Problem solve Get help with specific problems with your technologies, process and projects.

How to prevent mobile phone spying

Your cell phone conversations and wireless activity are not private, says resident threat expert Sherri Davidoff, and it's important to remember that mobile phone spying is far too easy.

What precautions should be taken to prevent mobile phone spying?

That depends on who you are and who you think might be spying on you.

Your cell phone conversations and wireless activity are not private, and it's important to remember that mobile phone spying is easy, and activity can be easily intercepted by many people. Consider the medium itself -- the air -- a shared one. Once upon a time, when cell networks were analog, eavesdropping on cell phone calls was trivial and vendors sold cell scanners to the public. Nowadays eavesdropping on cell phone calls is illegal, and the transition to digital networks made it much more difficult to convert captured RF to audio. However, telecommunications companies, government and law enforcement have much easier ways to snoop on calls -- as do attackers.

Since the Communications Assistance for Law Enforcement Act (CALEA) was enacted in 1994, telecommunications carriers are required by law to install equipment that facilitates electronic surveillance, so that federal agencies can have real-time access to telephone and Internet communications. The FBI has a sophisticated system called DCSNet that "can let FBI agents play back recordings even as they are being captured (like TiVo), create master wiretap files, send digital recordings to translators, track the rough location of targets in real time using cell-tower information, and even stream intercepts outward to mobile surveillance vans" (Wired Magazine). The NSA has also been provided with full access to all fiber-optic communications at U.S. telephone companies' major interconnection points.

There have been well-publicized reports of law enforcement using cell phones themselves as "roving bugs," remotely activating the microphones and capturing audio from the surrounding vicinity, even when the phone is off (see the 2006 reports on the FBI's monitoring of the Genovese crime family). E911 regulations have facilitated real-time location tracking of cell phone movements, allowing law enforcement to pinpoint the user's location at specific times.

When you're not using your phone, you can ensure it is not used as a "roving bug" or location-tracking device by storing it in an RF-shielding bag. Forensic equipment manufacturers sell RF-shielded mesh pouches for this purpose, and some have even been incorporated into handy phone carriers.

Closer to home, flaws in Bluetooth implementations can easily allow people around you to overhear your conversations or access your phone remotely. Josh Wright has an excellent demonstration of this on YouTube called Eavesdropping on Bluetooth Headsets. Bluetooth devices in "discoverable" mode will provide sensitive information that attackers can leverage to gain access to your device. Bluetooth devices are especially vulnerable while they are in pairing mode, because to facilitate pairing they exchange sensitive data that can be captured and used to reverse-engineer the device's PIN. To reduce your risk of Bluetooth spying, ensure your device is in non-discoverable mode by default, choose a long, complex PIN (if possible), don't accept unexpected connection requests, and only pair your Bluetooth devices in a trusted location (i.e. NOT a crowded stadium or coffee shop).

Finally, mobile devices are vulnerable to viruses, worms and spyware, just like a desktop computer. Until recently, the number of known outbreaks was relatively low. As mobile devices become more powerful, they will also become a more attractive target. While mobile malware isn't necessarily an urgent risk today, it's a trend to monitor going forward.

This was last published in July 2009

Dig Deeper on Malware, virus, Trojan and spyware protection and removal