Tag Info

Hot answers tagged

98

It is absolutely not secure. Text messages function essentially the same way email does: your client (phone) forwards it to a server, which then looks up a destination which may be on another network (carrier) and then sends it over where it is held in a mailbox until a phone gets it. Anywhere along the way it can be copied, retained longer than expected, ...


55

GSM includes some protection through cryptography. The mobile phone and the provider (i.e. the base station which is part of the provider's network) authenticate each other relatively to a shared secret, which is known to the provider and stored in the user's SIM card. Some algorithms known under the code names "A3" and "A8" are involved in the ...


54

A few scams I've seen making the rounds: Use it to dial a premium rate number owned by the group. In the UK, 09xx numbers can cost up to £1.50 per minute, and most 09xx providers charge around 33%, so a five minute call syphons £5 into the group's hands. If you're a good social engineer, you might only have a 10 minute gap between calls as you wander ...


44

As you found out, a SIM card is only required for initializing a connection to the mobile carrier and is not required anymore until the device loses the connection and needs to reconnect (which happens very frequently with mobile devices when you move them around). Your device might power down when the SIM card is removed, but there is no good reason why it ...


42

What are the technical aspects to tracing a phone call; is it more difficult for mobile phone? In the old days, signaling was inline, hence the 2600hz hack. Calls were setup as one switch talked to another, then another, and so on until a circuit was established end-to-end. In the modern age, everything is out-of-band over SS7 and every switch is lined ...


29

Who's to say that the phone is really off? If someone controls the firmware of the device then the off functionality could be replaced with state in which the phone appears to be "off" but is in fact maintaining a line of communication to a remote user. However firmware cannot stop you from introducing a hardware switch to disconnect the microphone. A ...


25

For telecommunications, checkout GSM, CDMA, TDMA, and EDGE. The two competing protocols in the United States are GSM and CDMA. The resources linked below are lacking when it comes to CDMA, but using site:defcon.org and site:blackhat.com in your Google searches will turn up some presentations. For interception of GSM, I refer you to a white paper on ...


24

A SIM identifies you with your network operator; it is necessary to be able to receive calls and to bill you for calls you make. Without a SIM, a phone is mostly useless as a phone, but it can still make emergency calls (in most countries). Without a SIM, your cell phone will not normally transmit data to local base stations, but if you make an emergency ...


23

Just wanted to chime in and say that the list you have there isn't entirely 100% accurate, but it is close. Keep in mind that this will vary per MDM vendor and mobile OS, but MobileIron can see your location if your employer enables the functionality and you choose to accept sharing your location data. How exactly is this done? They just configure ...


21

You are right in that one of the ways an attacker could intercept the code is to hack your phone. An attacker could also: Clone your phone's sim, and request a banking code to be sent to your phone's number. they could also possibly clone a non-sim phone as well Steal your phone. Once they have your phone they could perform transactions Perform a man in ...


21

As @Lighty said, the IMEI is a unique identifier for your phone (not the SIM card though, that would be the IMSI). You can think of it as an equivalent to a MAC address in Ethernet. The IMEI could be spoofed to impersonate you / your phone. Your phone could get traced in a network using the IMEI (It actually is to maintain your connection). The IMEI is also ...


20

They could use it to send the detonation signal to that nuclear weapon they've secreted in a warehouse in Manhattan. That's pretty much the worst-case scenario.


19

They could dial their own number to get yours (assuming your number isn't private.) I think I just invented a new, somewhat forceful and creepy, pick-up move.


18

Changing your e-mail and phone number is silly. Your phone number, unless unlisted, is a matter of public record and easily discoverable. Even if unlisted, it is still a publicly shared identifier that can be discovered with some investigating. Your e-mail address is also a public identifier and can be discovered with some effort. Having identifiers in ...


17

By law, faxes have to have the sender's phone number printed across the top. This is by law, not technical requirement, which means it's quite possible to not have that information, or at least not have it correct. Either way, you should have call records available from your phone company to help track the perpetrator. Armed with that information, go file a ...


17

Your carrier certainly sees the target IP address of the packets that you are asking them to transmit. The carrier's job is to, indeed, carry your packets from your phone to the base station, and, from that base station, to route it to the nearest infrastructure link so that it may reach its ultimate destination. In your case, all the packets that you send ...


17

We get these too in Australia. The consensus in the Internet seems to be that these are automated calls from cold call telemarketers. These automated callers calls random numbers and wait for the call to be received. When you pick up the phone, what's supposed to happen is that your call will then be routed to the next available telemarketer agent within a ...


16

There are many VoIP services that provide ID-spoofing functionality Jumblo: Create an account and add some credit to it (10 Euros minimum excluding VAT), then install their Android app, login, the go to Settings and choose "Add Caller ID" then add the number. (Requires SMS verification) * Skype: You can create an online number (15 Euros minimum) then add ...


16

Mostly, two-factor authentication reduces the need for strong passwords in the same way as safety belts in cars reduce the need for efficient brakes. When you drive your car, your probability to be killed during a given journey is the probability of your having an accident, multiplied by the probability of your being killed when an accident occurs. Good ...


16

Sending the password through sms/texting was, as far as I can tell, originally intended to be used to ensure the password came in through a different medium than the encrypted file you were receiving the password for. An encrypted file would be sent through email and the user would receive a plain-text sms on his phone with a password. This would ...


16

Your sensitive information travels through different mediums and systems to get to the bank, and yes, there are vulnerabilities along this path. First, it is transmitted from your finger tips to your dialler application. It can be intercepted by malware running on your phone. There is a new vulnerability in Android called Stagefright that can get full ...


14

For the most part[1] they are encrypted, but not sufficiently enough to be considered as safe, tap resistant encryption. GSM uses 64-bit A5/1 encryption that is weak, to say the least. $15 phone, 3 minutes all that’s needed to eavesdrop on GSM call article from ArsTechnica covers it pretty well IMO, if you care to read more about it. However, it also ...


14

IMEI is like a GUID (Global Unique Identifier), that identifies your unique handset. Your carrier can blacklist your IMEI by instructing the GSM Alliance to do so, so that the mobile can't connect to any networks, usually in the case the handset is lost or stolen. Your handset's IMEI is sent in the handshake process when connecting to a network, and can be ...


13

If you have a phone with a removable main battery, you can try this: Disable the cellular network, GPS, WiFi, Bluetooth etc on your phone by turning them off manually and then putting the phone into flight mode. Make a note of the current time shown on the phone and on your PC by writing it down on paper. Shut down the phone, remove the main battery and ...


12

Yes, this is accurate. If your version of the Android OS has known privilege escalation vulnerabilities, there is nothing stopping a rogue application from exploiting a privilege escalation vulnerability and thus escaping the sandbox (i.e., gaining unrestricted access to your phone). This absence of security upgrades is a shortcoming of the Android ...


12

The SIM card must be plugged into a device for it to be functional in any way. It does not contain a power supply or an antenna. As such, it'd be impossible to track a SIM card on its own. However, once you plug it into a phone and power it on, the IMEI number of the phone and the SIM's serial number will be transmitted to the nearest cell tower(s).


12

Yes, it is possible and almost trivial to make your phone call appear to come from a different number. Since many calls originate from within internal networks (e.g. PBX systems), the phone companies have a mechanism allowing the caller to indicate which phone number the call originates from. Traditionally there has been no restriction on which outgoing ...


12

You're trying to take away communications capabilities from a tool designed to communicate. It's probably not the best choice of devices. You can start by setting the phone into "airplane mode", which is intended to shut off the radios. Because of the way RF works, that means it shuts off both transmitting and receiving. It should keep you safe, but of ...


11

Well, many people consider Location data to be sensitive, as you'd imagine. The classic example is someone being stalked - they don't want their location out on the Internet anywhere. I suppose what's special about location is that it usually happens automatically and so it's easy to accidentally leak information. For example, I'm unlikely to accidentally ...


11

The whole idea about a second factor/step for authentication is to provide two independent layers of security. Vulnerabilities in one layer should not affect the security of the other. Second factor authentication was designed and used properly in the past but lately it has been weakened by companies who care more about profit than security. SMS messages ...



Only top voted, non community-wiki answers of a minimum length are eligible