Hi, my name is Per Thorsen and I am the founder of Passwords.com.
I'm really happy to be speaking once again at the Crypto & Privacy Village here,
this time at the DEF CON Safe Mode 2020 edition.
My talk is entitled Hacking Like Paris Hilton 14 Years Later and Still Winning.
And this is a talk that has been in the making for quite a few years
by me now. So I'm really, really happy to sort of tell the entire story on this one.
First, a very quick introduction of myself. Here you have a tweet a couple of years ago when I
said that I do have a certain interest in passwords and Cormac Hurley at Microsoft Research,
he responds back saying that, confirm I have a healthy curiosity while Thorsen is pathologically
obsessed with passwords and, well, digital authentication. So that's basically me in a
nutshell. Now, I do say this because for this talk it's important for me to provide a bit of
background and context to the stuff that I'm going to talk about. I'm going to talk about
essentially two topics, hijacking of mobile phones in different ways and also voicemail hacking,
getting access to your or somebody else's voicemail with the provider in question that
you are using. And why am I talking about this? Well, my interest is in passwords and digital
authentication. And in some cases, we have stuff like two-factor authentication, which is, you know,
everybody is talking about now, you should be using two-factor authentication. I agree.
But in a lot of cases, people are using their mobile phones to do exactly this. In fact,
you know, you are using two-factor authentication using text messages,
maybe email, which more and more people are probably using on their phones or iPads anyway.
There can be also voice-based SMS two-factor authentication. You have in-app push messages,
you have TOTP authenticator apps, Google Authenticator is probably the most common one.
And of course, maybe you're using WebAuthn as well, either through a hardware key or maybe
you have it integrated in your operating system like Android has today. And
if I want to hack into your account somewhere and you are using two-factor authentication,
two-factor authentication, well, it doesn't actually block me from hacking your account.
It makes it more difficult. But the only thing that is certain in life are death and taxes and
everything else can be hacked and probably will be sooner or later. So mobile hijacking,
something that came up to me many, many years ago when we saw sort of like
two-factor authentication by SMS coming in as a thing that some were using. And I got curious,
well, how can I bypass this? How can I hack it? And so on.
So seven years ago, actually, the Norwegian Government Agency for Financial Supervision
and Regulation, they issued their annual report about the financial market in Norway with lots
of interesting information to some nerds, including losses due to like skimming,
fiscal card skimming, and also online banking attacks as an example. And they said, and this
is 2013, they did say that they were expecting a rapid increase in mobile hacking. And they said
that they were cautious and they were concerned about the fact that people were starting to have
their entire digital life, including banks, including passport information, your money,
and your digital life on your phone, and you would be carrying your phone with you all the time.
And it was, you know, I'm sort of willing to say that they were basically ahead of their time,
at least for Norway, where I live, because did we see any, you know, sudden increase in mobile
hacking in 2013? Not really. And it also depends on what kind of mobile hacking are we talking
about. Now, here's a typical example that you have probably seen. Now, the message here is a
text message received in Norwegian. And the simple translation is, you know, we could not invoice
your membership for this month. Try again or update your payment details in order to continue
watching Netflix. And there's a totally legit link down below that you're supposed to click.
Now, I was actually sitting on my couch in my living room and watching Netflix
with a woman next to me on a Saturday evening. And, you know, we had turned down the... but I
had turned down the lights and we had some... we had some chips and we had some food and we,
you know, enjoying a good movie. And then suddenly it says ping in her phone. And politely,
of course, I stop Netflix and I look away. And she's typing and she's typing and she's typing
even more on her phone. And I'm, well, I'm sort of getting curious about, you know, what happened now.
And then she suddenly asks me, is it common that Netflix asks for your social security number?
And that's the moment when I turn on the lights and turn off the TV and said,
hey, love's gotta wait. We do have a security problem at hand. Give me your phone.
And I got it. And this is, this is the text message that I saw on screen. And I say, well,
you have probably already given away your username and your password. So now we have to change that
for Netflix. Simple scam. A lot of people, lots of people fall victim to this one. But it's the
big thing. Well, monetary wise, I don't know. Is it a threat to society? No, not really.
But we have also had other and more, should I say, interesting cases in here in Norway.
As an example, we had a minister in the government who actually went on a holiday trip to Iran with
his new Iranian girlfriend. And when you are a minister, you know, you should be sort of careful
of that, at least in the current political climate. And he did travel and he did not tell
the secret police. He didn't tell any intelligence services or lifeguards. He didn't tell the prime
minister or anyone else. He just went for it. And that's a big no-no. And when he came back,
back, one of the statements that he issued was pretty amazing. He said that, you know,
he had been, you know, traveling before. He knew his stuff when it comes to security.
So he said that his phone was secure because most of the time it was turned off and was just
left in the hotel room in Iran. Now, this and a lot more about, you know, this person and in this
case led to the simple fact he was forced to resign from his position. Now, for mobile hijacking,
I will be talking about port-out attacks, which I have chosen to call them, and to differentiate
that a little bit from sim-swap attacks. And I will also talk about spoofing, the sort of the
thing of, you know, what can you do when you are trying to pretend to be somebody else,
or if you actually succeed in becoming somebody else. There is also traditional fraud involved
in mobile hijacking as something as simple as having an insider issuing a sim card for you
in the wrong name and so on. I will not be talking about that.
Port-out attacks are the simple process of transferring a phone number to another operator.
That is one of the things you can do in Norway. You don't have to change your number,
you can transfer it freely to any operator you want to. And when I started working for
my current employer three years ago, I came to, you know, for my first workday on August 1st,
and I have been a customer of one telecom provider, Telenor, since basically the dawn of time,
more or less. And my employer said, you know, just give us your name and your phone number,
and, you know, we'll take care of porting it to the new provider that we are using,
we will be paying for your phone subscription, period. And I was like, you just need my
name and my phone number? Yeah, that's it. So I said, well, it's Peter Horsheim,
and my phone number is da-da-da-da-da. And by the way, phone numbers are by default public
available to anyone in Norway, unless you specifically say, I do not want my number listed,
or eventually also I want a secret phone number, there's a difference there.
And my employer just sent an email to their telco saying that we want to transfer the
subscription for Pears phone, current phone, this is the name, this is the phone number,
and we want to port that out and over to your service, and we want it done as soon as possible,
by email. And I got handed a new SIM card and envelope at work, and then I was told that,
and this was on a Tuesday, and I was told that the port out will happen on Friday, midday noon.
The porting actually happened on Thursday, 124 hours before it was supposed to happen,
it happened at 12 o'clock. So suddenly my phone stopped working, and I had to take out the
current SIM card and insert a new card from the new provider I had been given at work.
And this means that there was a time window of approximately 48 hours, maybe even less,
where I would have to sort of detect that something is wrong, understand what is actually
happening right now, and then act before it would be too late. And not only that,
I have also been told, without being told the exact time frames, I have been told that
you can ask these telecom operators as well to do a very quick port of your number,
and then it will probably happen in a few hours.
And not only was this process going faster than expected, it happened in 48 hours or less,
but for me to be able to understand, you know, if somebody initiated that without asking me or
telling me at all, these are the two text messages that I would have to understand
and react upon before it was too late. The first text message came from my current provider,
which was Telenor. In Norwegian it says, you know, thank you for being a customer with us,
sorry to see you go, and here's a questionnaire with an HTTP link, unencrypted link, where they
just want to ask me a single question about, you know, why did I leave or would I like to come back
again. And from my new phone provider, selected by my employer, I also got a text message.
Interesting fact number one, the sender number is an invalid phone number, it's not possible
to respond back to the number 470-5050, as you can see on the slide. And it says,
welcome to Telia, which is the name of the operator, and your phone number is now transferred
to us, have a nice day, best regards, Telia. That's it. And I'm just imagining my own mother
receiving these two text messages, and I am very certain that she would not really understand
what's happening here. And I'm not sure if she would actually call either of these two operators
in time to understand what just happened. And one of the things that I did as part of this,
because I've been working for several years looking into, you know, this issue of sort of
like being able to hijack somebody's phone number through social engineering and so on,
and I talked to the largest financial newspaper in Norway, dug a snag sleeve about this when I
was sort of ready and said, I have some theories, I have some facts, but I need to be careful not to
step over, you know, the red line on what is legal and what is illegal to do. But you are a newspaper,
so you can sort of defend doing things that might be considered shady, because you are sort of
working for the public and you should look into this. So they did. And they actually made an
agreement with one of the most famous bloggers that we have in Norway, Sofie Elisa, and they
asked her, would it be okay for us to try to sort of hijack your phone number? And she agreed to
that. And the newspaper actually has a video online that you can watch for free. It's like
three minutes long, where a female reporter from the newspaper that looks nothing like this blogger
she goes out on the street to a couple of sales people from a phone company, and she hands over
a business card that is fake. Obviously, she printed it on her own printer. And she says,
I'm Sofie Elisa and I would like to port my number over to you. And with the fake business card only,
they accept that as a valid ID and initiates the process. And the newspaper and of course,
Sofie Elisa, they were shocked that, is it that easy? You know, you can affect business cards
really. This was scary and was scary to me, was scary to the newspaper. It was very scary to
everyone to be precise. Now for SimSwap, I know that SimSwap is the standard term to use,
especially in the US on these things. And I wanted to make a difference between what I call
mobile hijacking and SimSwap attacks or port out and SimSwap attacks here. SimSwap to me is the
same as in the US, you will get new SIM cards for a specific subscription for a specific phone
number. I don't know if you can do this in the US. I don't know if you can do this in Sweden or
for that matter. But at least in Norway, as part of your current service with your phone company,
you can get the new SIM card and you don't need any sort of valid reason. You can just say,
I want a new SIM card and you will get one. You can also get the twin SIM card. So you can have
two phones that are essentially the same. So if somebody calls you, it will ring in both phones.
And you can also get a data SIM card that, you know, given the name, you can not use it for
making or accepting phone calls in or out, but you can use it for data traffic only. And you can
get a specific data SIM card for your existing service subscription with all the operators,
to the best of my knowledge. And the same thing applies here. Fake ID will probably get you one
of these SIM cards that will also, given the circumstances, you will also be able to do sort
of full or at least limited sort of surveillance of whatever victim you are targeting.
So it became very obvious to us that we have a problem with identifying people. And we also
have a problem in a business to business relationship and in general with authorization.
If you are not ordering or changing a phone subscription for yourself, but for somebody else,
how do we identify and how do we find out whether you're authorized to make those changes on behalf
of another person? Obviously, there was a problem with this. One of the revelations made by the
newspaper was that the telecom operator Telia, which is working out of many different countries,
it's home base is in Sweden. They found out that in Sweden, the government requires Telia to ask
for proper ID when you are setting up, terminating or changing or moving a phone subscription,
like passport or something, digital ID, which is government approved.
Now, Telia also operates in Norway, and we also have digital identities in Norway called Bank ID.
And in Sweden, they are using Bank ID to identify their customers. So it was a pretty easy question.
Are you using Bank ID or something similar in Norway as well? And Telia, they responded,
no, we don't do that. And when the question came up, why don't you do that? The answer to the
question was saying that we do as we are required to do by the government in Norway. And the answer
to that, again, is the government in Norway didn't require the telephone operators to ask for any
kind of solid ID, being it on paper, like passport or driver's license, or a digital version of a
digital ID. Again, a big surprise. So I looked to the Federal Trade Commission in the US, more
specifically to Lori Cranor, who is normally a professor at Carnegie Mellon University, and she
wrote several articles on the Federal Trade Commission website. One where she talks about
how she got her phone hijacked through a SimSwap attack. It's an interesting article, it's definitely
worth reading. And one of the things she did was to ask all the major mobile carriers in the US
what consumers could do to protect themselves from a mobile account takeover. One of the most
important steps you can take is to establish a password or PIN that is required before making
changes to your mobile account. Each of the carriers offers this feature to the customers
in a slightly different way. And this was sort of good, I mean, social engineering, PIN guessing, and
so on, can probably still get past this, but at least it's one more speed bump for the bad actors
to try to hijack your number and do a SimSwap attack. But interestingly, none of the providers
in Norway had any feature like this at all in place. And to the best of my knowledge, they are
still working on figuring out how to do this in Norway. So as a result of this, or one of many
results out of this process, which, you know, culminated in the spring of 2019, that means last
year, is our Minister of Digitalization at the time, Nikolai Astrup, he instructed the Norwegian
Communications Authority, NKOM, to implement security functions in order to prevent mobile hijacking
in cooperation with the telecom sector. That is a pretty serious move to do when you instruct them
to work on this immediately. And not only that, but also in September 2019, the government
also released a hearing named Actions to Prevent Mobile Hijacking, as a direct consequence of the
stories made by Dagens Næringsliv and by me earlier in the spring. This came out and there
was a hearing process until December 2019, where, you know, everybody, government organizations and
private people, could then give their input on the proposal for changing changes to the existing
law. Now, this hasn't passed into law yet, but we are sort of waiting for the results from the
hearings to see what's going to happen next. And also, while working with this on my own, and
together with Dagens Næringsliv, I was not aware that a news website for the IT and security
industry in Denmark, were also looking into the same thing, more or less, in Denmark with
different providers. Simply, social engineering into stores selling SIM cards, making replacement
SIM cards, and so on. And they succeeded many, many times. And, you know, they posted this article,
among many others, saying that after multiple failures, telcos are actually considering to
completely stop handing out SIM cards in physical stores. Now, Norway is next to Sweden, next to
Denmark, and next to Finland. They are neighbours. And we are very much alike in society, in law,
in language, and so on. But one of the things that has been fascinating to me is to see the
different reactions from the telcos, from newspapers, from, you know, normal people like
you and me on the streets, and from politicians, on how they have reacted to these stories in the
media. Because stopping completely to hand out SIM cards in physical stores, haven't even been
mentioned by anyone in Norway or in Sweden at all. But it is pretty much the same operators
working in these three countries. So it's kind of like,
are you people not even talking to each other internally in the same company? Or what is
happening here? So to sort of more better and better exemplify the problem of spoofing,
I say, what if I could be you as a bad actor? Now, this is Crypto and Privacy Village. You know,
we have had lots of talks on this. You are most probably watching EFF closely. You are watching
what is happening in your country right now in terms of privacy. It doesn't look good in quite
a few places all over the world. Now, in Norway, we do consider ourselves, you know, a very safe,
solid, democratic country with a government that, you know, well, we trust our government,
believe it or not. But still, there are cases where things are happening. Now, this one is an
article or series of articles that were released in the fall of 2019, Chasing Max. And this is about
a guy that has been caught by the police. And he is charged for hacking the accounts of
approximately 50 different random women around the country, extracting pictures, videos, contact
details, harvesting usernames and passwords, gaining access to Instagram, Facebook, and so on.
50 women randomly all over Norway. And the newspaper told us a story about Nina.
Nina was smart. Nina was using two-factor authentication, SMS-based two-factor
authentication for her phone account, for Facebook, for Google, for Apple, and so on.
And she woke up one morning with a picture like this, where she had received authorization codes
from different services, like Microsoft, like Google, like Apple, in order to do a password
reset. And she had lost access to a lot of her accounts. And she really couldn't understand
how did this happen, because I was using two-factor authentication. And lots of people
say that, well, if you have two-factor authentication, you're secure, right? Wrong.
What they actually found out in this particular case is that Nina was using
Telia, one of the telecom providers in Norway, and they had a service called SMS Copy.
You could log on to their web page, like, you know, my page, and you could configure the SMS
Copy service, which is essentially a message service, so that if you receive a text message
to your phone, Telia will also silently forward that text message either to another phone number
or send it to an email address. You know, what could possibly go wrong with this?
And in order to get access to the my page at Telia, you needed a username and a password,
and they did not offer any kind of two-factor authentication at all. So what this bad guy did,
who is now being prosecuted by the police, he went to that page and tried to log in
with a lot of different usernames and passwords. And as we know, people are reusing passwords.
And I suspect that he got in through credential stuffing or online password spraying. And by
getting in there, he could configure the SMS Copy service, he could order a password reset from
different services, and although Nina received the messages, she received them in the middle of the
night when she was sleeping, and he was up and he received the same messages, and by that he
gained access to all the accounts of these women. And that, I think, serves as a really
hard and scary example of what the possible consequences can be
if you don't have secured your entire chain with two-factor authentication or something else.
Two-factor authentication can be bypassed in so many different settings and scenarios.
Now, this was about hijacking your phone number and receiving your text messages and so on.
But I've also been looking into voicemail hacking. And this goes back again to the title of
Paris Hilton, because all the way back in 2006, there was a lot of articles around the world
saying that Paris Hilton and Lindsay Lohan had got into a sort of a disagreement, and they were
trying to hack each other's phone numbers, spread them online, and also gain access to each other's
voicemail boxes. And the story is, to the best of my knowledge, is that Paris Hilton
gained access to the voicemail box of Lindsay Lohan. And in even mainstream Norwegian media,
this was mentioned on August 27, 2006. And not only did they mention this happening,
they also actually mentioned the specific service that Paris Hilton had been using to do this.
Now, if you Google voicemail hacking, you will find interesting results. One of them is a talk
that has been presented at DEF CON before, that also includes a tool that you can use for some
services with voicemail, where you can try to basically brute force the PIN code to get into
the voicemail boxes. Some voicemail boxes will have a four-digit PIN, three digits, five, six
digits that are randomly selected and provided by the telco to the user. Other telecom providers
may allow you to select your own PIN. One of the things we know from PIN code research is that
as soon as you allow users to select their own PIN code,
those PIN codes are not going to be any good at all, in pretty much all cases.
And there was also, back in 10 years ago, there was also a large scandal with News of the World
in the UK, where the British royal family got their phones and their voicemail hacked by reporters
that were able to extract messages that were, you know, most definitely not meant for the public to
listen into. This was a big scandal, and also in this case, the suspicion was targeted against
the same service as Paris Hilton had been using several years earlier.
Now, this is probably a picture that you have seen before. In order to do a password reset at
Microsoft, you have several different options. You can have an email sent to you with a link
that you need to click to gain access, or you can also ask to use an authentication app if you have
a TOTP app installed. And you can also have an SMS sent to you. So there, you know, with SMS,
you already see one problem with the SMS copy service. But there are also services where,
you know, to do a password reset and so on, you can also ask the service provider to give
you a robot call and to read the PIN code for you out loud. So one of the things I was curious about
is, hmm, can I initiate a password reset for someone online and ask that service to make a
phone call and just, well, go directly to voicemail and enter that PIN code into the voicemail box,
so I can get access afterwards, listen to the code and use it to get access to an account.
Interesting experiment. So, you know, let's hack. And what I did, I used the same service
as Paris Hilton from 2006, which is called Spoof Card. They are still operational today,
and they are still doing their fancy little tricks today. But of course, they do say that
this service is to protect your privacy. And you should, of course, not use this for any kind of
legal purposes. So I did. And the case number one was Telenor, the biggest telco in Norway.
I managed to get access to people's voicemail. Of course, I did this under a responsible disclosure.
And I also talked to my potential victims, friends, family and others, co-workers, and asked
them, can I try this? And if you want to listen in, you can do that. I showed them how I could
very easily use Spoof Card to get access to their voicemail, listen to the messages, delete them,
and also change the welcoming message for the voicemail. I told Telenor about this on a Tuesday
and on the Thursday they had fixed it. So in less than 48 hours, which is really, really good.
They also, of course, after, you know, fixing this, there was a media article and they said
that they were sorry for this and they acknowledged that this vulnerability had probably
been available for use and abuse for 13 years or more, you know, dating all the way back to
the Paris Hilton incident. 13 years. An interesting thing is, this specific service, Spoof Card,
was mentioned all the way back in 2006 in Norwegian mainstream media. But when Telenor
was informed about this in November 2019, they said, never heard of it. Which is, well, I mean,
you don't have to read mainstream media, do you? But in this case, I was a bit, well, surprised.
And as a consequence of my findings in this, the Norwegian government agency that are overseeing
the telecom industry in Norway, they chose to issue a fine of 1.5 million Norwegian kroner,
that is equivalent of 165,000 US dollars today, as a fine because they didn't have sufficient security
for the voicemail system. And depending on the country you're in, if you're in the US,
I would guess a fine of 165,000 US dollars doesn't sound much. In Norway, to the company,
it's pocket change, not even that. But it is very, very rare that any company is being given any fine
at all by this government agency. So that sort of underlines the seriousness of this security breach.
And also our Norwegian data protection agency, they also issued a reprimand to Telenor saying
that this is really not good, and you have basically violated two different GDPR articles
on this. But since you have already been fined once, we are not going to slap another fine on
top of that. That's usually not how it's being done here in Norway. And there's case number two,
because I asked friends in other countries as well, can I try to hack your voicemail box?
So with Telia in Denmark, the version two news website in Denmark, they tried this out on my
behalf, and they found that this works. I approved it for them. I talked directly to Telia, they
fixed it, and they also ended up in the news saying that this is a big scandal, and it's not
just in Denmark, it also applies to other providers in Norway and in Sweden.
And kind of fascinating that version two even have an article saying that Telia is now considering
better voicemail security. So I'm sort of waiting to see what's going to happen there, but hopefully
it has already improved. Case number three is Tele2, which is the third provider that I found
vulnerable in this. Based in Sweden, they operate in eight different countries. I tested against
voicemail boxes of people in Sweden. I found them to be vulnerable. I got access to their voicemail.
I do not know about the, you know, hackability of Tele2 voicemail boxes in other countries where
they operate, because I didn't test, but Tele2 says, nope, they are not vulnerable. So hopefully
that's true. At least, again, this also led to media attention in Sweden. Again, back to, you
know, my fascination of the different ways of how this was handled, or wasn't handled at all
in the different countries. In Norway, there was a lot of media attention on this. Mainstream media
picked it up. There have been issued a fine. There have been issued a reprimand by the Data
Protection Agency of Norway. In Denmark, there have been a little bit of media attention, but
politicians have said, well, the problem is fixed, so there's nothing left for us to do, and we'll
just leave it to the telecom providers to, you know, they have to talk to each other and figure
out what to do. And that's it. And in Sweden, pretty much nothing has happened at all so far.
In fact, there were one or I think it was two or three articles in total about this,
and then it went completely quiet. But all in all, I found that several million people across Norway,
Sweden and Denmark were affected by this, and have most probably been affected for 13 years or more.
At the same time, the telecom providers, they have logs that maybe go back two, three or four
weeks in time. So proving or disproving that this hasn't been hacked and abused by anyone for the
past 13 years is completely impossible. So they have concluded that, well, since we haven't heard
anyone complain about it, nobody has probably been hacked. And there's nothing we can do about that.
So I just want to say that, you know, this is sort of still a work in progress,
but I would really, really, you know, recommend you to listen in on the talk from Kelly Robinson
on Sunday here at the Crypto and Privacy Village, where she will be talking about Stör shaken.
Not saying anything more than that, just listening to that talk. And by that,
we have reached the end. And I say, thank you. And I am ready for your questions now,
or you can contact me later. You have my cryptic contact details here on screen. Thank you.
Not saying anything more than that, just listening to that talk. And by that, we have reached the end
and I say, thank you. And I am ready for your questions now, or you can contact me later.
That was the talk, Hacking Like Paris Hilton 14 Years Later and Still Winning, by Pear.
We have them here for our live Q&A, so please put your questions in the Discord CPV Q&A channel.
So Pear, one of the first questions we have is, in the USA, many carriers use the phone number
as a default PIN. So if you spoof the number and call as voicemail, you can access it using
the phone number as the default PIN, if the user didn't change it, and a lot of people don't.
Is that the same outside the US of other carriers? Well, I can say for sure that at least that's not
what we have. That's not what we have here in Norway. I haven't seen this in Sweden or Denmark,
but I really can't answer for all telecom providers in all the countries
outside the US. That's impossible to do. But I do have my suspicions that you will find
a lot of bad security connected to both voicemail accounts, and also in general,
the accounts where you can log in on your telco homepage for, in any way,
administrating your subscription with that. Awesome. Thank you so much for that.
In your ideal world, what would you like to see exist in place of the current available
options that we do have? Well, there are many facets to this. And one of the things that I
pointed out early in my presentation is starting with whenever you go into a shop and say that you
want a new SIM card, or if you want a data SIM card, or a twin SIM card, if you want a new
subscription, if you want to change it, if you want to end it, to move it to another telco,
and then you have the issues of logging on to your telco provider to administer your subscription
there, like this SMS copy service, which is now, of course, turned off, and options like that.
Then you also have the stuff like doing the voicemail hacking using spoofed numbers. Now,
some of the issues are specific to each telco provider, like the absence of two-factor
authentication for administrating your account. And then you have the security awareness training
for staff on help desk, online chat, and in stores. But there are also problems with the
basic telco networks worldwide for mobile communication using the SS7 protocol and
stuff like that. And that is, I'm not going to say it's an unsolvable problem, but it's not up
to a single telco provider to fix it. It's not up to a single country to fix it. And basically,
if you are to fix the fundamental security issues that we have in the GSM networks today,
all providers and makers of phones, of networking equipment, all the telcos,
they have to come up with solutions. And you have to replace all the handsets in the world.
And we can't do that. That's just impossible to expect that to basically ever happen.
So one of the things that are coming now, which is very interesting, of course, as I said,
Kelly Robinson will be talking about stir shaking. So I'm not going to spoil that anymore,
but that's a talk that I really hope people will listen to. And one of the things that I'm doing
as well is trying to, to the extent I can, I'm trying to pressure the Norwegian government and
also the governments in Sweden and Denmark as well, together with other people, to ask the
telcos to at least look into stir shaking, and eventually also consider, can it be implemented?
And how can we make the rest of the world implement it as well? So long answer to a short question.
Wow, that was a really great, thorough answer. Thank you so much. So another question we have
is, should we just disable our voicemails then at that point? Oh, yeah. Oh, yeah. Disable voicemail
now. I mean, there's absolutely no point... I can't really understand why people are using
voicemail at all. And I was in Czech Republic last year, I think. And I was surprised to hear
from friends in the Czech Republic that voicemail, nah, no, they don't have that with their
phone subscriptions. And I asked around, and they couldn't think of any friends or family
who had voicemail. In Norway, we have three companies that are providing a physical
infrastructure for mobile communications. And then we have lots of virtual operators as well.
And all of them, absolutely all of them, by default, provide voicemail as a part of the service.
And there actually is no option to say, I don't want voicemail, but they do have options to turn
it off. So one of the things I would like to see is that, you know, well, I just don't need
voicemail at all. And I actually... I just don't pay for it either, because I can turn it off,
but I'm sort of still paying for it. Yeah, that's actually really... huh, I did not realize
that was an option in other places like that. Thank you. You kind of answered some of this
question already, but someone asked, as a regular user, what can I do to protect myself, if anything,
or is it completely out of my hands? Well, to protect yourself, you know, I'm working as a
security officer for a large hotel chain. And of course, I've been asking my colleagues and
friends about this as well, you know, what do you think about this? And of course, I can say,
I have truly scared a lot of people by being able to sort of hack into their voicemail using a
spoofed phone call, and also making phone calls that appears to be coming from your mom, or your
dad, or your brother, or whoever it is. And they are really surprised to see that I can do that.
So there are some things you can do. And the very simple thing that you can do is that whatever text
message you are receiving, or the phone number, or the name that you see in the display on your phone
when somebody is calling you, do not trust it. Because it is exceptionally easy to spoof.
And I don't know how, you know, I don't know, you know, you're in the US, so I don't know
how much people in the US in general know about phone spoofing, you know, number spoofing,
and text message spoofing. But to people here in Norway, the vast majority of people in the
IT security industry were absolutely clueless about this existing at all, when I started
working with this. And when I did my initial presentations last year, people were shocked
that this was possible. So as an end user, first and foremost, do not trust that the number you
or the name you see in your display are correct. No matter who calls or texts you, do not trust it.
As a millennial who does not pick up any phone calls at all, that's really fascinating to know
about. Oh, yeah, you youngsters. Yeah, well, yeah. I mean, you have a completely different
sort of way to protect yourself in this area. But I know, again, robocalls, as far as I know,
is a very big problem in the US. It almost doesn't exist over here yet. Except for the
operation on Microsoft is calling you to say you have a computer virus on your system. That's
the only robocalls we get. And when I got one last year, I was like, yes, finally. So there you go.
That is a very different reaction that I have, I think, along with other people.
Oh, gosh. With that said, thank you so much again, Pear, for all of your answers to this Q&A
and for your talk today. Please take care and enjoy the rest of your DEF CON.
I hope you have fun. Thank you so much again.