full-disclosure - Re: Tabloid phone-tapping net widens

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 10 Aug 2006 11:19:29 +0300
From: Markus Jansson <seemyhomepage@...sokotisivuilta.ni>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Tabloid phone-tapping net widens

 >It seems to me that this may be a global, not UK-specific
 >vulnerability which probably affects all of the world's 1 billion
 >mobile phones (just a guess) on each of the world's carriers.  My
 >question is, what are the vendors doing about it? The usefulness of
 >their technology is undermined if it cannot be trusted. The immediate
 >remedial step for users appears to be to make their PINs difficult to
 >guess.

One simple solution would be to make it possible for users to disable 
voice mail access to all other than the actual phone(number) that is 
using that voice mail account. Kinda make it "trusted number" and 
concider all others "untrusted" unless "trusted number" tells the system 
that number X can also be concidered "trusted".

Ofcourse this makes no difference if anyone can fake the phone number 
they are calling or sending SMS from. In Finland, atleast, this is not 
possible since phone numbers are not "directly trusted" when 
authenticating phone or SMS senders, but the trust comes from the 
operator who "confirms" that number X really belongs to phonecall Y.

(Ofcourse I think it might be a bit paranoid solution to encrypt all 
voice mail with users publickey and then allow them to be decrypted only 
by the privatekey stored in protected area of the recipients SIM card, 
but anyway...)

-- 
ï»¿My computer security & privacy related homepage
http://www.markusjansson.net
Use HushTools or GnuPG/PGP to encrypt any email
before sending it to me to protect our privacy.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/