Cell phone voice mail hacking

Question

The news has been filled recently with the allegations that News of the World employees hacked into the voicemail inboxes of celebrities and crime victims. What flaw was exploited to accomplish this, and what is the risk to other cell phone users?

Answer 1

According to this New York Times article, there were a couple of methods used.

The first was a simple password guessing attack by trying the operator default PIN, and the second method was a social engineering attack against the mobile phone network operator.

The password guessing attack is simple to mitigate against simply by changing the default PIN, the main UK operators have already set up procedures to mitigate against the second attack method

Orange, Three and T-Mobile no longer provide default voice mail pass codes; users must set their own. O2 and Vodafone will allow codes to be set only from the cellphones they supply. If that number is reset, the new code is also sent directly to the phone. Vodafone alerts customers if three failed attempts are made to enter the number, and O2 locks voice mail services.

Answer 2

This article explains a method that does not involve guessing or social engineering the voice mail PIN. Many mobile operators seem to configure voice mail access so that the PIN is not required when the subscriber calls from their mobile phone. In these instances, an attacker simply needs to spoof caller ID (so that the call seems to be originating from the victim's phone) and call the voice mail access number. Spoofing caller ID can be accomplished using some VoIP services and via other methods.

A countermeasure against this attack is for the subscriber to configure their voice mail to require the PIN in all cases, even when calling from their own phone.