Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Visual Voice Mail on Android may be Vulnerable to Eavesdropping

Visual Voice Mail on Android may be Vulnerable to Eavesdropping

A security analyst has devised a way to capture Visual Voice Mail (VVM) credentials on Android devices and then remotely listen to voicemail messages without the victim’s knowledge.

The security researcher, Chris Talbot, discovered the flaw on June 21, 2021, and filed the vulnerability under CVE-2022-23835.

The bug is not a flaw in the Android operating system but rather how the service is implemented by mobile carriers.

However, the flaw has a “disputed” status because AT&T and T-Mobile dismissed the report for describing a non-exploitable risk, while Sprint and Verizon have not responded.

Also Read: 6 Simple Tips on Cyber Safety at Home

Response to reporter's HackerOne submission
Response to reporter’s HackerOne submission (GitLab)

Even though the flaw’s exploitability is in question, the CERT Coordination Center has published the details of Talbot’s discovery today due to the potential impact and the existence of a published PoC (proof of concept) tool to exploit the bug.

Visual Voice Mail is a voicemail system used by numerous mobile carriers that allow customers to view, listen to, and manage voicemails in any order.

Utilizing the method discovered by Talbot is a significant breach of privacy as it allows a remote person to potentially listen to someone’s private, and in many cases, sensitive messages.

The exploit process

To exploit CVE-2022-23835, the attacker must use an app with the READ_SMS permission required to eavesdrop on the VVM IMAP server credentials.

Also Read: 7 Key Principles of Privacy by Design that Businesses should adopt

Because VVM IMAP credentials are sent in an unencrypted form via the SMS protocol, any malicious application with the permissions to read SMS content can snatch them.

These SMS messages are sent and received when registering on VVM, activating/deactivating, and logging in to the VVM client app. The users never see these SMS messages as they are handled by the VVM system in the background.

After the credential-stealing step is over, the attacker would no longer need access to the SIM card and SMS, and would be empowered to access the victim’s VVM independently and without leaving a trace.

Since Android leaves all voice messages on the IMAP server until the user deletes them in the client app, a malicious actor could access not only recent messages but an entire historical archive, depending on the victim’s data-wiping diligence.

An example VVM voice message
An example VVM voice message (GitLab)

Impact and protection

The analyst tested the exploit against Android VVM applications, but the iPhone, which also supports VVM functions, wasn’t tested.

Also, when the victim switches to a new smartphone, the carrier doesn’t reset the VVM password even if the IMEI number associated with the particular SIM card has changed.

At this point, the only way for consumers to protect themselves against these attacks is to treat SMS permission granting requests with caution.

Remember, most instant messaging apps request this permission, so only install apps of this kind from trustworthy sources and publishers.

Additionally, change your VVM password periodically and delete voicemail messages you have accessed and no longer need.

Finally, accessing VVM services via a web portal is a lot safer than using client apps on your mobile device.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us