Voicemail “Hacking” isn’t new, it isn’t hard, isn’t clever

This is really starting to wind me up!
There’s no hacking involved here at all.

The voicemail “hack” is a well known shortcoming of cell voicemail services.
When calling your voicemail number from your mobile your caller id is used to put you in the right mailbox, but if you call that voicemail number from another line you are asked for your mobile number and your pin code.
In the majority of cases users haven’t set a pin number so the default (lists available on the web) is used.
So all you have to do is find out what network they’re on by (in order of newbishness):

• Ring the phone till you get redirected to voicemail
• If they don’t have a personalised answer message you’ll get the default message which will say the orange/t-mobile, vodaphone etc
• IF they do have a personalised message hit * to get to the main menu same applies as above
• Google the phone number prefix -> different networks have different prefixes
• Since the availbility of number porting this may not be accurate.
• Try all the voicemail numbers till the cell number is recognised…duh
• Send a network query message (online smsc services can provide this 99% accurate)

Once you know what network they are on just dial in, enter the mobile / cell number and the default pin.

If that doesn’t work fire up google / facebook etc and get the persons key dates, dob, anniversary etc and try those. “90% of the time it works every time”

If not you could just brute force the numbers, a small vb program and a skype out account makes this easy, though any decent security program would catch this I doubt there are any running, yet!

So at best that’s brute forcing or social engineering, a hacker would bypass the passcode altogether and simply setup an asterix box with a voip provider and spoof the targets caller id.

Once that’s done, send a network query message to find out the targets network, lookup the voicemail number and dial it with the spoofed caller id.

So long as the user hasn’t set up their voicemail account to require a password when called from their own mobile you’re straight into the account and can listen to messages at will.

It’s also worth noting that in current UK legislation it’s only illegal to intercept and alter communications, so as long as you only listen to old messages and don’t delete anything you aren’t actually breaking the law.

Once an email / voicemail / text has been heard or read by the intended recipient that communication has completed and cannot be intercepted thereafter.

Time for a change I think…..Food for though eh!