Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The news has been filled recently with the allegations that News of the World employees hacked into the voicemail inboxes of celebrities and crime victims. What flaw was exploited to accomplish this, and what is the risk to other cell phone users?

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

According to this New York Times article, there were a couple of methods used.

The first was a simple password guessing attack by trying the operator default PIN, and the second method was a social engineering attack against the mobile phone network operator.

The password guessing attack is simple to mitigate against simply by changing the default PIN, the main UK operators have already set up procedures to mitigate against the second attack method

Orange, Three and T-Mobile no longer provide default voice mail pass codes; users must set their own. O2 and Vodafone will allow codes to be set only from the cellphones they supply. If that number is reset, the new code is also sent directly to the phone. Vodafone alerts customers if three failed attempts are made to enter the number, and O2 locks voice mail services.

share|improve this answer
    
Just found this useful post as well. –  jrdioko Jul 18 '11 at 18:17
add comment

This article explains a method that does not involve guessing or social engineering the voice mail PIN. Many mobile operators seem to configure voice mail access so that the PIN is not required when the subscriber calls from their mobile phone. In these instances, an attacker simply needs to spoof caller ID (so that the call seems to be originating from the victim's phone) and call the voice mail access number. Spoofing caller ID can be accomplished using some VoIP services and via other methods.

A countermeasure against this attack is for the subscriber to configure their voice mail to require the PIN in all cases, even when calling from their own phone.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.