Flaw threatens T-Mobile voice mail leaks

By Robert Lemos
http://news.com.com/Flaw+threatens+T-Mobile+voice+mail+leaks/2100-1002_3-5589608.html

Story last modified Thu Feb 24 18:45:00 PST 2005

A convenient voice mail feature has likely opened up many T-Mobile
subscribers' voice mail boxes to unauthorized attackers armed with a simple
hack, the embattled cellular service provider acknowledged on Thursday.
The attack, publicized by wireless security firm Flexilis, could be used to
download a person's voice mail or take control of the victim's voice mail
functions, provided the attacker knew the subscriber's phone number.

"The attacker would be able to listen to the victim's voice mail, record the
voice mail to a file on a remote server, and also make calls out from the
system posing at the victim," said John Hering, director of business
development for Flexilis. "This can all be done from a public pay phone,
which is extremely difficult to trace."

While Flexilis did not give details of the flaws, at least one Internet site
has pointed out that T-Mobile's voice mail system can be accessed by anyone
who uses a service to spoof caller ID. T-Mobile acknowledged the problem,
but said that the solution is simple: Users should set their voice mail to
require passwords.

"By default, customers are not required to put a password on their voice
mail," said spokesman Bryan Zidar. "If you enable the password protection,
it solves the problem."

Zidar said the issue has no relation to the high-profile privacy hits
suffered by Paris Hilton and other celebrities or a previous incident where
an online intruder had access to the mobile phone system. T-Mobile is still
investigating that case and has not released how the information was stolen.

"The silver lining of this Paris Hilton thing, is it is an opportunity for
customers to take further steps to protect their data," Zidar said.

Flexilis also advised T-Mobile subscribers to change their voice mail
setting to require a password from the mobile device.

Copyright ?1995-2005 CNET Networks, Inc. All rights reserved.