A method of staying connected on the go, the “Facebook over Mobile” facility has turned into “hacking over mobile”. Techies are increasingly expressing their concern over the FOM facility and claim that anyone who has activated it is in danger of identity theft. Little technical know-how and ulterior motive is all one needs to hack into a FOM user’s Facebook profile and with the help of any SMS portal, post malicious messages on it.
The excessive use of technology could also translate into more avenues for hackers and malware creators to exploit. Gunjan Piplani, media professional explains the use of FOM application, saying, “The user can update FB statuses by sending an SMS. I had subscribed it sometime back and they sent updates to my phone.” Upon subscribing to the service, a subscriber gets an SMS from Facebook every time anyone posts or comments on their page. And they can comment by replying to the same message with their comments. And this is the weak link in the service that hackers or spoofers use to break into the Facebook profile.
Popularly known as SMS spoofing, it is commonly used to play pranks, but that power can also be used to malign one’s image. Talking about the concept of SMS spoofing, Sunny Vaghela, ethical hacker and a cyber crime consultant, informs, “SMS spoofing or forging is possible because of AO-MT (application originated — mobile terminated) facility of mobile companies. There are many websites that allow a user to send an SMS using their customised sender ID. But many applications and websites are vulnerable, which allow the hacker to exploit the application and spoof the SMS as well.”
While spoofing SMSes isn’t child’s play it also isn’t impossible for a tech freak, who is hell-bent on creating nuisance, adds Sunny, and sounds warning bells by saying that anyone using Facebook mobile is susceptible to fraud. “Facebook mobile application allows people to use Facebook features using the mobile, so if a person’s number is spoofed, the hacker can exploit all features,” he adds.
However, the law provides protection for the victims in this case. If the spoofer’s Internet Protocol (IP) is traced, the culprit can be nabbed. Informs Santosh Raut, forensic expert, “If the user is able to track the IP address then it is possible to register a case\FIR in case one’s profile gets hacked.”
But the method isn’t foolproof, Santosh sums up saying, “Any IT professional can exploit this loophole easily by using a Chinese or US proxy server as then it gets almost impossible to track the culprit.”