4

My phone is newly bought. Can a hacker actually scan the mobile phone signal around me, detect it, and put virus/malware into my phone THROUGH the mobile phone signal of my mobile service provider?

Let's assume the hacker doesn't know my number.

I turn off bluetooth and have no wifi connection.

5

Yes. An individual hacker may do this via a femtocell tower. These are heavily demonstrated at security conferences. These devices can trick your device into installing rouge malware.

Additionally, on a larger scale, rogue cell phone towers have been discovered and could potentially have the same capabilities.

In both cases the devices trick your phone into thinking that it is connecting to it's trusted carrier network. From here the rogue devices can intercept and inject data at will.

  • 3
    The simple fact of connecting to a rogue tower doesn't mean the phone is compromised; it just means the attacker has control of the phone's Internet connection and can intercept/send data to it. He still needs to find an exploit on the phone that allows him to execute malicious code via the network. – user42178 Dec 30 '14 at 7:50
  • Such as pushing "sofware" updates, that is mentioned as a capability of these devices – KDEx Dec 30 '14 at 12:02
  • 1
    Software updates are either signed and/or delivered through HTTPS, making the delivery of a rogue update very hard if not impossible. – user42178 Dec 30 '14 at 22:59
2

If by "hacker" you are referring to government agencies, it may be possible, but no one would know. There are rumors that governments may have secret backdoors that allow them to remotely install malware, but they are just that - rumors. Most phone malware infections happen when users install shady apps from unofficial app stores, not remotely through a wireless signal. There isn't any publicly known way to wirelessly infect a phone, and if there were, the hole would be patched very quickly.

However, a hacker does not need to install malware to spy on you. Anyone willing to shell out some money can purchase a fake base station that impersonates a cell tower, tricking your phone into connecting and allowing them to intercept your calls and messages. Unfortunately there's really no good way to protect yourself against this, outside of using encryption apps for all of your calls, texts, and browsing.

  • for example, let's say I use Maxis, can the fake base station method happened? – User Dec 30 '14 at 5:03
  • @User yes, virtually every phone is vulnerable to cell tower impersonation. It is a basic flaw in the design of cellular networks. – tlng05 Dec 30 '14 at 5:11
  • how does cell tower impersonation can FIRST happened? Does it required YOUR PERMISSION to connect to them in order for that to work, or they can just connect to you without your permission? – User Dec 30 '14 at 5:15
  • @User Your phone willingly connects to them because it does not know the tower is fake. It does not require your permission. It only requires that you are physically close to the fake tower. – tlng05 Dec 30 '14 at 5:40
  • I know about phone calls and text message, but does an attacker able to put malware into my phone through the cell power impersonation? – User Dec 30 '14 at 6:00
1

No, but an attacker could build a mobile base station and intercept all your communications within close proximity by spoofing your carriers mobile base station and acting as a MITM between you and the cell tower, not something many people can do or let alone would take the necessary steps to obtain the hardware to do it.

-2

Not from what i know, if by 'hacker' you mean a person, or a group it would be nearly impossible, they could even do what the people above said but if you just a normal person why someone would do that much effort to listen to your useless communications ? If you talk about a three letter gov agency then it may be possible to do that but not only using your phone signal, here it may be how they can do it:

1.Malware can installed in various ways, including fake software updates, emails with fake attachments, and security flaws in popular software. Sometimes the surveillance suite is installed after the target accepts installation of a fake update to commonly used software. One example i'm aware of is FinFisher, also known as FinSpy.

2.Hacking to your PC and then install an spyware on your phone when you connect it via USB or maybe even by just being in the same wireless network.

3.Just force your phone provider like AT&T or Verizon to just hang out your data, some paranoid people even believe they already have backdoor installed on their system so the gov can just spy anyone without even talking to the phone provider or your ISP, this may be true or not.

Remember that even your apps and sites your visit on your phone can track you using cookies,browser fingerprint.(I recommend using Ghostery app browser for visiting sites) Now here how to protect you against that:

1.Ignore all updates of programs you use, if you want to upgrade them do it only in their official websites using HTTPS if you can.

2.Never open attachments you receive by email, even if it looks like its from Google,or Windows

3.A security flaw in Apple's iTunes allowed unauthorized third parties to use iTunes online update procedures to install unauthorized programs, that seems to be patched but it's best to not let any app to auto-sync to your phone.

4.Only install apps from Google play store or from sources you can trust and NEVER let checked the option Unknown Fonts(may be look different on your device, mine is not in english so i'm doing a translate here)

5.Always check your apps permissions,if an notepad like app wants to send SMS or do calls then you should be very suspicious about it.

Is your phone rooted? Don't seems that way, but if you are really concerned i think you should root it because then you can harder android by that ways:

When you root, you usually install a superuser manager that prevents apps from gaining root access without you know, that may prevent someone from unloading something in your phone that can root it without you know and then your phone will be in their hands.

  • Freedom - your final 5 points are interesting from a privacy perspective, they have nothing to do with the question, which is not about privacy. I have edited them out. – Rory Alsop Jan 2 '15 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.