Posted today in a bulletin on the Sprint PCS website:
Sprint has recently discovered that certain websites may provide a means for unauthorized access to your wireless phone voicemail account. These websites use technology that makes it appear as if a call, that is in fact placed from the website into a wireless voicemail account, is coming from the wireless phone. Sprint does not believe this security risk exists if access to your voicemail account is protected with a passcode.
In effect, Sprint has been using Caller ID information to authenticate a voicemail customer as having called from their wireless phone, skipping the need to enter a password (referred to as the “Skip Password” feature. While there have been no such security breaches reported yet, in theory a hacker can spoof their Caller ID data (or non-hackers could use a “legitimate” spoofing service) and appear to be calling from an authorized Sprint PCS phone, bypassing security features and gaining access to the spoofed identity’s voicemail inbox.
But this voicemail situation goes beyond just who has access to your messages. The Sprint PCS voicemail system also allows its users to place calls to any phone number through the voicemail interface and billing the minutes (and any international charges) to your PCS account, but only when calling from the Sprint PCS phone (option 8 in the main menu). In my opinion, this is a rather stupid feature, considering that it’s only enabled when calling from your handset, and you could just as easily hang up and place the call directly from that same handset. Nonetheless, the feature exists, and a CID spoofer could assume the identity of any “authenticated” user’s VM account and make calls, racking up minutes and charges (including international calls) as if they had physical possession of the Sprint phone in question.
With this in mind, even if you don’t care about the security of your messages, it’s still wise to disable the Skip Passcode feature in voicemail. To do this, log into you Sprint PCS voice mail box (either by holding down the “1” from your handset, or dialing your PCS number and letting voicemail pick up, then pressing “*” and entering your password). Once at the main menu, press option 3, then option 2, then option 1. At this point, your voicemail passcode will be played back to you as a reminder. This passcode will now be required even if you call in from your PCS phone.
I’m actually very surprised that Sprint was using conventional Caller ID to perform this little authentication trick. A much more secure route would have been the use of ANI (Automatic Number identification), which is a trunk level method used to identify a calling party. It’s been around much longer, is much harder to spoof and the latest release, ANI II, comes with the added feature of passing along what type of line the calling party is on (plain wireline, wireless, payphone, etc.), to further verify that yes, this is a cell phone that the person is calling from.