Can my phone be hacked just by being called?

Question

I recently found a site, Cell-Spy-Stealth.com, that claims to sell spyware which can be targeted on a phone by simply making a call to it: "It will work even if you get the voice mail, or if the target phone is password protected." It claims that after this one-time call, your phone will have access to all live SMS, calls, photos, videos, data, GPS (if enabled) and even the microphone while unused. It further claims that it is 100% undetectable and untraceable.

Is this really possible? If so, would there be any way to neutralize such a breach?

Answer 1

Any site that claims to be able to do that is a scam. Such technology would have to exploit some kind of backdoor, and if such a backdoor exists, it would only be known to law enforcement. If knowledge of such a backdoor leaks, you can be sure that there would be a media frenzy over it, and the vulnerability would quickly be fixed.

Phone monitoring software exists, but all of the legitimate ones require either physical access to the phone to install, or finding a way to deceive the owner into installing it.

Answer 2

There certainly are zero-day exploits out there for Android and iOS. So the technology exists for this to be real. In fact there is a thriving black market where discoverers of these exploits can sell them to the highest bidder -- here is an interesting article on that topic.

That said, according to the above article, Android exploits sell for $30,000 - $60,000 and iOS exploits for $100,000 - $250,000. Nobody is going to spend that kind of money on the black market and then turn around and open a junk website where people can see if their "Daughter is still seeing that no good jerk" for $27.

Also consider that once someone starts waving a vulnerability around the internet like that, it's usually a matter of days until Google or Apple figure out what's going on and patch it. Vulnerabilities only stay vulnerabilities if you keep them secret (unless people are using a version of Android so old that it's not getting updates anymore, in which case they're on their own).

More likely, this is a scam where you pay them $27 for the privilege of getting your own phone infected. The main tip-off is that they want you to download and run their software -- and not even through the app store.

Answer 3

There is known vulnerability called: Stagefright, but it works by sending you a MMS message. It only works in Android and new models have been patched.

I agree, it smells to a scam. Perhaps they know some vulnerability, but that could only work either in iOS or Android, but I don't think in both. Also it will depend on the model (OS version and hardware). As tlng05 said, if such vulnerability exists, it would have hit the news. Perhaps it is not confirmed yet? I agree with Mike Ounsworth that its more possible they want your phone infected and they will be able to control your phone / hijack it by installing their app.