Recently, Taiwan Mobile users reported on Threads that there was a voice verification vulnerability in LINE accounts and telecom phone number voicemails, resulting in forced logouts of LINE accounts and theft. After extensive media reports, LINE users panicked, and many people listened to online suggestions to turn off the voicemail function. Since voicemail is still a commonly used function for some users, and it is currently confirmed that the victims are mainly concentrated in specific telecom operators, there is a concern that telecom users should turn off the voicemail function because of choking.
Why does a voice verification vulnerability occur, causing LINE accounts to be forced to log out (stolen)? What is the correct way to handle it? Here is an explanation:
Image source: Nownews
The media reported that a large number of LINE accounts were forced to be logged out due to a voice verification vulnerability, and it was recommended that everyone close their voicemails to protect themselves! ? The following is a summary video and detailed explanation of the causes and correct handling of this wave of forced logouts of LINE accounts:
1. Why does a voice verification vulnerability occur, causing LINE accounts to be forcibly logged out (stolen)?
Recently, a Taiwan Mobile userThreadsIt was revealed that I received an SMS verification code at around 9pm on March 30. I was not using my phone at the time, so I ignored it. As a result, I received an email notification within a few minutes that “the link to LINE has been released.” When I opened LINE again, I found that I was forced to log out, and it was useless to log in again. Later, I sent a letter to customer service asking for help, and finally got my account back, but my LINE friends and chat history were all gone.
However, after verification, the current wave of users whose LINE accounts were stolen are concentrated among former Taiwan Star users who switched to Taiwan Mobile. Other telecom users have not heard of this wave of forced logouts from LINE due to a voice verification vulnerability.
Why did users who converted from Taiwan Star to Taiwan Mobile have a LINE voice verification vulnerability and their accounts were stolen?
In consideration of people with disabilities or users who are unable to receive SMS verification codes due to poor signal, roaming or telecommunications problems, LINE uses voice verification as an SMS backup mechanism. Because telecom operators consider that users may roam abroad or lose their mobile phones, they usually open channels designed to listen to voicemail remotely or while roaming. As a result, hackers can easily obtain the LINE account voice verification password through voicemail loopholes and steal the account. The hacking techniques are as follows:
A. Voice verification backup mode is enabled:
The hacker used the victim’s mobile phone number to log in to LINE, triggering the system to automatically send an SMS verification code (OTP). Since most people tend to ignore unknown verification code text messages and choose to ignore them, the attacker immediately switched to “voice verification” and asked LINE to activate the voice verification backup mode and read out the verification code over the phone instead.
B. The voice verification code is transferred to the voicemail:
If the victim does not answer the call, LINE voice verification will be transferred to the voicemail and the voice verification code will be stored in the mailbox.
C. The hacker enters the default password of the telecom operator:
The hacker calls the telecom operator’s voice phone line through a local phone or other mobile phone, enters the victim’s phone number, and attempts to enter the default password (0000 or 1234). Since most people never change their voicemail passwords, if they successfully access their voicemails, they can obtain the voice verification password and steal the victim’s LINE account, causing a large number of user accounts to be logged out.
D. The original Taiwan Star user’s voicemail default is “0000” and can be easily hacked:
The verification code for former Taiwan Star users (now Taiwan Mobile) to open their voicemails is “0000” by default. Unlike other telecom operators that require a new password to be forced to use voicemail for the first time, hackers can easily obtain the voice verification code, resulting in a large number of LINE accounts stolen from Taiwan Mobile (formerly Taiwan Star) users.
3. Correct ways to deal with voice verification vulnerabilities:
Due to the voice verification vulnerability, the original Taiwan StarDue to the use of “default password 0000” for remote/remote voicemail, users of Chunghwa Telecom and Far EasTone Telecommunications are not immune to this wave of disasters and do not need to panic. In response to the voice verification loophole problem, Taiwan Mobile and NCC have launched remedial measures. In addition to recommending that everyone proactively change their voicemail passwords to avoid time lag loopholes in the implementation of new measures, it is not necessary to listen to media reports and take measures to completely close voicemail!
The following are the remedial measures and recommended self-help methods initiated by Taiwan Mobile and NCC:
A. Former Taiwan Star users should change the default voicemail password as soon as possible:
After investigation, it was found that most of them were “former Taiwan Star” users. Taiwan Mobile has now started requiring former Taiwan Star users to change the default voicemail password. Taiwan Mobile said on April 1:「 In response to the situation where some former Taiwan Star users have not completed setting their own passwords or are still using the initial settings, the company has completely canceled the default password mechanism from now on to ensure that the relevant security control levels are consistent with current regulations. Former Taiwan Star users are asked to dial 123 from their mobile phone, use the Taiwan Mobile APP, or call customer service to complete the personalized password setting.」
The original way to change the password for Taiwan Star and Taiwan Mobile voicemail is to dial 123 on your mobile phone → press 3 → “Change Password”.
Since Chunghwa Telecom, Far EasTone Telecommunications and Taiwan Mobile (non-original Taiwan Star users) users use remote listening for the first time,
The following is the guide for changing the voicemail password of Telecom Sanxiong:
B.NCC requires telecom operators to transfer customers who use the “default password” to confirm their identity:
The NCC has requested all telecom operators (especially Taiwan Mobile) to use the “default password” to access remote/remote voicemails to first call the customer service hotline to confirm the user’s identity. but,There may be a time gap loophole in the telecommunications operator’s process for logging in using “default password” and requiring them to be redirected to customer service to confirm their identity. Users who are worried about their LINE account being stolen are advised to take the following temporary measures (choose one of three) in addition to implementing two-stage account authentication, linking with Google or iOS accounts, and avoiding unknown links on the Internet:
a. Actively change the voicemail password of the telecom operator number of the LINE account:
Chunghwa Telecom: Press the “777” send button on your mobile phone to enter the voicemail. Follow the voice prompts and enter a new four- to eight-digit password and the # key.
Taiwan Mobile: Dial 123 on your mobile phone → press 3 → “Change Password”.
Far EasTone Telecom:Dial “222” on your mobile phone to set the password.
b. Temporarily turn off the “Allow login from other devices” function of your LINE account or:
Enter LINE “Settings” ⇨ “My Account” ⇨ “Link Other Devices” ⇨ Temporarily turn off the “Allow login from other devices” or “Allow password login to log in from other devices” functions to prevent other devices from using passwords to log in and steal LINE accounts. However, these two closing measures will affect the convenience and diversity of login.
c. Temporarily close your voicemail:
If you cannot use your voicemail at all or are worried about the time gap loophole in the measures required by the NCC, you can consider taking the initiative to permanently or temporarily turn off the voicemail function to prevent hackers from intruding! However, turning off the voicemail will definitely not prevent LINE account theft, but only prevent the voicemail from being eavesdropped remotely.
The following is the guide for closing the voicemail password of Telecom Sanxiong:
Source: KOCPC Chinese