The news has been filled recently with the allegations that News of the World employees hacked into the voicemail inboxes of celebrities and crime victims. What flaw was exploited to accomplish this, and what is the risk to other cell phone users?
According to this New York Times article, there were a couple of methods used.
The first was a simple password guessing attack by trying the operator default PIN, and the second method was a social engineering attack against the mobile phone network operator.
The password guessing attack is simple to mitigate against simply by changing the default PIN, the main UK operators have already set up procedures to mitigate against the second attack method
This article explains a method that does not involve guessing or social engineering the voice mail PIN. Many mobile operators seem to configure voice mail access so that the PIN is not required when the subscriber calls from their mobile phone. In these instances, an attacker simply needs to spoof caller ID (so that the call seems to be originating from the victim's phone) and call the voice mail access number. Spoofing caller ID can be accomplished using some VoIP services and via other methods.
A countermeasure against this attack is for the subscriber to configure their voice mail to require the PIN in all cases, even when calling from their own phone.