PHONE HACKING
Recently there has been a good deal of talk in the media about "phone hacking." England is up in arms; people have been arrested; newspapers have been shut down; personal information has been obtained from nobility, celebrities, and businesses.
"Phone hacking" has a ring about it that makes it sound like something we should be concerned with. It sounds like wire tapping -- but it isn't. In fact, the "phone hacking" we hear about has nothing at all to do with phone hacking.
It is, actually, illicit voicemail access.
It all boils down to the PIN assigned to a particular voicemailbox system -- and believe me, there are hundreds of different systems out there. This can apply to the voicemail system where the stored messages are held by the service provider, or a simple answering machine sitting on the kitchen counter.
Here are several ways voicemail messages are accessed:
1. Call the remote voicemail access number for that particular network operator (readily available). Enter the number of the phone you would like to access. When requested enter the PIN number for the voicemailbox. You're in
2. Call the victim's telephone itself. Wait for the voicemail message to start telling you you're not available, and then press the * key. (Or, perhaps, a different pre-assigned key or keys.) You will likely now be asked to input the appropriate PIN. You're in. If the victim has been at all attentive he or she will have changed the default PIN that came with the machine or the service; most people don't bother with this, and the default PIN will work. If the system is at all sophisticated, it will lock out after a certain number of failed attempts. So try later.
3. If we are dealing with a voicemail system rather than an answering machine, there is yet another method: spoofing the system into believing it is the handset calling the voicemail service. Again, you're in. There are sophisticated methods for tricking the system to do this.
The trick, of course, is to get the PIN. Oh, you "forgot" it? Well, answer a few questions and we'll let you reset the PIN and assign a new one. For the average person this might be somewhat difficult, but for government employees, or celebrities, it is quite simple: "In what city were you born?" "When is your birthday?" "What is your dog's name?" We call this social engineering.
Even easier is "guessing" at a PIN. Default PINs are often one of the following: 99, 10, 00, 1234, 9999, 000, 111, 123, Questions have been raised as to whether there should even be a default PIN. We should have an opt-in system, goes the argument. If you want to use your voicemail system you are required to establish a PIN -- don't rely on one provided by the company, and easily "guessable."
So, nobody's tapping our phone lines. There is no phone hacking. But there is a theft of information from the voicemail systems tied to our lines. And that is cause for concern.
What’s your take on this subject? Leave a comment and get the conversation going.
