Slashdot Mirror
Legal Spying Via the Cell Phone System
An anonymous reader writes "Two researchers say they have found a way to exploit weaknesses in the mobile telecom system to legally spy on people by figuring out the private cell phone number of anyone they want, tracking their whereabouts, and listening to their voice mail."
In Soviet Russia, phone calls you!
Google already does this.
ya ha ahaaaa phone up my asss!
Is it true that the gubmint can track the location of my cellie even when it's off? Or do I really need to disconnect the battery?
Damping absorbs vibrations. Dampening is caused by moisture.
Just because it's possible doesn't make it legal.
From TFA: DePetrillo used open-source PBX software to spoof the outgoing caller ID and then automated phone calls to himself, triggering the system to force a name lookup. I thought spoofing caller ID was now illegal...
FTA: ""It's not illegal, nor is it a breach of terms of service," Bailey said."
I get mailed revised TOS and privacy policies from companies on a weekly basis. Now that this is publicized, how long will it stay 'legal'? Usually, loudly exclaiming "nener-nener-boo-boo you can't catch me" to one of the largest, consumer unfriendly, profit motivated industries gets their attention.
'We are trying to prove ourselves wrong as quickly as possible, because only in that way can we find progress.' RPF
Plus the whole breaking into voicemail boxes thing.
As of 10/06/03, I hate COBOL developers.
It is. And yes, they are doing it on a massive scale to pull thousands of records. So how long before a lawsuit?
He's calling himself, so he'd certainly lack any intent to deceive (which is an element of the new caller ID law). Do most people's cell phones work with caller ID with name? Neither mine (ATT) nor my wife's (Verizon) comes up with a name.
What about it? It hasn't been signed yet (at least as of yesterday) and the FCC has to put it in place 6 months after it's signed. So, I guess for this particular research it was fine and will continue to be fine.
""It's not illegal, nor is it a breach of terms of service," Bailey said."
Yeah, right. Don't bend over in the shower.
As far as I can tell, they assert that it is legal, therefore they think it is legal. Come on folks -- just because you aren't breaking or entering, or murdering someone does not make what you are doing "legal." There are all sorts of privacy laws that come into play here -- and I strongly suspect that I can find at least one prosecutor/judge/jury combo in this country that disagrees. I can't even begin to describe how many laws could be implicated by breaking into someone's voice mail!
Yes, IAAL, but IANYL.
These people are smoking crack if they actually believe that taking advantage of a flaw in the system is not illegal. Accessing any information that is believed to be protected is against most all of the state laws in the United States and the federal statues in place for actions like this. Yeah, it might seem cool, but it is a serious felony.
Anyone can try and reason their actions to be legal and/or moral/ethical, but they are not in this case. If I were them, I would quit talking and hope that state governments and/or the Federal Government do not come after them.
They say it's legal, and cite no sources (i.e.'we asked our lawyer"). They seem to indicate that since EU telco 'offer it for free', then it must be legal. I would love to see someone defend this in court; especially if they are using the system to track someone covertly.
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
Breaking into voice mail systems is not legal.
We already do that, it's called the Homeland Security Act.
With the ability to read the constitution - and reason above a third grade level - it is 100% clear that spying on a US citizen's communications without probable cause AND a warrant is not an authorized power for the US government or a US state. It is also doubtful that there exists, or can exist with constitution as currently constructed, a justification for a private citizen exercising such a power.
I've fallen off your lawn, and I can't get up.
From TFA: "DePetrillo used open-source PBX software to spoof the outgoing caller ID..."
Last week Congress passed the Truth in Caller ID Act of 2010 which will make it illegal "to cause any caller ID service to transmit misleading or inaccurate caller ID information, with the intent to defraud or deceive."
Once that's signed into law they will be on very thin ice arguing that they did not intend to defraud or deceive when they spoof their caller ID to obtain information that they normally would not be able to access.
Eagles may soar, but weasels don't get sucked into jet engines.
Me thinks that the "researchers" need to research a little more... http://www.answers.com/topic/trespass http://groups.csail.mit.edu/mac/classes/6.805/student-papers/fall97-papers/kim-crime.html
My sausage tree didn't grow, does that make me a bad mommy?
What if he has multiple personality disorder? Or maybe like many car salesmen I know, he openly lies to himself so he can sleep at night? I wouldn't be so quick to assume there's no deception here.
On a more serious note, I was wondering something along those lines myself. I have T-Mobile and I could have sworn that mine used to do caller ID with name years ago. Now it only does it if the number's in my address book, and I was trying to figure out when that changed, or if I'm just insane (strong possibility some days).
I believe it depends on the intent.
You can still spoof as long as you aren't doing so to deceive or defraud.
If they "[use an] open-source PBX software to spoof the outgoing caller ID and then automated phone calls to himself, triggering the system to force a name lookup" in the US, it looks like they'll be in violation of Truth in Caller ID Act of 2010, which added a subsection e to Section 227 of the Communications Act of 1934 (47 U.S.C. 227):
‘‘(e) PROHIBITION ON PROVISION OF DECEPTIVE CALLER ID INFORMATION.—
‘‘(1) IN GENERAL.—It shall be unlawful for any person within the United States, in connection with any real time voice communications service, regardless of the technology or network utilized, to cause any caller ID service to transmit misleading or inaccurate caller ID information, with the intent to defraud or deceive."
My phone (Rogers) shows the name.
publish another brain-dead academic paper on spoofing?
This is another example of ( to quote Rob Pike ) irrelevant systems software research.
Yours In Akademgorodok,
Kilgore Trout.
The US House recently passed a bill to make caller ID spoofing illegal. Hopefully the Senate will soon follow suit.
If privacy is protected by law (at least in some countries), how can you say you found a legal way of not respecting someone's privacy ?
They may successfully argue that it is still legal. Their method is to call themselves with spoofed caller-id. The network fills in the name associated with the phone number and they build their database. Since they are only calling themselves and they know they are spoofing, they are not "intending to defraud or deceive" anyone.
Regardless of the legality of this, the fact that anyone can do it means that someone will do it.
I guess if you're fortunate enough to be fairly unknown, the likelihood that someone would really care enough to do something like this for you in particular is pretty small. However the fact that someone can do it means that someone probably is compiling this information and storing it away to be used at some point in the future.
I guess it gives a whole new feeling to the concept of calling my cell phone a leash.
It hasn't been signed into law yet: http://www.govtrack.us/congress/bill.xpd?bill=s111-30
Sorry, that's the 2009 bill. The 2010 version -- the one relevant now -- is here: http://www.opencongress.org/bill/111-h1258/show
I'll be interested to read the details, but 2 out of the 3 things have been known for quite some time. The 'caller ID' spoofing trick has been known for _years_. The concept they are touting is known as "back spoofing". I've had friends doing this for a long time. However - there's one problem. No call cell phone associate caller ID with a phone. Yes, back spoofing works great - with _land lines_, but it's always that accurate with cell phones. So, "finding" the cell number that way isn't very reliable. If I have a boost mobile number, bought in cash, under a fake name you'll be out of luck. That is, the caller ID name (CNAM) won't be associated with it in the first place _and_ I gave all fake information to begin with. About the voice mail. Not a big deal. This was reported 6 or more years ago. The idea is that you spoof your targets number with their cell number. The Telco side "sees" this as a call from the cell and drops you into their voicemail system. Some telco's have fixed this, other haven't. It's been a known flaw for years and years. You don't use CID for authentication exactly for this reason. If possible, PIN protect your voicemail will stop these types of attacks (if possible). Anyways, the article is interesting, but several factors must fall into place or this attack won't work.
Anyway unless the software he's using is illegal or the order of key strokes he's typing is illegal then nothing he's doing is illegal, well unless the result of using that software with those keystrokes is illegal, but then according to common-law it's up to the law enforcement body to prove he knew what the result would be.
In Soviet Russia, phone calls you!
You missed a small detail. It's supposed to be funny, too.
I find it interesting that they claim this is "legal"; I suspect they mean "we don't know of or haven't thought of the laws that one would be breaking by donig this".
Sure, they point out specific steps of the process that don't break specific laws even though you might think they would; but in the end, a series of actions that would each be legal on its own can add up to a crime. Spying on another individual, tracking their whereabouts and spying on their phone calls, is in and of itself illegal no matter how clever your approach to doing it.
"Why, I'm just driving around and sometimes looking through this telescope. Neither of those things is illegal, is it?" Grow up.
Every civilian in the US can be found guilty of cocaine dealing & have all their property forfeitured, just through the uncorroborated testimony of a paid snitch with a dubious past, & no other evidence what so ever - Ever heard of Mobile, Alabama & Union, Texas? Or look at all the prosecutor/judge/jury combos that have put innocent people to death.
And once it IS signed it's still legal if you're in one of a number of other countries when you do it. (I wonder if the EU laws on personal information apply to the caller-ID info retrieval step if it's done there?)
As far as I can see (IANAL) the only step that's currently illegal in the US is cracking past the voicemail password. That's illegal under the Computer Fraud and Abuse act (accessing a protected computer) and occurs at the server location even if it's initiated from outside the US so there's jurisdiction.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
You can still spoof as long as you aren't doing so to deceive or defraud.
Seems to me that spoofing caller ID in order to trick the database into delivering information on some other phone user constitutes intent to defraud.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Maybe legal in the USA where there are no privacy laws. As for the rest of the world, you should probably not try it.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
From TFA: DePetrillo used open-source PBX software to spoof the outgoing caller ID and then automated phone calls to himself, triggering the system to force a name lookup.
Name lookup? What is that?
The article claims that by calling someone with spoofed callerID, the phone system will look up the corresponding name to the spoofed callerID and pass along the corresponding name.
I've never heard of that functionality, but now I've got something to try with the office PBX!
This is quite obviously illegal under the Computer Fraud and Abuse Act.
... information from any protected computer."
Title 18, Part 1, Chapter 47, Section 1030(a)(2).
It's a crime if someone:
"intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains
Given the scale of their activities, it's almost certainly a felony too.
From TFA:
I thought spoofing caller ID was now illegal...
Not yet. The bill passed the US House of Representatives, but not the Senate.
The worst case mentioned on that page was 30% discharge per month.
"Gold still represents the ultimate form of payment in the world." - Alan Greenspan, 1999
Of the numb3rs episode Convergence where the thieves were able to piggyback onto the system to figure out the location of specific people using their cellphones. Seems as tho reality has caught up to tv.
Can't you get the same information by purchasing it from the cell providers? There's already precedent on this.
-- Terry
Sometimes actions reveal intent, but I don't think it does in this case.
These researchers have apparently tried the attack described in TFA on themselves with no intent to defraud.
If you spoof caller id to trick a database, only a machine has been deceived (and that's arguable). What you do (or intend to do) next is the big question.
FTA: "The first part of the operation involves getting a target's cell phone number from a public database that links names to numbers for caller ID purposes"
Public database of CallerID info? A link to that would be great! I've never found anything like that. Thanks.
How many more years will slashdot have an off-by-one error on your Score in your profile?
is it just me or does that not explain how they are able to gain access to the messages?
are they relying on the fact the phone does not ring to quickly brute-force the PIN undetected?
Because that would be illegal in most states, ("Unauthorized use of a computing resource, etc.")
Whether legal or not, if it's possible, it will be done. Turn off your cell phone and pull the battery if you don't want to be tracked and/or spied upon. But everyone here knows this, don't you? MK
So if instead of displaying "Michael" I make my phone display "Mike" I'm deceiving someone? Just checking.
- Michael T. Babcock (Yes, I blog)
Arrogant? No. I'm entitled to an opinion, and to state that opinion. As a citizen, there is no requirement that I keep said opinion(s) to myself. You, on the other hand, are absolutely entitled to counter it. By all means, do so. Every mistake of mine I can correct improves me, and I'm all for that. Calling names, however, gets you nowhere. Try not to worry about my willingness to state my position, and instead, look at the actual position, and if you have a counter, let fly.
Also, I am bound to point out that thus far, it appears that my opinion (based, among other things, upon thirty-plus years of study of the constitution and surrounding events, by the way) does describe the situation accurately. No one has yet to post a reasonable counterpoint. But again, if you think otherwise... please, enlighten us all. The floor is yours.
I've fallen off your lawn, and I can't get up.