Almost everything you do on your phone could be accessed by hackers.
When we use our mobile phones, we do so with the expectation of privacy. Whether we’re making a call, sending a text or browsing the web, we assume we have full control over who can see or hear what we’re doing. But the reality is that someone could be listening in and you might never know.
Recently, details of a major security vulnerability in Bluetooth were released. Giving hackers the ability to insert themselves between two Bluetooth-connected devices, KNOB (Key Negotiation Of Bluetooth) can intercept practically everything, including file transfer data and phone calls. It can also inject its own data, so it could be used to infect devices with malware. Even more worrying is that KNOB attacks are completely undetectable.
Luckily, the flaw was discovered not by criminals but by security researchers, who first revealed their findings at a Bluetooth industry event in November 2018. The fact it’s only reaching the public sphere now is probably a good sign, because it’s given manufacturers time to work on security fixes – although that doesn’t necessarily mean they’ve taken action. As the researchers have said, "After we disclosed our attack to industry in late 2018, some vendors might have implemented workarounds for the vulnerability on their devices. So the short answer is: if your device was not updated after late 2018, it is likely vulnerable. Devices updated afterwards might be fixed."
The uncertainty in that statement is far from reassuring, but so far no attacks using KNOB have been discovered ‘in the wild’, and it’s worth noting that it only works if both devices are vulnerable.
Could there be an uninvited guest on your call?
But KNOB is not the first Bluetooth attack, and it won’t be the last. There have been other vulnerabilities, each of which had to be patched by manufacturers of Bluetooth-enabled technology.
However, Bluetooth attacks are just the tip of the iceberg when it comes to mobile phone attacks; there are many other ways hackers can spy on your phone. Using these techniques, they can access your phone camera, your photos, your files, your contact database and, of course, your calls.
Wi-Fi Hacking
Just like Bluetooth, Wi-Fi is a wireless data transfer technology. How it works is different, but hackers can use it to launch the same kind of ‘man in the middle’ attacks that are possible with KNOB. They can do this by gaining unauthorised access to vulnerable networks, or they can set up a public Wi-Fi hotspot with the sole intention of hacking mobile devices and laptops. This kind of attack has been used in the past to target business people using hotel Wi-Fi.
Rogue Apps, Email Attachments & Websites
Via rogue apps, malicious email attachments and dodgy websites, hackers can install malware on phones that spies on everything the user does. The Android malware RedDrop, for example, can steal photos, files and information about the victim’s device, and it can listen in on their calls. It can also send SMS messages to a premium rate number. The fact is, hackers can use malware to intercept everything on your phone, from your camera to the words you type.
Eavesdropping Devices
It may have occurred to you that regular mobile phone calls also use a form of wireless communication. So what’s to stop that being hacked as well? Nothing. In fact, there are many devices that can be used to intercept data from mobile phones and to launch denial-of-service attacks to stop calls being made. Some also have the ability to eavesdrop on calls.
IMSI catchers, such as the StingRay, are generally used by law enforcement agencies, but they may also be acquired on the black market for criminal use. One way they work is to act a fake mobile network tower, which all phones in a certain radius will automatically connect to.
SIM Cloning
By making a copy of someone’s SIM card, hackers can see all their text messages, send their own and, yes, listen in on their calls, this means they may be able to get your information through a phone call you think is private. SIMs can be cloned in numerous ways, some of which require physical access to the target’s SIM card, but it’s also possible to do it remotely. In fact, in some cases, it has been achieved simply by sending a text message.
Shoulder Surfing
It’s not exactly sophisticated, but criminals can eavesdrop on your mobile communications simply by standing next to you, listening to your call and looking at your phone screen. Shoulder surfing is a common form of attack at cash machines, for obvious reasons, but mobile devices are at risk too.
Stealing data can be as simple as looking over someone's shoulder.
So What Can You Do?
The only sure way to know your phone isn’t being used to spy on you is to not have a phone at all. That’s a perfectly possible solution, but it isn’t terribly convenient. You can, however, mitigate the risk in a few ways:
- Only download apps from trusted sources.
- Never install pirated apps.
- Don’t root or jailbreak your phone.
- Make sure you have all security features enabled on your handset.
- Turn off Bluetooth when you’re not using it.
- If you need to discuss something sensitive, try to do it in person.
- Always be aware of your surroundings, including who is standing near you.
- Avoid connecting to public WiFi hotspots.
- Enable multi-factor authentication on your device and all important accounts.
- Monitor your data use for suspicious activity.
- Use a device monitoring solution like Microsoft Intune.
- Don’t download email attachments from unknown parties.
Not one of these actions provides 100% protection against every type of attack, but they can effectively reduce the chances of them happening to you.
It's also important to prioritise protection against the most likely forms of attack. For most businesses, there's no point in worrying about IMSI catchers, for example. They require a large amount of effort and cost, which is beyond most criminals, so unless you're working on some top secret government project, you're probably okay. The average person is more likely to encounter malware from rogue apps, malicious email attachments and dodgy wi-fi hotspots – and those, thankfully, are all much easier to defend against.
No business should be without cyber security in this day and age, and with more of us than ever before working from home, it's important we keep our phone calls as secure as possible. TMB Group is dedicated to protecting our clients, arming them with powerful security technology and the knowledge to stay ahead of the criminals. Contact us today if you're worried about someone spying on your phone to see how we can help your business stay safe.
