Skip to main content
103 votes

How can caller ID be faked?

Ars Technica did a superb piece on this a couple of years ago. A woman who is a real estate agent and publishes her cell phone, was inundated with junk calls. What was odd about these was They were ...
Machavity's user avatar
  • 3,798
90 votes
Accepted

Someone called someone else with my phone number

Someone placed a call to 'the guy', and spoofed the caller id to make it look like the call came from your phone number. Caller-id spoofing is not uncommon, and there are even VOIP services that ...
mti2935's user avatar
  • 23.6k
89 votes
Accepted

Can phone apps read my clipboard?

Android Prior to Android 10 any app could freely register listeners to receive the clipboard contents whenever they changed. As of Android 10, only the current app with focus and any app set as the ...
pri's user avatar
  • 4,446
70 votes

Charging someone else's cell phone in my car

Since I don't know your car model but you seem to be concerned about information security and the fact that the possible attacker chose your car I make the assumption that the USB port in your car is ...
Noir's user avatar
  • 2,573
65 votes

Is a 'dumbphone' mobile more secure for basic phone calls than a smartphone?

Has the security of the basic phone call changed much, in the last 10 years ? So, do smartphones utilise anything new [purely in] the initiation and connection of just the phone call itself ? Yes. ...
Hacktiker's user avatar
  • 934
64 votes

"This used to be my phone number"

It's a known scam attempt. The caller probably compromised one of your accounts, and got stopped by the 2FA token sent to your phone. If you send them the token, your account is fully compromised. Or, ...
ThoriumBR's user avatar
  • 54.5k
58 votes
Accepted

Is revealing the phone number during OTP verification process considered a vulnerability?

The primary attack method against text message OTP is to 'sim swap' and take over the target's phone number. If the site provided the full number in this scenario, they'd be giving the attacker ...
gowenfawr's user avatar
  • 72.9k
50 votes
Accepted

Why does my digital bank need my phone date and hour to be correct?

One of the reasons can be the usage of the digital signature. If the time on your phone differs essentially from the actual current time, this may cause your phone to reject signatures done by the ...
mentallurg's user avatar
  • 12.4k
45 votes
Accepted

Why do web sites show my iPhone using different IP addresses for HTTP and HTTPS (cellular only)?

I am just going to take a guess here. Your telephone data carrier may have an optimizing or caching proxy for content whose IP address appears in your JSON result. As the proxy has no visibility ...
Akber Choudhry's user avatar
42 votes

How should I verify a caller is from the bank or company they claim?

I would refuse to give out any personal details to anyone that called me as you can't verify who they are. If they need to talk to you then say you can call back. You can then call through on the ...
ChrisM's user avatar
  • 332
33 votes

How can caller ID be faked?

Security of the PSTN is horrifically poor. It's very easy to spoof anyone's number on Caller ID, without having to hack into any of their systems. As such, Caller ID provides no real assurance of who ...
Joseph Sible-Reinstate Monica's user avatar
29 votes

How can caller ID be faked?

The CallerID displayed on the phone was never designed to be secure. Most VoIP (telephone over the internet) providers will allow the end user to set the outgoing number to be whatever they want. ...
Steve Sether's user avatar
  • 21.6k
27 votes
Accepted

Wouldn't forging the balance of a prepaid telephone card allow to make a lot of calls?

Back in the 90s these prepay cards were easily hacked in a number of ways. First, as you said, people could reprogram them with much larger amounts for free calls. A more low-tech method was that they'...
Polynomial's user avatar
  • 135k
26 votes

Is revealing the phone number during OTP verification process considered a vulnerability?

This is not about a "vulnerability". This is about personally identifiable information (PII). It's the same reason why credit cards numbers are not displayed in full on sites either. Anyone ...
schroeder's user avatar
  • 131k
25 votes

Can an infected phone infect other computers in a network?

A modern smartphone is far more powerful and connected than, say, a 1990s office work-station. There's nothing about it being a "phone" that makes it not a network-connected general-purpose computer. ...
Derek Elkins left SE's user avatar
23 votes

Is a 'dumbphone' mobile more secure for basic phone calls than a smartphone?

Case in point: Snowden uses a feature phone (i.e. 'dumb phone). A few people would like to attack his phone, but even if they succeed, it's a very limited reward. OpenMOKO is an example of such a ...
user400344's user avatar
18 votes

Why does my digital bank need my phone date and hour to be correct?

In addition to Tim's answer, I would add that it also has to do with how SSL Certificates are verified. If you log onto your computer instead of your phone, and change the date and time on your ...
Sean Larabee's user avatar
17 votes

Charging someone else's cell phone in my car

Without being able to research vehicle vulnerabilities, we can't really tell you. It's definitely possible there was some sort of autoplay exploit in your vehicle's USB handling. We'd need to know ...
Mark Buffalo's user avatar
  • 22.5k
17 votes
Accepted

Any plans/research for SSL-like method in telephony?

It sounds like the thing you're interested in here that's related to SSL and TLS is authenticity, although TLS also provides confidentiality and integrity. The latter two are difficult in standard ...
bk2204's user avatar
  • 9,514
16 votes

How can a website verify that my phone number belongs to me?

Is this just security theater No. or is there an API or database available where I can verify that a phone number does indeed have a certain name attached to it? The phone companies (ed: didn't ...
Ivan's user avatar
  • 6,338
16 votes

How should I verify a caller is from the bank or company they claim?

Should I refuse to give even partial answers to my security questions in this situation? You should. Mutual authentication on the telephone really isn't trivial but important. One of the more common ...
Ben's user avatar
  • 2,064
16 votes
Accepted

Real life examples of malware propagated by SIM cards?

TL;DR: For laptops, you should be fine. Networks: no advantages that couldn't be gained more easily though the Ethernet port. Can be fixed by having BIOS password and encrypted drive (not a threat). ...
James Stone's user avatar
15 votes

Charging someone else's cell phone in my car

Attacks through USB and other car interfaces such as the stereo are known risks in modern cars. There is research that has shown proof cars can be compromised via various inputs, including the ...
Booga Roo's user avatar
  • 526
14 votes

Charging someone else's cell phone in my car

It depends on what type of USB port you have. If you have a power-only USB port (i.e. in your cigarette lighter adapter), then there is nothing that can be done to attack the vehicle. On the other ...
Brent Kirkpatrick's user avatar
14 votes

Is revealing the phone number during OTP verification process considered a vulnerability?

If the full number were listed then I could visit your account, request a new password, and know your phone number. The last two digits are a tradeoff that permit you to know its (likely) your number ...
Jeff Ferland's user avatar
  • 38.3k
12 votes
Accepted

If my phone for two factor authentication is stolen, can the attacker access my account via an email password reset?

As @Limit pointed out in the comment under your question, the attacker would first need to unlock your phone. Which is a problem. But not impossible. But for the sake of argument, let's assume the ...
Nalaurien's user avatar
  • 1,654
12 votes

Why does my digital bank need my phone date and hour to be correct?

There are numerous security algorithms that limit the window of time in which something is valid. Regardless of the security mechanism, the concept is that a code is generated that can be used to ...
Tim Campbell's user avatar
11 votes

Is a 'dumbphone' mobile more secure for basic phone calls than a smartphone?

Sure, Internet connection and physical data intefaces like USB or microSD constitute attack vectors. However, if you use your smartphone as a dumbphone (i.e. never enable data connections, never plug ...
Dmitry Grigoryev's user avatar
11 votes

Can an infected phone infect other computers in a network?

Yes, any infected device can potentially compromise other devices on the same network. A corporate network should really not allow access for personal devices or any other devices not managed by the ...
Mike Scott's user avatar
  • 10.3k

Only top scored, non community-wiki answers of a minimum length are eligible