Is my cell phone's security compromised?
Greetings,
In the highly competitive trade that I work in there have been a number of competing parties in the same work group. The level of competition has involved lots of passive aggressive behaviors, gossip, rumor, innuendo, backstabbing, etc., but worst of all there has been a culture of eavesdropping that has evidenced itself in many forms.
My question is, although I know it is possible for anyone who can get there hands on your phone for a few minutes to install a hidden program on it that allows them to use it as a listening device to eavesdrop on your conversations, is there a way that I or my phone store (Verizon Wireless) or another party can detect such a program, and for that matter, if so, is it further possible to look into phone records to identify the culprit?
Here's one article of interest
Click here for a Printer Friendly version Print or Email This Page
March 2007, Page 12
Is Someone Eavesdropping on Your Attorney-Client Conversations?
By Louis L. Akin
A lawyer and his client are sitting in a café having coffee while on recess in a major case. They turn off their cell phones so that no one will interrupt them. They lean forward for a highly confidential tête-*-tête. However, they are not the only ones interested in their discussion. Unknown to them, a third-party — miles away — remotely turns on the lawyer’s cell phone and records every word of the conversation. When the conversation ends the lawyer turns on his phone, calls his investigator, and gets the latest on statements taken from key witnesses. The third-party records that conversation too, and while she is at it, downloads all the text messages and e-mails the lawyer has on his cell phone. She downloads the telephone numbers, dates, exact times, and duration of the conversations. Finally, she downloads information telling her the lawyer’s location when he placed or received cell phone calls during the past month. Fantastic? Futuristic? Not at all. It is happening now.
Activity Monitors
Technical surveillants, many of whom prefer to be addressed by the more Orwellian “Activity Monitors” appellation, have developed technical means of invading privacy. Eavesdropping has been around as long as eaves, the beams that form the two long sides of an A-frame roof. Eavesdroppers supposedly climbed up on the eaves to listen in on private conversations. Nowadays, that kind of physical eavesdropping is no longer a credible threat. While it may be trespassing, the Omnibus Crime Control and Safe Streets Act does not prohibit it.1
Common telephone taps are as old as the 1940s, but have grown progressively more sophisticated. The hook switch bypass was a device that circumvented the off button on the receiver of the old rotary dial telephones. In effect, the telephone microphone could be turned on remotely just as if it were off the hook, and someone miles away could listen to what was being said in a room. In the 1950s, Manny Middleman devised a way to activate a hookswitch bypass by calling a telephone that had one installed on it (which required a previous burglary to install) and blowing a certain key on a harmonica into the phone. He could then listen to conversations for as long as he liked from wherever he liked.
Taps are devices that are placed on telephone lines for purposes of covert eavesdropping. Bugs are devices placed in a room or area for the same purpose. Transmitters are physical objects that are easy to hide because of their incredibly small size, but they still require entry into the target area to plant.2 Hal Lipset, a San Francisco private investigator, waltzed around a cocktail party in the 1960s with a transmitter hidden in an olive in his martini.3 The toothpick was hollowed out for the antenna. Considering that he did it at about the time that color televisions were beginning to appear in homes in America, this was a considerable feat.
Eavesdropping devices have kept abreast of the times — advancing from ultrasophisticated electronics such as tiny frequency-hopping burst transmitters that compress and store conversations and transmit them through the air in short bursts that hop about in a preset pattern amongst multiple frequencies.4 To receive the messages, the eavesdropper has to know not only when they are going to be transmitted, but the exact order of frequency hops they will make during the short burst of transmission. The eavesdropper’s receiver has to hop with the transmitter to capture the electronic bursts and then demodulate them.
Eavesdropping devices can be physically installed on cell phones or computers in a matter of seconds by an intruder (a cleaning person, inspector, customer, client, sales person, acquaintance, police officer, or burglar). In the alternative, the device might be sent to the “target” by e-mail or text message. When programs are installed in the latter manner, they are called Trojans, a kind of virus that is packaged as something attractive or expected.
For example, a consumer might get a text message on his cell phone saying, “Call 314-666-1234 to update your Verizon cell phone software,” or “Download free new ring tones.” When the consumer calls to get the update, he or she gets a Trojan that installs in the cell phone as a digital eavesdropping device. No burglary required. The phone will turn on so the eavesdropper can listen to room conversation or autodial the eavesdropper and give such private information as the telephone number, date and exact time of each call, and the location (within feet) of each incoming or outgoing call the cell phone owner makes or receives. It will also send any text messages or e-mail to the eavesdropper.
FlexiSpy Products’s FlexiSpy Pro5 spyware cell phone tap ($49.95) is one of the latest commercially available cell phone eavesdropping devices on the market, but it is not the only one. Many competitors produce similar programs. Anti-virus software companies and tech writers condemn the program as blatant spyware that can turn on a cell phone (just like Manny Middleman used to do) and allow an eavesdropper to listen in on every conversation that takes place within earshot of the cell phone while the owner of the phone thinks it is off. Now, since most of us wear our cell phones on our belts . . .
FlexiSpy advertises its product as the “World’s Most Powerful Spy Software for Mobile Phones. FlexiSpy Pro is a mobile phone monitoring application that secretly records all activity on a mobile phone that has FlexiSpy Pro installed. Protect your children, catch cheating spouses. The possibilities are endless.”6 The possibilities for abuse are endless, too.
According to the FlexiSpy Web site:
“You can listen in on calls and read SMS/MMS messages. What’s more, even when the phone is not in use, you can remotely activate the microphone and listen in on non-call conversations. Of course, the legality of this falls in a grey area.”
Actually, it is plainly illegal to use the tap on anyone except your minor children. FlexiSpy adds the limp caveat:
“If you are the owner of your spouse’s (or child’s) cell phone, you are merely monitoring your property, but if you use FlexiSpy Pro on an unsuspecting neighbor, that’s a different story altogether.”
FlexiSpy Products adamantly denies that FlexiSpy Pro tap is a Trojan, stating that it has to be consciously installed by a real live human. Yet the critics disagree. “This application installs itself without any kind of indication as to what it is. And when it is installed on the phone it completely hides itself from the user,” says Jarno Niemela, a researcher for F-Secure.
This is a case in which both parties may be right — at least on the surface. A person has to consciously install the program, but that person does not have to be the cell phone owner. On the other hand, if it is sent as a Trojan, the person installing it may not know that it is spyware. The missing words are “effective legal consent of the cell phone user.”
F-Secure warns consumers8
“When FlexiSpy Pro is installed on the phone it will hide from Symbian’s built-in process menu and it does not have any visible user interface or icon. After FlexiSpy Pro is installed on the phone, the only indication that it is installed is that the application removal menu has an additional application named ‘phones’ in the list. This ‘phones’ application cannot be removed with the application manager.
FlexiSpy Pro has a hidden user interface that can only be accessed using a special code known to the person who has purchased the spying application and has installed it on the phone.
When FlexiSpy Pro is active on the device, it will record details of all voice call and SMS information, and then later send those details to the FlexiSpy Pro server.”
Law enforcement has a cell phone tap that is more limited but easier to install. When law enforcement officers get your cell phone number, they go to a Web site to find out the name of the service provider. They obtain a search warrant, call the service provider, and have the provider clone the phone on which they want to eavesdrop. The provider sends them a chip via overnight mail. Thereafter, each time the target uses the cell phone to make or receive calls or text messages, the police department receives the calls and records them. This technique is an updated version of the lease-line method of tapping land lines that was popular before cells phones came along.
Digital cell phone taps may be the newest technology available to the general public, but plenty of the old gear is still around and it works well. FM radio frequency transmitters that sell for $20 in electronics stores make ideal drop bugs, i.e., disposables. Disposables are transmitter bugs that can be left somewhere to transmit until their battery runs dry, and then they can be forgotten. The eavesdropper does not have to make a second entry to recover the devices. These bugs are cheap and untraceable; nearly every law enforcement agency uses them. They are also used by private investigators, people getting divorced, partners terminating a business relationship, possessive spouses, and others.
Carrier current devices are also available at electronics stores. They are sold as baby monitor systems. Strip off the baby blue or pink plastic case and the device can be hidden anywhere in a house or building’s electrical system, inside or out. It will transmit conversations from inside the house or office along the AC wiring to a receiver down the line. Room to room plug-in intercom systems do the same thing and are used by eavesdroppers for the same purposes. They are also commonly available in electronics stores.9 More sophisticated devices include light switches and wall plugs that really work to turn on lights or run a vacuum, but also work as transmitters when there is a conversation in the room
