Be Aware of Caller ID Spoofing

The wireless operator's caller ID service embeds your phone number in every phone call and every network connection you make from your phone. A common assumption is that caller ID is always accurate, since it is controlled by the wireless operator. In fact, some services even use caller ID as their primary authentication mechanism. For instance, by default, T-Mobile's voice mail allows you to check messages without a password if you are calling from your T-Mobile mobile phone. Some web sites automatically sign into your account if you make an HTTP request from a phone number registered to your account. In many cases, your caller ID has become part of your identity.

However, in reality, caller ID is not completely secure. An experienced phone hacker can manipulate the network and change the caller ID to any number she wantsthis is called caller ID spoofing. Some callback services, such as Star38 (http://www.star38.com/) and Camophone (http://www.camophone.com/), allow anyone to spoof caller ID for as little as five cents per call.

You should call your service providers and request to set passwords for all mobile phonerelated network services. T-Mobile now allows customers to set an optional password on their voice mail account.

Remember that you cannot always trust the caller's identity based on the caller ID. For instance, if you get a call with the caller ID indicating "Bank of America," it does not necessarily mean that the call is indeed from a Bank of America representative. You certainly should not disclose your bank account information based on the caller ID. In this case, you should offer to call the representative back using a published number for Bank of America.

Use Strong Passwords for Web Accounts

You should use strong passwords to protect online accounts for your mobile phone, especially the wireless operator's web account for your service, and web sites you frequently use to share photos.

Many web services also allow users to retrieve forgotten passwords by answering a personal question (i.e., the "password question"). It is important to use a password question that is not easy to guess. And don't forget: the answer to the question "what is your favorite pet's name" does not have to really be your favorite pet's name. It just has to be something you can remember.

In early 2005, it is believed that a cracker either guessed socialite Paris Hilton's T-Mobile account password, or exploited an SQL injection vulnerability on the T-Mobile portal web site and reset her password. Regardless of how the attacker did it, Paris's account was compromised. After logging into her account, the cracker downloaded and then posted all her personal information, including her Contacts list and phone camera photos, on the Internet.

Protect mobile phone data on the phone's companion PC and web accounts

Mobile phone data is stored not only on the phone, but also on the phone's companion PC and web accounts. For instance, the Nokia PC Suite can copy everything in the phone's memory to a PC for offline processing or backup purposes. Voice mail messages are typically stored in the wireless operator's voice server. Mobile web portal sites also store a lot of sensitive data from the contacts or photo albums in the Camera application. Any comprehensive mobile security solution needs to protect this remote data as well.

Secure the Companion PC
Generally, you should not use a public PC in a library or web cafe to copy data from your phone. In theory, you can delete everything off the public PC after you are done and you won't leave a trace. But in reality, you can miss or forget to delete important data. The Nokia PC Suite can also store important information and settings (e.g., Bluetooth settings) in directories that are not obvious to most users. Hence, to avoid these potential information leaks, I recommend avoiding public PCs altogether.

You should also safeguard your PC from viruses and spyware, which can be used to steal data from your phone. A piece of good PC antivirus software, such as Norton AntiVirus from Symantec, will protect your Nokia PC Suite databases and synchronized Outlook databases from attacks.