Hello,

We noticed you're browsing in private or incognito mode.

To continue reading this article, please exit incognito mode or log in.

Not an Insider? Subscribe now for unlimited access to online articles.

Simson Garfinkel

A View from Simson Garfinkel

Sprint PCS Uses Caller-ID as it’s Authenticator for Voice Mail Access!

MSNBC has a disturbing article describing how easy it is to hack into Sprint PCS voice mail systems.Here’s the problem. I am a Sprint PCS subscriber. When you set up your voice mail, you are invited to “activate a special…

  • March 2, 2005

MSNBC has a disturbing article describing how easy it is to hack into Sprint PCS voice mail systems.

Here’s the problem. I am a Sprint PCS subscriber. When you set up your voice mail, you are invited to “activate a special feature” that allows you to retrieve your Sprint PCS voice mail without having to type your account password. However, this feature is supposed to only work when you are calling your voice mail from your Sprint PCS phone!.

It turns out, according to this MSNBC article, that Sprint PCS uses Caller ID as the authenticator. Now anybody who has their own telephone switch with a digital interface to the phone company can spoof Caller ID. This is an old trick that ex-hacker Kevin Mitnick has discussed for years.

So what could be done?

Well, Caller-ID could be made more secure: There is no reason that my phone company should accept any Caller-ID string.

Second, Sprint PCS is a cell phone company! They should know the difference between a landline calling their voice mail system and one of their own cell phones.

Third, there should be some kind of liability on companies that knowingly market systems that are not secure. Don’t you think?

Want more award-winning journalism? Subscribe to Insider Plus.
  • Insider Plus {! insider.prices.plus !}*

    {! insider.display.menuOptionsLabel !}

    Everything included in Insider Basic, plus the digital magazine, extensive archive, ad-free web experience, and discounts to partner offerings and MIT Technology Review events.

    See details+

    Print + Digital Magazine (6 bi-monthly issues)

    Unlimited online access including all articles, multimedia, and more

    The Download newsletter with top tech stories delivered daily to your inbox

    Technology Review PDF magazine archive, including articles, images, and covers dating back to 1899

    10% Discount to MIT Technology Review events and MIT Press

    Ad-free website experience

/3
You've read of three free articles this month. for unlimited online access. You've read of three free articles this month. for unlimited online access. This is your last free article this month. for unlimited online access. You've read all your free articles this month. for unlimited online access. You've read of three free articles this month. for more, or for unlimited online access. for two more free articles, or for unlimited online access.