Chuck Bokath would be terrifying if he were not such a nice guy. A jovial senior engineer at the Georgia Tech Research Institute in Atlanta, Georgia, Mr Bokath can hack into your mobile phone just by dialing the number.
He can remotely listen to your calls, read your text messages, snap pictures with your phone's camera and track your movements around town - not to mention access the password to your online bank account.
And while Mr Bokath's job is to expose security flaws in wireless devices, he said it was "trivial" to hack into a mobile phone. Indeed, the instructions on how to do it are available online (the link most certainly will not be provided here). "It's actually quite frightening," said Mr Bokath. "Most people have no idea how vulnerable they are when they use their [mobiles]."
Advertisement: Story continues below
Technology experts expect breached, infiltrated or otherwise compromised mobiles to be the scourge of 2012. The smartphone security company Lookout estimates that more than a million phones worldwide have already been affected. But there are ways to reduce the likelihood of getting hacked - whether by a jealous ex or Russian crime syndicate - or at least minimise the damage should you fall prey.
As mobiles have gotten smarter, they have become less like phones and more like computers, and thus susceptible to hacking. But unlike desktop or even most laptop computers, cellphones are almost always on hand, and are often loaded with even more personal information.
So an undefended or carelessly operated phone can result in a breathtaking invasion of individual privacy as well as the potential for data corruption and outright theft.
"Individuals can have a significant impact in protecting themselves from the kind of fraud and cybercrimes we're starting to see in the mobile space," said Paul N. Smocer, the president of Bits, the technology policy division of the Financial Services Roundtable, a US industry association of more than 100 financial institutions.
Mobiles can be hacked in several ways. A so-called man-in-the-middle attack, Mr Bokath's specialty, is when someone hacks into a phone's operating system and re-routes data to make a pit stop at a snooping third party before sending it on to its destination.
That means the hacker can listen to your calls, read your text messages, follow your internet browsing activity and keystrokes and pinpoint your geographical location. A sophisticated perpetrator of a man-in-the-middle attack can even instruct your phone to transmit audio and video when your phone is turned off so intimate encounters and sensitive business negotiations essentially become broadcast news.
How do you protect yourself? Yanking out your phone's battery is about the only way to interrupt the flow of information if you suspect you are already under surveillance. As for prevention, a common ruse for making a man-in-the middle attack is to send the target a text message that claims to be from his or her mobile service provider asking for permission to "reprovision" or otherwise reconfigure the phone's settings due to a network outage or other problem. Don't click "OK". Call your carrier to see if the message is bogus.
For added security, Mr Bokath uses a prepaid subscriber identity module, or SIM, card, which he throws away after using up the line of credit. A SIM card digitally identifies the mobile's user, not only to the mobile provider but also to hackers.
It can take several months for the mobile registry to associate you with a new SIM. So regularly changing the SIM card, even if you have a contract, will make you harder to target.
Another way hackers can take over your phone is by embedding malware, or malicious software, in an app. When you download the app, the malware gets to work corrupting your system and stealing your data.
Or the app might just be poorly designed, allowing hackers to exploit a security deficiency and insert malware on your phone when you visit a dodgy website or perhaps click on nefarious attachments or links in emails. Again, treat your mobile as you would a computer. If it's unlikely Aunt Beatrice texted or emailed you a link to "Great deals on Viagra!", don't click on it.
Since apps are a likely vector for malware transmission on smartphones, Roman Schlegel, a computer scientist at City University of Hong Kong who specialises in mobile security threats, advised, "Only buy apps from a well-known vendor like Google or Apple, not some lonely developer."
It's also a good idea to read the "permissions" that apps required before downloading them. "Be sure the permissions requested make sense," Mr Schlegel said. "Does it make sense for an alarm clock app to want permission to record audio? Probably not." Be especially wary of apps that want permission to make phone calls, connect to the internet or reveal your identity and location.
The Google Android Market, Microsoft Windows Phone Marketplace, Research in Motion BlackBerry App World and Appstore for Android on Amazon.com all disclose the permissions of apps they sell. The Apple iTunes App Store does not, because Apple says it vets all the apps in its store.
Also avoid free unofficial versions of popular apps, say, Angry Birds or Fruit Ninja. They often have malware hidden in the code. Do, however, download an anti-virus app like Lookout, Norton and AVG. Some are free. Just know that security apps screen only for viruses, worms, Trojans and other malware that are already in circulation. They are always playing catch-up to hackers who are continually developing new kinds of malware. That's why it's important to promptly download security updates, not only from app developers but also from your mobile provider.
Clues that you might have already been infected include delayed receipt of emails and texts, sluggish performance while surfing the internet and shorter battery life. Also look for unexplained charges on your mobile bill.
As a general rule it is safer to use a 3G network than public Wi-Fi. Using public Wi-Fi can leave you open to hackers shooting the equivalent of "gossamer threads into your phone, which they use to reel in your data," said Martin H. Singer, chief executive of Pctel, a company that provides wireless security services to government and industry.
Michael Pearce, a mobile security consultant with Neohapsis, agrees that you should take precautions. "It's like any arms race," he said. "No one wins, but you have to go ahead and fight anyway." Via[smh.com]
No comments:
Post a Comment