ONE of the most sensational trials in modern British history is coming to an end. Last week Andy Coulson (pictured), a former top adviser to prime minister David Cameron, was found guilty of conspiracy to “hack” phones during his spell as editor of the News of the World, a tabloid newspaper. On July 4th he will be sentenced along with Glenn Mulcaire, a private detective who worked for the paper and carried out much of the hacking (illegally accessing private voicemail messages) to obtain scoops on celebrities and other figures. In the course of the trial it was alleged that some 5,500 people may have been targeted. How did the hackers do it?
Blame the trade-off between convenience and security. Not so long ago, a telephone answering machine was as secure as the room it was in. It was, essentially, a tape recorder bolted onto a phone. If you called someone and they were out, the tiny cassette inside would record your message so that the intended recipient could play it back later. The only way to “hack” the message would be to steal the cassette itself. But mobile telephony has changed all that. Users now need access to their messages wherever they are and sometimes from more than one phone. This provided a way in for the phone hackers.
Once they had found out their victims’ mobile-phone numbers (from public or private records) it is thought that hackers working for the News of the World broke into their voicemail accounts by mimicking the phones’ owners in various ways. Voicemail systems have different ways of verifying the identity of someone trying to access messages. Some check the caller ID of the phone making the request (if your voicemail system does not require you to enter a numerical access code or PIN, it probably works this way). So the hackers falsified this with software easily downloadable from the internet. Other systems require PINs, particularly when the owner is accessing his messages from abroad. In theory these codes should be hard to obtain, but in practice it is often surprisingly easy to guess them. Many people, for example, do not change the standard code that is assigned when a new mobile-phone contract is taken out: this is often 1234, or the last four digits of the phone number. Even when people do change the code, they often use their birthdate, or another easily guessable sequence. And if none of these methods work? Then, hackers found, a call to the mobile phone company, pretending to be a subscriber who has forgotten their PIN, often does the trick. (This approach is technically known as “social engineering”.) The court was played recordings of such calls. In one Mr Mulcaire persuaded an operator to reset the PINs of several voicemail accounts by providing an internal password (which he had blagged from elsewhere).
Phone hacking, then, is a remarkably simple business, one that requires more audacity than technical genius. (It is nothing to do with computer hacking, a term that denotes using clever technical tricks to get things done quickly, and does not necessarily imply malicious intent.) Fortunately, making your phone harder to hack is straightforward, too: use a voicemail account protected by a PIN and make the code hard to guess. But the safest option of all is even simpler: disable your voicemail account altogether, and ask people to send you a text message instead.
Powered by Facebook Comments