The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

106

It is absolutely not secure. Text messages function essentially the same way email does: your client (phone) forwards it to a server, which then looks up a destination which may be on another network (carrier) and then sends it over where it is held in a mailbox until a phone gets it. Anywhere along the way it can be copied, retained longer than expected, ...


103

GSM includes some protection through cryptography. The mobile phone and the provider (i.e. the base station which is part of the provider's network) authenticate each other relatively to a shared secret, which is known to the provider and stored in the user's SIM card. Some algorithms known under the code names "A3" and "A8" are involved in the ...


101

Ars Technica did a superb piece on this a couple of years ago. A woman who is a real estate agent and publishes her cell phone, was inundated with junk calls. What was odd about these was They were fully automated calls They never played a message They used a different number every time They detailed her nightmare On the first night, France went to bed, ...


85

Android Yes, it's possible in Android. Any app/service can read your clipboard data. In fact, there is a lot of code online which creates a service running with a listener in the background, which will inform the app whenever the content on the clipboard changes, along with the content. There are a few Android apps that I know which use this feature. One ...


71

A few scams I've seen making the rounds: Use it to dial a premium rate number owned by the group. In the UK, 09xx numbers can cost up to £1.50 per minute, and most 09xx providers charge around 33%, so a five minute call syphons £5 into the group's hands. If you're a good social engineer, you might only have a 10 minute gap between calls as you wander around ...


71

This is because of Called Subscriber Held (CSH). This is not specific to telephony in the UK but rather a line state applicable on PSTNs caused by the person who made the call not hanging up. The person from which the call originates must hang up for the call to disconnect as it is the person from which the call originates that is paying for the bill. The ...


69

Since I don't know your car model but you seem to be concerned about information security and the fact that the possible attacker chose your car I make the assumption that the USB port in your car is not power-only. The telephone could do anything on this USB port because every USB device can identify itself as any device (storage, keyboard, network, ...


66

Can you get "hacked" by calling a number? I am curious if calling the number would do something to my phone. How could a hacker possibly access sensitive information just by tricking someone into calling. It could be a hack, or it could be a prelude to a hack. Here are some rough examples: If you call them, the spammer can find out if that phone number ...


64

Has the security of the basic phone call changed much, in the last 10 years ? So, do smartphones utilise anything new [purely in] the initiation and connection of just the phone call itself ? Yes. There are new technologies used to establish phone calls in cellular networks. Those new technologies mitigate some attacks which were possible due to flaws ...


64

It's a known scam attempt. The caller probably compromised one of your accounts, and got stopped by the 2FA token sent to your phone. If you send them the token, your account is fully compromised. Or, as Nic pointed very well, may be the account of someone else. What you do? First: don't send them any code or token. That will prevent them for compromising ...


46

What are the technical aspects to tracing a phone call; is it more difficult for mobile phone? In the old days, signaling was inline, hence the 2600hz hack. Calls were setup as one switch talked to another, then another, and so on until a circuit was established end-to-end. In the modern age, everything is out-of-band over SS7 and every switch is lined up ...


45

I am just going to take a guess here. Your telephone data carrier may have an optimizing or caching proxy for content whose IP address appears in your JSON result. As the proxy has no visibility into encrypted HTTPS packets, it cannot proxy the content, so it may be routing directly with your public (routable) IP address. If this is the case, your phone ...


44

As you found out, a SIM card is only required for initializing a connection to the mobile carrier and is not required anymore until the device loses the connection and needs to reconnect (which happens very frequently with mobile devices when you move them around). Your device might power down when the SIM card is removed, but there is no good reason why it ...


42

I would refuse to give out any personal details to anyone that called me as you can't verify who they are. If they need to talk to you then say you can call back. You can then call through on the direct number, which if it is a large bank will be well known and on their website. You could then ask for an extension number to direct your call once you know you ...


41

Who's to say that the phone is really off? If someone controls the firmware of the device then the off functionality could be replaced with state in which the phone appears to be "off" but is in fact maintaining a line of communication to a remote user. However firmware cannot stop you from introducing a hardware switch to disconnect the microphone. A ...


38

Burner phone numbers as an OTP 'equivalent' You can think of the "identities" of those phones (phone number, SIM, phone itself/IMEI) as an equivalent of one-time pad encryption - you exchange the phone numbers (multiple) over a secure channel - e.g., when meeting in person; and then they're secure and provide no useful information (for network/metadata ...


37

The telephone system has been designed so that a caller can replace their phone number with a fake, and some unscrupulous companies use this to change their number to appear to be local to the person they are calling. They aren't using specific numbers of people you know, just something picked at random. The thinking is that a person is more likely to pick ...


33

For telecommunications, check out GSM, CDMA, TDMA, and EDGE. The two competing protocols in the United States are GSM and CDMA. The resources linked below are lacking when it comes to CDMA, but using site:defcon.org and site:blackhat.com in your Google searches will turn up some presentations. For interception of GSM, I refer you to a white paper ...


33

Data dealers often buy data from multiple sources and aggregate it to generate an all-compassing user-profile from it. For example: xyz company sold your telephone number and what the conversation was about. social network which asks for your phone number for password recovery sold your telephone number and your ip address at some point in time. ...


31

They could dial their own number to get yours (assuming your number isn't private.) I think I just invented a new, somewhat forceful and creepy, pick-up move.


31

A SIM identifies you with your network operator; it is necessary to be able to receive calls and to bill you for calls you make. Without a SIM, a phone is mostly useless as a phone, but it can still make emergency calls (in most countries). Without a SIM, your cell phone will not normally transmit data to local base stations, but if you make an emergency ...


31

For the most part[1] they are encrypted, but not sufficiently enough to be considered as safe, tap resistant encryption. GSM uses 64-bit A5/1 encryption that is weak, to say the least. $15 phone, 3 minutes all that’s needed to eavesdrop on GSM call article from ArsTechnica covers it pretty well IMO, if you care to read more about it. However, it also ...


30

They could use it to send the detonation signal to that nuclear weapon they've secreted in a warehouse in Manhattan. That's pretty much the worst-case scenario.


30

If you know Jack A few weeks or months before the call, you could create a simple web page with a login wall and a signup page. In order to sign up, you need to write your phone number. By using standard measures, you can hide your access to the website, hide as much as possible the website in the deep web and protect the database. You now need to tell ...


30

Security of the PSTN is horrifically poor. It's very easy to spoof anyone's number on Caller ID, without having to hack into any of their systems. As such, Caller ID provides no real assurance of who actually called you. There are even services available that the general public can use (for a small fee) to spoof any number they want.


29

To add to the original answers (and consolidate some comments): Analog exchanges (certainly (*1) Strowger exchanges in the UK, probably others elsewhere) did not permit the called party to clear the line (hang up). My understanding of the original reason for this is that the calling party was paying the bill, and there was no effective signalling (pre ...


28

The CallerID displayed on the phone was never designed to be secure. Most VoIP (telephone over the internet) providers will allow the end user to set the outgoing number to be whatever they want. There's good reasons for this, one of which is your incoming provider doesn't have to be (and often isn't) your outgoing provider. This is commonly seen in spam ...


27

If you have a phone with a removable main battery, you can try this: Disable the cellular network, GPS, WiFi, Bluetooth etc on your phone by turning them off manually and then putting the phone into flight mode. Make a note of the current time shown on the phone and on your PC by writing it down on paper. Shut down the phone, remove the main battery and the ...


27

Back in the 90s these prepay cards were easily hacked in a number of ways. First, as you said, people could reprogram them with much larger amounts for free calls. A more low-tech method was that they'd simply scratch off or cover the conductive surface on the pin which decreased the amount on the card, allowing for infinite free calls on a one-time topup. ...


26

A Korean researcher demonstrated this on Samsung Smart TVs at Black Hat this year. (Slide deck here.) He mentions that the malware was originally designed for cell phones, and that TV sets were even easier to attack because battery life did not give them away. His basic premise is that if he owns your device, he owns the power indicators, too. Remote ...


Only top voted, non community-wiki answers of a minimum length are eligible