Breaking into someone’s voice mailbox - in the style of the hackers at the British tabloid News of the World - can be as easy in the United States as it is on the other side of the Atlantic.
It is done using a readily available online service known as “caller ID spoofing,’’ which can make a call appear to be coming from any phone number. Hackers can use it to access someone else’s voice mail messages by fooling the system into thinking the call is coming from the owner’s cellphone.
If the mailbox is not protected by a password, as is often the case, the attacker can hear and even delete messages in the target’s voice mailbox.
There are numerous spoofing services in the United States; all you need to do is Google them. Although these services are used by hackers to commit crimes, they’re also used legitimately by, for example, battered women who do not want their calls traced, or law enforcement agents operating undercover.
Three of the four major US cellphone carriers - AT&T, T- Mobile, and Sprint - do not require customers who call voice mail on their own phones to use a password to listen to messages, making them vulnerable to malicious spoofers. That is a serious shortcoming, said Meir Cohen, president of Teltech Systems Inc., a caller ID spoofing company in Toms River, N.J., who is aware of how easily the service he provides can be misused.
“They should require a password every time a customer calls in to check their voice mail,’’ Cohen said, adding that unless every cellphone company makes voice mail passwords mandatory at all times, they’re giving customers “a false sense of security.’’
Verizon Wireless is the only major carrier to require all customers to use passwords to check voice mail messages. A password “must be entered every time by the customer, from any phone, to check voice mail,’’ said company spokesman Michael Murphy in an e-mail.
As a result, a spoofer wouldn’t be able to access the voice mail of any Verizon Wireless customer unless he managed to steal or guess the user’s password.
Congress considered a ban on caller ID spoofing in 2006, but last year President Obama signed a less-stringent measure that bars the practice only when it’s done “with the intent to defraud, cause harm, or wrongfully obtain anything of value.’’
Officials from both AT&T and T-Mobile say they are aware that their voice mail systems are vulnerable to malicious spoofers. They encourage customers, even when calling from their own phones, to protect their voice mailboxes with passwords. (AT&T has proposed a $39 billion acquisition of T-Mobile that is awaiting regulatory approval.)