Is someone trying to hack your phone? The answer to this question is most likely “yes” – regardless of whether you are a person of particular interest to hackers or not. The average Joe may not be the CEO of a petroleum or pharmaceutical company, but there is still money to be made in hacking their device and extracting data. Here is how attackers do that.
1. Tracking and wiretapping through SS7
Signalling System 7 (SS7) is an almost 50-year old protocol which connects most mobile networks worldwide and allows services like roaming and call forwarding. It is a bit rusty, and so is its security. On the other hand, hacking into it allows attackers to track the location of any mobile handset around the globe and intercept the calls and texts coming on and off it. All they need is the associated phone number.
There is little you can do to counter that type of attack. If you are a subject of interest to someone who has the capabilities to hack SS7 – which could be anyone from governments, to petty cybercriminals – your device can be tracked. However, you can ensure the content of your communications remains secured by using apps that offer end-to-end encryption.
2. Eavesdropping on you via an IMSI-catcher
The protocols used by all mobile phones are pretty old and not particularly secure. One of the flaws in them is that a device always identifies to a cell tower with its IMSI number, but the cell tower doesn’t have to. And because phones always connect to the tower emitting the strongest signal – usually the nearest one – it is not that hard to lure a device to connect to a fake cell tower.
This is, in essence, what an IMSI-catcher (or Stingray) device is. Once an attacker tricks your device to connect to their tower, they can relay your communications and read the unencrypted content. To avoid that you can use an IMSI-catcher detector app, which can help you avoid fake cell towers.
3. Infecting a device with malware or spyware
The apps on your phone have access to all kinds of information stored on it. This includes your contacts, browsing history, saved logins, your location, etc. And even if all of those are stored in an encrypted form, a keylogger spyware app can bypass that by monitoring what you type before it ever gets encrypted.
Attackers either need to have physical access to the phone, so they can install the apps themselves – or have you do it if you download software from shady third-party stores. The best you can do is put a password on your lock screen and never venture outside the Google Play store.
4. Using phishing to get your credentials
Reading the previous paragraph, you might be wondering who’d be so stupid to install a malicious app on their phone themselves? It is not really about stupidity, though.
Phishing schemes, in which attackers fool their targets with fake versions of legitimate sites to extract credentials, are getting more and more sophisticated and tailored. Remember that one time a phishing attack probably turned the outcome of an election? Exactly.
5. Intercepting your communications over free Wi-Fi
Whoever operates a network also sees the unencrypted traffic going through it. This is as true for Wi-Fi as it is for mobile operators. And while a carrier is a legit company which operates its networks under a number of regulations, anyone can setup a Wi-Fi hotspot.
Setting up a free one next to a hotel or café – and naming it with the establishment’s name – is a way to lure in unsuspecting customers to connect. Once they do, the attacker can access all the unencrypted emails and messages that go through it. The solution here is to avoid using free Wi-Fi and to encrypt all your web traffic and communications.
6. Extracting your data through a USB charger
The USB chargers of most smartphones don’t just power the battery, but can also transmit data on and off the device when connected to a computer. While this can be useful for loading files on the device and saving some precious megabytes from your data plan, it is also an attack vector.
In many versions of Android, the device mounts the hard drive as soon as the cable is connected to a computer. The latter can be set up to automatically upload malware or spyware when this happens. SO, try not to charge your phone on public computers, or ones that you don’t trust. You best just use a good old wall socket to charge your device.
Comments