AviD Dec 21 '12 at 8:19
22  
sure he would. his phone is in the warehouse. Jesus. –  DelvarWorld Dec 21 '12 at 8:23
2  
You could also use the phone to call off armageddon! –  Henning Klevjer Dec 21 '12 at 9:04
7  
Surely the worst thing is to set off that nuclear weapon where I live, not Manhattan! –  jimbobmcgee Dec 21 '12 at 11:55

They could dial their own number to get yours (assuming your number isn't private.)

I think I just invented a new, somewhat forceful and creepy, pick-up move.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.