[<prev] [next>] [day] [month] [year] [list]
Message-ID: <44DAEC11.6050506@katsokotisivuilta.ni>
Date: Thu, 10 Aug 2006 11:19:29 +0300
From: Markus Jansson <seemyhomepage@...sokotisivuilta.ni>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Tabloid phone-tapping net widens
>It seems to me that this may be a global, not UK-specific
>vulnerability which probably affects all of the world's 1 billion
>mobile phones (just a guess) on each of the world's carriers. My
>question is, what are the vendors doing about it? The usefulness of
>their technology is undermined if it cannot be trusted. The immediate
>remedial step for users appears to be to make their PINs difficult to
>guess.
One simple solution would be to make it possible for users to disable
voice mail access to all other than the actual phone(number) that is
using that voice mail account. Kinda make it "trusted number" and
concider all others "untrusted" unless "trusted number" tells the system
that number X can also be concidered "trusted".
Ofcourse this makes no difference if anyone can fake the phone number
they are calling or sending SMS from. In Finland, atleast, this is not
possible since phone numbers are not "directly trusted" when
authenticating phone or SMS senders, but the trust comes from the
operator who "confirms" that number X really belongs to phonecall Y.
(Ofcourse I think it might be a bit paranoid solution to encrypt all
voice mail with users publickey and then allow them to be decrypted only
by the privatekey stored in protected area of the recipients SIM card,
but anyway...)
--
My computer security & privacy related homepage
http://www.markusjansson.net
Use HushTools or GnuPG/PGP to encrypt any email
before sending it to me to protect our privacy.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists