{"id":11643,"date":"2018-08-17T11:50:43","date_gmt":"2018-08-17T15:50:43","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/hacking-online-accounts-via-voice-mail\/11643\/"},"modified":"2019-11-15T15:22:54","modified_gmt":"2019-11-15T11:22:54","slug":"hacking-online-accounts-via-voice-mail","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/hacking-online-accounts-via-voice-mail\/11643\/","title":{"rendered":"Hijacking online accounts through voicemail"},"content":{"rendered":"<p>Who uses voicemail these days? \u201cNo one\u201d is probably the first response on most people\u2019s lips. That answer is both right and wrong. True, not many people use voicemail now, yet many mobile subscribers have the service \u2014 and it\u2019s still in good working order, even if somewhat neglected.<\/p>\n<p>And remember: Just because you don\u2019t use your voicemail doesn\u2019t mean no one else does. In his report \u201c<a href=\"https:\/\/www.martinvigo.com\/voicemailcracker\/#more-718\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Compromising online accounts by cracking voicemail systems<\/a>\u201d at DEF CON 26, security researcher <a href=\"https:\/\/twitter.com\/martin_vigo\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Martin Vigo<\/a> demonstrated that voicemail might be of interest to intruders looking to hack into your online accounts.<\/p>\n<p>In fact, most operators allow access to your voice mailbox not only from your phone, but also using an external phone number \u2014 in which case access is protected with a PIN. However voicemail PINs are often far from secure. A lot of subscribers use default codes set by the operator \u2014 usually either the last digits of the phone number or something simple like 1111 or 1234.<\/p>\n<p>Moreover, even if the subscriber bothers to change the PIN, the probability of it being guessed is still fairly high: <a href=\"http:\/\/www.datagenetics.com\/blog\/september32012\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">As another research shows<\/a>, when it comes to thinking up PINs, people are even less inventive than they are with passwords.<\/p>\n<p>First, the PIN is likely to consist of four digits, even if it\u2019s technically possible to make it longer. Second, many users opt for easy-to-remember strings of four identical digits or combinations such as 1234, 9876, 2580 (the middle vertical row on the phone keypad), and the like. PINs beginning with 19xx are also very popular. Knowing these quirks makes it quicker and simpler to crack a voice mailbox.<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe class=\"youtube-player\" type=\"text\/html\" width=\"640\" height=\"390\" src=\"https:\/\/www.youtube.com\/embed\/Z9kO4VmN1FM?version=3&amp;rel=1&amp;fs=1&amp;showsearch=0&amp;showinfo=1&amp;iv_load_policy=1&amp;wmode=transparent\" frameborder=\"0\" allowfullscreen=\"true\"><\/iframe><\/span><\/p>\n<p>There is no need to comb through all combinations manually \u2014 the job can be done by a script that calls the voicemail number and enters different combinations in tone mode. That means brute-forcing voicemail is not only possible, but also quite resource-light. \u201cSo what?\u201d you might say, \u201cThere\u2019s nothing valuable in my voicemail.\u201d Or so you think.<\/p>\n<h2>How to hack PayPal and WhatsApp through voicemail<\/h2>\n<p>When resetting a password, many of the largest online services offer, among other options, to call you on the phone number specified in your profile and supply a verification code.<\/p>\n<p>The attacker\u2019s task is merely to figure out the voicemail PIN and wait until the victim\u2019s phone is turned off or out of range (for example, in airplane mode). Then they simply initiate a password reset in the online service and select as the verification option a call that will go straight to voicemail.<\/p>\n<p>Martin Vigo demonstrated how this technique can be used to hijack a WhatsApp account.<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe class=\"youtube-player\" type=\"text\/html\" width=\"640\" height=\"390\" src=\"https:\/\/www.youtube.com\/embed\/-n2NCc5TnCE?version=3&amp;rel=1&amp;fs=1&amp;showsearch=0&amp;showinfo=1&amp;iv_load_policy=1&amp;wmode=transparent\" frameborder=\"0\" allowfullscreen=\"true\"><\/iframe><\/span><\/p>\n<p>Some online resources employ a slightly different verification process: The service redials the phone number that is associated with the account and prompts the user to enter the numbers displayed on the password reset page as verification. This can be bypassed, however, with the help of a simple trick that involves setting the voicemail greeting message to a recording of the keypad tones that correspond to the digits in the reset code.<\/p>\n<p>One online service with this kind of verification system is PayPal. Martin Vigo successfully cracked that, too:<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe class=\"youtube-player\" type=\"text\/html\" width=\"640\" height=\"390\" src=\"https:\/\/www.youtube.com\/embed\/itEVmcirta0?version=3&amp;rel=1&amp;fs=1&amp;showsearch=0&amp;showinfo=1&amp;iv_load_policy=1&amp;wmode=transparent\" frameborder=\"0\" allowfullscreen=\"true\"><\/iframe><\/span><\/p>\n<p>The above are just a couple of examples. In fact, many more services use an automated voice call to an associated phone number to verify a password reset or to transmit a one-time <a href=\"https:\/\/encyclopedia.kaspersky.com\/glossary\/two-factor-authentication\/?utm_source=kdaily&amp;utm_medium=blog&amp;utm_campaign=termin-explanation\" target=\"_blank\" rel=\"noopener noreferrer\">two-factor authentication<\/a> code.<\/p>\n<h3>How to guard against voicemail-based hacking<\/h3>\n<ul>\n<li>Consider disabling voicemail altogether; it has little practical use anyway;<\/li>\n<li>Use a secure PIN, if you do need voicemail. For a start, it should be longer than four digits. The more, the better. Next, the combination should be <a href=\"http:\/\/www.datagenetics.com\/blog\/september32012\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">hard to guess<\/a>, and preferably random.<\/li>\n<li>Don\u2019t indiscriminately give out the phone number that your online accounts are associated with. The harder it is to match your online identity with a phone number, the better.<\/li>\n<li>Try not to associate your phone number with an online service at all if it\u2019s not a precondition or required for two-factor authentication.<\/li>\n<li>Use two-factor authentication \u2014 ideally an app such as Google Authenticator or a <a href=\"https:\/\/www.kaspersky.com\/blog\/multi-factor-authentication\/9669\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">hardware device such as YubiKey<\/a>.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>When it comes to online accounts, voicemail is a major security hole. Here\u2019s why.<\/p>\n","protected":false},"author":421,"featured_media":11644,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,1486],"tags":[1047,740,423,741,1874,82,976,104,1877,520],"class_list":{"0":"post-11643","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"tag-2fa","10":"tag-black-hat","11":"tag-blackhat","12":"tag-def-con","13":"tag-def-con-26","14":"tag-hacking","15":"tag-online-services","16":"tag-paypal","17":"tag-voicemail","18":"tag-whatsapp"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/hacking-online-accounts-via-voice-mail\/11643\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/hacking-online-accounts-via-voice-mail\/13944\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/hacking-online-accounts-via-voice-mail\/15943\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/hacking-online-accounts-via-voice-mail\/14230\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/hacking-online-accounts-via-voice-mail\/13303\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/hacking-online-accounts-via-voice-mail\/16722\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/hacking-online-accounts-via-voice-mail\/16131\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/hacking-online-accounts-via-voice-mail\/21092\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/hacking-online-accounts-via-voice-mail\/23499\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/hacking-online-accounts-via-voice-mail\/10840\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/hacking-online-accounts-via-voice-mail\/10761\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/hacking-online-accounts-via-voice-mail\/9612\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/hacking-online-accounts-via-voice-mail\/17485\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/hacking-online-accounts-via-voice-mail\/21300\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/hacking-online-accounts-via-voice-mail\/17135\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/hacking-online-accounts-via-voice-mail\/20814\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/hacking-online-accounts-via-voice-mail\/20815\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/def-con\/","name":"def con"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/11643","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/421"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=11643"}],"version-history":[{"count":4,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/11643\/revisions"}],"predecessor-version":[{"id":14627,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/11643\/revisions\/14627"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/11644"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=11643"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=11643"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=11643"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}