Visual Voice Mail (VVM) services transmit unencrypted credentials via SMS
REMINDER: Preparing for Escalating Cyber Threats
March 2, 2022IN THE KNOW: The Expectation for Consistency Across Regional Entities and What Possible Avenue to Take if Inconsistency is Experienced
March 3, 2022
Summary:
Visual Voice Mail (VVM) services transmit unencrypted credentials via SMS. An attacker with the ability to read SMS messages can obtain VVM IMAP credentials and gain access to VVM data. VVM is specified by Open Mobile Terminal Platform-OMPT and is implemented with SMS and IMAP (and other protocols). VVM IMAP credentials are sent unencrypted in SMS messages.
Additional Discussion:
Link to Source:
