View source for Phone hacking

{{pp-semi-indef|small=yes}}
{{Short description|Surveillance or computer investigation}}
{{About|the use of telephone technology to steal information|the manipulation of telephone call routing|Phreaking}}

'''Phone hacking''' is the practice of [[exploring]] a [[mobile device]], often using [[Exploit_(computer_security)|computer exploits]] to analyze everything from the lowest [[computer memory|memory]] and [[central processing unit|CPU]] levels up to the highest [[file system]] and [[Process (computing)|process]] levels. Modern [[open source]] tooling has become fairly sophisticated to be able to "hook" into individual functions within any running [[Mobile app|app]] on an unlocked device and allow deep inspection and modification of its functions.

Phone hacking is a large branch of [[computer security]] that includes studying various situations exactly how attackers use [[Exploit (computer security)|security exploits]] to gain some level of access to a [[mobile device]] in a variety of situations and presumed access levels.

The term came to prominence during the [[News International phone hacking scandal]], in which it was alleged (and in some cases proved in court) that the British tabloid newspaper the ''[[News of the World]]'' had been involved in the interception of voicemail messages of the [[British Royal Family|British royal family]], other public figures, and murdered schoolgirl [[Milly Dowler]].<ref>{{cite news |url=https://www.theguardian.com/uk/2011/jul/04/milly-dowler-voicemail-hacked-news-of-world |title=Missing Milly Dowler's voicemail was hacked by News of the World|last1=Davies |first1=Nick |last2=Hill |first2=Amelia |work=[[The Guardian]] |date=4 July 2011 |access-date=13 July 2011}}</ref>

==Victims of phone hacking==
Although mobile phone users may be targeted, "for those who are famous, rich or powerful or whose prize is important enough (for whatever reason) to devote time and resources to make a concerted attack, it is usually more common, there are real risks to face."<ref>{{Cite news |volume= 1 |issue= 2 |website= mdigitalera.com |url= https://www.mdigitalera.com/2018/11/how-to-secure-android-phone-from-hackers-viruses.html |title= Secure Mobile From Hackers |page= 3 |first= Henry B |last= Wolfe |date= December 2018 |access-date= 2018-12-12 |archive-date= 2019-04-02 |archive-url= https://web.archive.org/web/20190402151911/https://www.mdigitalera.com/2018/11/how-to-secure-android-phone-from-hackers-viruses.html |url-status= dead }}</ref>

==Techniques==
===Voicemail hacking===
[[File:Motorola L71 on the China Mobile network 20100521.jpg|thumb|150px|alt=Motorola L7 mobile phone|Phone hacking often involves unauthorized access to the [[voicemail]] of a [[mobile phone]]]]
The unauthorized remote access to [[voicemail]] systems, such as exposed by the [[News International phone hacking scandal]], is possible because of weaknesses in the implementations of these systems by [[Telephone company|telephone companies]].<ref>{{cite web|url=http://blog.mobilephonesecurity.org/2011/07/voicemail-hacking-and-phone-hacking.html|title=Voicemail Hacking and the 'Phone Hacking' Scandal - How it Worked, Questions to be Asked and Improvements to be Made|date=7 July 2011|access-date=25 Jul 2012|first=David|last=Rogers|publisher=Copper Horse Solutions}}</ref>

Mobile phone voicemail messages may be accessed on a [[landline]] telephone with the entry of a [[personal identification number]] (PIN).<ref name="BBC" /> Reporters for News International would call the number of an individual's mobile phone, wait to be moved to voicemail, and then guess the PIN, which was often set at a simple default such as 0000 or 1234.<ref>{{Cite news |last=Waterson |first=Jim |date=2021-07-10 |title=News of the World: 10 years since phone-hacking scandal brought down tabloid |language=en-GB |work=The Guardian |url=https://www.theguardian.com/media/2021/jul/10/news-of-the-world-10-years-since-phone-hacking-scandal-brought-down-tabloid |access-date=2023-05-08 |issn=0261-3077}}</ref> 

Even where the default PIN is not known, [[Social engineering (security)|social engineering]] can be used to reset the voicemail PIN code to the default by impersonating the owner of the phone with a call to a [[call centre]].<ref>[https://www.newscientist.com/article/dn20660-voicemail-hacking-how-easy-is-it.html?full=true Voicemail hacking: How Easy Is It?], ''[[New Scientist]]'', 6 July 2011</ref><ref name="cnn1">{{Cite news|title=Phone Hacking Can Extend Beyond Voice Mail|url=http://edition.cnn.com/2011/TECH/mobile/07/08/phone.hacking/index.html?&hpt=hp_c2|work=[[CNN]] |last=Milian|first=Mark|date=8 July 2011|access-date=9 July 2011}}</ref> During the mid-2000s, calls originating from the handset registered to a voicemail account would be put straight through to voicemail without the need of a PIN.  A hacker could use [[caller ID spoofing]] to impersonate a target's handset caller ID and thereby gain access to the associated voicemail without a PIN.<ref>{{cite web|url=http://www.infoworld.com/article/2658949/security/paris-hilton-accused-of-voice-mail-hacking.html|title=Paris Hilton accused of voice-mail hacking|author=Robert McMillan|date=25 August 2006|work=InfoWorld|access-date=14 June 2015}}</ref><ref>[https://www.nbcnews.com/id/wbna7046776 Cell Phone Voicemail Easily Hacked], ''[[NBC News]]'', 28 February 2005</ref><ref>[http://news.cnet.com/8301-27080_3-20077732-245/kevin-mitnick-shows-how-easy-it-is-to-hack-a-phone/ Kevin Mitnick Shows How Easy It Is to Hack a Phone], interview with [[Kevin Mitnick]], ''[[CNET]]'', 7 July 2011</ref>

Following controversies over phone hacking and criticism of mobile service providers who allowed access to voicemail without a PIN, many mobile phone companies have strengthened the default security of their systems so that remote access to voicemail messages and other phone settings can no longer be achieved even via a default PIN.<ref name="BBC">{{cite news|url=https://www.bbc.co.uk/news/magazine-14044499|title=Who, What, Why: Can Phone Hackers Still Access Messages?|work=[[BBC News]]|date=6 July 2011}}</ref> For example, [[AT&T]] announced in August 2011 that all new wireless subscribers would be required to enter a PIN when checking their voicemail, even when checking it from their phones.<ref>{{Cite news|title=Not an option: time for companies to embrace security by default|url=https://arstechnica.com/tech-policy/2011/08/not-an-option-time-for-companies-to-embrace-security-by-default/|work=[[Ars Technica]] |last=Soghoian|first=Christopher|date=9 August 2011|access-date=25 July 2012}}</ref> To encourage [[password strength]], some companies now disallow the use of consecutive or repeat digits in voicemail PINs.<ref name="smh">{{Cite news |last=Grubb |first=Ben |date=8 July 2011 |title=Vulnerable voicemail: telco-issued PINs insecure |work=[[The Sydney Morning Herald]] |url=http://www.smh.com.au/technology/security/vulnerable-voicemail-telcoissued-pins-insecure-20110708-1h5yz.html |access-date=9 July 2011}}</ref>

===Handsets===
An analysis of user-selected PIN codes suggested that ten numbers represent 15% of all [[iPhone]] passcodes, with "1234" and "0000" being the most common, with years of birth and graduation also being common choices.<ref>{{Cite news|title=Once Again, 1234 Is Not A Good Password|url=https://blogs.wsj.com/tech-europe/2011/06/15/once-again-1234-is-not-a-good-password/|work=[[The Wall Street Journal]] |last=Rooney|first=Ben|date=15 June 2011|access-date=8 July 2011}}</ref>  Even if a four-digit PIN is randomly selected, the [[Key space (cryptography)|key space]] is very small (<math>10^{4}</math> or 10,000 possibilities), making PINs significantly easier to [[brute-force attack|brute force]] than most passwords; someone with physical access to a handset secured with a PIN can therefore feasibly determine the PIN in a short time.<ref>{{cite journal|title=Here's How Law Enforcement Cracks Your iPhone's Security Code|url=https://www.forbes.com/sites/andygreenberg/2012/03/27/heres-how-law-enforcement-cracks-your-iphones-security-code-video/|website=Forbes.com|date=27 Mar 2012|first=Andy|last=Greenberg|access-date=25 Jul 2012}}</ref>

Mobile phone microphones can be activated remotely by security agencies or telephone companies without physical access as long as the battery has not been removed.<ref name="schneier-roving-bugs">{{cite web|url=http://www.schneier.com/blog/archives/2006/12/remotely_eavesd_1.html|title=Remotely Eavesdropping on Cell Phone Microphones|last=Schneier|first=Bruce|date=December 5, 2006|work=Schneier On Security|access-date=13 December 2009}}</ref><ref name="roving-bugs">{{cite news|url=http://news.cnet.com/FBI-taps-cell-phone-mic-as-eavesdropping-tool/2100-1029_3-6140191.html |title=FBI taps cell phone mic as eavesdropping tool |last=McCullagh |first=Declan |author2=Anne Broache |date=December 1, 2006 |work=CNet News |access-date=2009-03-14 |url-status=dead |archive-url=https://web.archive.org/web/20131110182623/http://news.cnet.com/FBI-taps-cell-phone-mic-as-eavesdropping-tool/2100-1029_3-6140191.html |archive-date=November 10, 2013 }}</ref><ref name="uk-mobile-bug">{{cite news|url=http://news.ft.com/cms/s/7166b8a2-02cb-11da-84e5-00000e2511c8.html|title=Use of mobile helped police keep tabs on suspect |last=Odell|first=Mark|date=August 1, 2005|work=Financial Times|access-date=2009-03-14}}</ref><ref name="noaa-phone">{{cite web|url=http://www.wrc.noaa.gov/wrso/security_guide/telephon.htm|title=Telephones|year=2001|work=Western Regional Security Office (NOAA official site)|access-date=2009-03-22}}</ref><ref name="can-you-hear-me">{{cite news|url=http://blogs.abcnews.com/theblotter/2006/12/can_you_hear_me.html |title=Can You Hear Me Now? |work=ABC News: The Blotter |access-date=13 December 2009 |url-status=dead |archive-url=https://web.archive.org/web/20110825102123/http://blogs.abcnews.com/theblotter/2006/12/can_you_hear_me.html |archive-date=25 August 2011 }}</ref><ref>{{cite news|url=https://www.theregister.co.uk/2007/06/26/cell_hack_geek_spook_stalk/ |title=Cell hack geek stalks pretty blonde shocker |author=Lewis Page |publisher=The Register |date=2007-06-26 |access-date=2010-05-01 |url-status=dead |archive-url=https://web.archive.org/web/20131103193709/https://www.theregister.co.uk/2007/06/26/cell_hack_geek_spook_stalk/ |archive-date=2013-11-03 }}</ref> This "roving bug" feature has been used by law enforcement agencies and intelligence services to listen in on nearby conversations.<ref>{{cite news |url=http://news.bbc.co.uk/2/hi/uk_news/magazine/3522137.stm |title=This goes no further... |author=Brian Wheeler |publisher=BBC News Online Magazine |date=2004-03-02 |access-date=2008-06-23}}</ref>

Other techniques for phone hacking include tricking a mobile phone user into downloading [[malware]] that monitors activity on the phone. [[Bluesnarfing]] is an unauthorized access to a phone via [[Bluetooth]].<ref name="cnn1" /><ref>[https://www.bbc.co.uk/news/technology-11217012 How easy is it to hack a mobile?], ''[[BBC News]]'', 7 September 2010</ref>

===Other===
There are flaws in the implementation of the [[A5/1|GSM encryption algorithm]] that allow passive interception.<ref>{{cite journal|url=http://csrc.nist.gov/publications/nistpubs/800-124/SP800-124.pdf|title=Guidelines on Cell Phone and PDA Security|publisher=[[National Institute of Standards and Technology]]|date=October 2008|first1=Wayne|last1=Jansen|first2=Karen|last2=Scarfone|doi=10.6028/NIST.SP.800-124|access-date=25 Jul 2012}}</ref>  The equipment needed is available to government agencies or can be built from freely available parts.<ref>{{cite news |url=http://www.pcworld.com/article/185542/hackers_show_its_easy_to_snoop_on_a_gsm_call.html |title=Hackers Show It's Easy to Snoop on a GSM Call |first=Robert |last=McMillan |work=IDG News Service |access-date=2011-07-24 |archive-date=2012-01-20 |archive-url=https://web.archive.org/web/20120120095422/http://www.pcworld.com/article/185542/hackers_show_its_easy_to_snoop_on_a_gsm_call.html |url-status=dead }}</ref>

In December 2011, German researcher Karsten Nohl revealed that it was possible to hack into mobile phone voice and text messages on many networks with free decryption software available on the Internet. He blamed the mobile phone companies for relying on outdated encryption techniques in the [[2G]] system, and said that the problem could be fixed very easily.<ref name="nohl">{{Cite news|title=Lax Security Exposes Voice Mail to Hacking, Study Says|url=https://www.nytimes.com/2011/12/26/technology/26iht-hack26.html?_r=1&ref=technology&pagewanted=all|work=[[The New York Times]] |last=O'Brien|first=Kevin J.|date=25 December 2011|access-date=28 December 2011}}</ref>

==Legality==
Phone hacking, being a form of [[surveillance]], is illegal in many countries unless it is carried out as [[lawful interception]] by a government agency. In the [[News International phone hacking scandal]], private investigator [[Glenn Mulcaire]] was found to have violated the [[Regulation of Investigatory Powers Act 2000]]. He was sentenced to six months in prison in January 2007.<ref>[http://news.bbc.co.uk/1/hi/6301243.stm "Pair jailed over royal phone taps "], ''[[BBC News]]'', 26 January 2007</ref> Renewed controversy over the phone-hacking claims led to the closure of the ''[[News of the World]]'' in July 2011.<ref>[https://www.bbc.co.uk/news/uk-14070733 News of the World to close amid hacking scandal], ''[[BBC News]]'', 7 July 2011</ref>

In December 2010, the [[Truth in Caller ID Act]] was signed into [[Law of the United States|United States law]], making it illegal "to cause any caller identification service to knowingly transmit misleading or inaccurate caller identification information with the intent to defraud, cause harm, or wrongfully obtain anything of value."<ref>[http://www.gpo.gov/fdsys/pkg/PLAW-111publ331/pdf/PLAW-111publ331.pdf Truth in Caller ID Act of 2010, December 22, 2010], accessed 7 July 2017</ref><ref>[https://olinux.net/android-hacking-tools-megapack-18-advance-suites] {{Webarchive|url=https://web.archive.org/web/20171017093945/https://myhacker.net/2017/09/android-tools-advance-hacking/|date=2017-10-17}}, 29 September 2017</ref>

==See also==
{{Portal|Telephones}}
* [[Mobile security]]
* [[Operation Weeting]]
* [[Phreaking]]
* [[Telephone tapping|Wiretapping]]
* [[Vault 7]]
* [[SIM swap scam]]

==References==
{{reflist}}

==External links==
*{{Guardiantopic|media/phone-hacking|Phone hacking}}
*[https://www.usatoday.com/story/tech/columnist/saltzman/2018/03/01/has-someone-hacked-your-webcam-heres-how-stop-cyber-snoopers/377676002/ '''US Today''' Has someone hacked your webcam], March 2 2018
*[https://www.bbc.co.uk/news/uk-politics-12253968 Timeline: News of the World phone-hacking row], ''[[BBC News]]'', 5 July 2011
*[http://news.sky.com/skynews/Home/UK-News/News-Of-The-World-Phone-Hacking-Full-Question-And-Answer-On-News-International-Allegations/Article/201107116024567?lpos=UK_News_Top_Stories_Header_2&lid=ARTICLE_16024567_News_Of_The_World_Phone_Hacking%3A_Full_Question_And_Answer_On_News_International_Allegations Full Q&A On The Phone Hacking Scandal], ''[[Sky News]]'', 5 July 2011
*[https://www.nytimes.com/interactive/2010/09/01/magazine/05tabloid-timeline.html Anatomy of the Phone-Hacking Scandal], ''[[The New York Times]]'', 1 September 2010
*[https://blogs.wsj.com/digits/2010/02/05/the-rise-of-caller-id-spoofing/ The Rise of Caller ID Spoofing], ''[[The Wall Street Journal]]'', 5 February 2010
*[https://www.bbc.co.uk/news/technology-14118995 Phone hacking: Are you safe?], [[Rory Cellan-Jones]], ''[[BBC News]]'', 12 July 2011
*[https://www.bustle.com/p/should-you-cover-your-phone-camera-heres-what-security-experts-want-you-to-know-8121712 Should you cover your phone camera, BUSTLE ] Feb 16 2018
{{2011 News Corporation scandal}}

{{DEFAULTSORT:News Of The World Phone Hacking Affair}}
[[Category:Hacking (computer security)]]
[[Category:Telephone crimes]]
[[Category:Telephone tapping]]
[[Category:Mobile security]]
[[Category:Phreaking]]