Security flaw left cell phones vulnerable to attack, report finds
Calls made using a smartphone may have been vulnerable to cyberattacks due to a security flaw, according to German public broadcaster Bayerischer Rundfunk (BR).
During telephone calls, information about the smartphone in question was in some cases transmitted in the background to the caller, which could facilitate potential cyber-attacks, BR said.
The broadcaster said it carried out a total of more than 70 test calls. With some networks including Telefónica (O2), unique device identifiers (IMEI numbers) were reportedly transmitted to the caller in several instances. For operators Deutsche Telekom and Vodafone, smartphone models and operating system versions were disclosed in some cases.
Malicious hackers can use this information to determine, for example, whether all updates have been installed or whether there are any security vulnerabilities.
The Federal Office for the Protection of the Constitution told dpa it takes security risks in this context very seriously, in response to a query. "The focus here is particularly on potential misuse by foreign powers."
The leakage of any information that enables a device or user to be identified must, in principle, be viewed critically. Sophisticated criminal cyber groups and state-sponsored cyber actors are capable of exploiting all such information to their advantage, it said.
"Consequently, the disclosure of IMEI-URNs as well as device and software information also gives rise to further attack vectors and, consequently, threats. For example, it is possible to deploy targeted spyware if the specific model or operating system is known."
It remains unclear whether the security breach might also have been caused by the smartphone hardware. In response to an enquiry from dpa, Telefónica Germany said protecting consumers data was a top priority. "To the best of our knowledge, the cause of the incident described did not lie in the systems or infrastructure of the telecoms providers," a spokesman said.
A Vodafone spokesman said the transmission of technical data used to establish connections during phone calls always takes place in accordance with industry guidelines. To further enhance security on an ongoing basis, the scope of the data transmitted has been further restricted.
Countermeasures taken by the affected mobile network providers appear to have been effective. The Federal Office for Information Security (BSI) informed the companies in its daily report that tests had shown that fourth- and fifth-generation mobile networks (LTE and 5G) are no longer affected by the security vulnerability.
