gAtO sAy -In 2012 businesses information will be the main hacking victims thru their cell phones. IEEE say’s “it is likely to be C-suite executives exposing businesses to vulnerabilities” (CEO -Chief Executive Officer, CFO -Chief Financial Officer, COO -Chief Operations Officer) yes even (CTO’s) Chief Technology Officer will get their cell phones hacked and all kind of IP intellectual property- BI Business Intelligence- KM knowledge management- will go out the door. The hacked information is a treasure to cyber criminals, competition, international/national governments, hackers and scipt-kiddies. Smartphones Danger for Corporate World

GaTo sAiD bEfOrE -Why is this true, the public has been trained to recognize cyber-security threats associated with their PCs and laptops, they do not see their smart phones as computers and subject to the same threats. And in some ways those threats are even worse.

Research by IEEE Fellow Dr. Jeffrey Voas in the US has so far uncovered malware in more than 2,000 free smartphone apps. Voas says free, rogue applications like this will be the most common access-point for hackers over the next year.

Unlike on a PC, where web browsers often give plenty of warning about dodgy websites with warning lights and alerts, the screens on smart phones are too small to display this protection, These devices contain identifying information, potentially saved passwords, and authentication details, and are much more likely to be misplaced or stolen than other larger portable computing equipment.
It takes just one high or low level employee to download malware onto their phone and spread it to the organization systems.

But the fun does not end here you don’t really need to be a hacker to get information to decide who to attack, just like targeted spear phishing attacks.
Here are a few thought:

2012 Security Predictions gAtO working copy v.01-alpha - click to enlarge

• ? spoofed caller ID -
• ? low-tech approach of merely guessing someone’s four-digit voicemail PIN number or password
• ? pretexting -professional imposters

Social engineering if a person uses there cell phones to update Linkedin, Facebook or twitter – “Send an enticing link via SMS, email, Twitter; if the target follows from their phone you’ve got a chance at using one of many remote exploits for iPhone and Android to install a rootkit,”

An attacker can join social media and start collecting friends I’m sure there will be a wealth of information out there. Even indirect if you can get a friend of a friend of a friend you may be able to see your subjects SMS or cell phone update.

Watch how you use your cell phones PEOPLE.

WiFi and VIOP hacking for the personal and corporate data and better still small mom & pop stores and small business, how much information does your local gas station, news stand have on you, they don’t have an IT department. VIOP can allow you to drive by phone phreaking along the back roads of suburbia near the subjects (targets) home address.
Android and iPhones re-syncs phone book data, voicemail, text message logs, browser history, or anything covertly sent to you with your computer. Even your personal computer may have business information.
“Older versions of Android are easiest to hack,” – “Recent versions of iOS [are easy to hack] too, though both Apple and Google have been quick to release patches.”
If a rogue hacker were to hack into someone’s (your) voicemail, is there any way to detect the intrusion? Unfortunately, voicemail systems from the major carriers in the U.S. leave a lot to be desired. None that I’ve encountered offer any sort of access log. The best you can determine is whether or not a message has been listened to. Even then, if a hacker were to listen to and then delete a message, you’d have little way of knowing.”
Getting a person’s personal phone number to spoof could be accomplished by finding it in publicly available documents such as student listings, or these days, on social networking sites like Facebook. A bit of social engineering with real people who know or could access the number would accomplish the same thing

Your E-Mail is the KEY to cell phone hacking. It’s the closest thing to the skeleton key of the digital world. How about if your email is hacked and your password published. How about just simple bad password, in the release of the hacked email from Stratfor there were 100 with “password” in them. How about the last four digits of your phone number, or 1-2-3-4, or publicly available information like your birthday,”

Data Breach Affects 50,000 people; 50,277 Credit Card Numbers, 44,188 Hashed Passwords, 47,680 E-Mail addresses.
personally identifiable information:
• 50,277 Unique Credit Card Numbers, of which 9,651 are NOT expired. Note: Many credit cards are re-issued, and many credit card processors do not check the expiration date. Consequently, more than 9,651 credit card holders may still be at risk.
• 86,594 Email addresses, of which 47,680 are unique.
• 27,537 Phone Numbers, of which 25,680 are unique.
• 44,188 Encrypted Passwords, of which roughly 50% could be easily cracked.
• 73.7% of decrypted passwords were weak
• 21.7% of decrypted passwords were medium strength
• 4.6% of decrypted passwords were strong
• Average decrypted password length: 7.1 Characters.
• 10% of decrypted passwords were less than 5 characters long.
• Anonymous and AntiSec Hackers??Only 4.8% of decrypted passwords were 10+ characters long.
• Presumably the remaining non-decrypted passwords were stronger than the decrypted subset.
• 13,973 of the addresses belonged to United States victims; the remainder belonged to individuals from around the world.
Cell Phone — Password retrieval mechanisms can be exploited, most security protocols send forgotten passwords to a person’s main email address. Every service in the world typically goes back to your email address. Your primary email password should be different than anything else you use, and it should be stronger than any other password you use.”

Ubiquitous computing, of which our smartphones and tablets are but just the beginning, is going to require that we shift our paradigms of privacy and security in profound ways. This isn’t just the responsibility of the average Joe user, however.  We need to be demanding that our mobile service providers aggressively protect our privacy and keep the bar high for device security. In the meantime, to avoid becoming phone hacking victims, users should take extra precautions to regularly reset their PIN numbers to protect their data — just as we’re engrained to do with our computers and online accounts.
It’s not unreasonable to project that [phone hacking] will become more common, as more of our important data finds its way into the cloud, those seeking to exploit that data will seek the weakest point of entry. Your cell phone can talk to a cloud service so think about it. One exploit ran an application on the attacked phone that could retrieve data. The SMS came back with the attack phone’s INSI number; the phone’s unique ID. However the application could have just as easily have stolen a contact list, either personal or corporate. It is also possible in this scenario to push viruses to the device or even initiate a denial of service attack. The app could easily uncheck SSL, leaving the device vulnerable with no encryption when you login at your local coffee shop. These kinds of hacks are unique to smartphones because PCs don’t have SMS capabilities, gAto advised all smartphones that are under an organization’s control be tightly monitored, patched and updated regularly to avoid users taking matters in their own hands… - gAto oUt

References:
IEEE Experts Predict Smartphone Hacking Will Soar in 2012

http://www.prnewswire.com/news-releases/ieee-experts-predict-smartphone-hacking-will-soar-in-2012-134658373.html

http://uscyberlabs.com/blog/2011/12/28/stratfor-hack-personal-identifiable-information/

http://www.cellphonehacks.com/

http://en.wikipedia.org/wiki/Phishing

http://en.wikipedia.org/wiki/Corporate_title

http://www.cisco.com/en/US/products/csa/cisco-sa-20050412-icmp.html

http://www.google.com/search?client=safari&rls=en&q=midnight+raid+attack&ie=UTF-8&oe=UTF-8

http://www.privateline.com/mt_cellbasics/index.html