How we HACKED mobile voicemail without a PIN • The Register

Following a previous guest post on how personal rather than default PIN numbers could be accessed, here’s a recent piece from the Register which explains continuing loopholes in mobile telephone services, which allow hacking voicemails through spoofing the caller’s number.

It’s believed the infiltrated inboxes merely had default PINs, or passcodes that were far too easy to guess, allowing eavesdroppers to easily drop by. People were urged to change their number codes for their voicemail, but, as we shall see, that advice is useless – you simply don’t need to know a PIN to listen to someone’s messages.

Going down the rabbit hole

The login flaw was discovered during development work I was doing on a virtual mobile phone network that’s aimed at folks who struggle with modern technology: it allows, for example, an elderly subscriber to ring up a call centre and ask to be put through to a friend or relative, rather than flick through a fiddly on-screen contacts book.

In this case, the operator makes the connection between the subscriber and the intended receiver, but the “calling line identification” (CLI) shown at the receiving end is that of the subscriber and not of the call centre. CLI is the basis of caller ID in the UK, but it’s a bit of a misnomer because it can be changed as required.

I’d long suspected that miscreants were hacking voicemail by spoofing their CLIs to fool the phone system into thinking it was the handset collecting the messages – but surely that’s too easy? It is trivial to set an arbitrary CLI when making a call. I had to find out if voicemail systems were vulnerable to spoofing.

via Reg probe bombshell: How we HACKED mobile voicemail without a PIN • The Register.