You may or may not have heard of Cerberus, an anti-theft application for Android devices. Cerberus allows you to remotely control your device if it has been lost or stolen. Features include: locate and track your device, start alarms, get a list of recent calls, download SMS messages, take pictures, record video, record audio and much more – all of which is done discreetly without the “thief” knowing so you can track your phone down and attempt to recover it. Pretty cool, right? Now imagine if anyone could access your device and listen to your conversations. A security hole in Cerberus allows just that.
Update: Cerberus have said this will be fixed in their next version, 2.4 which will be published “soon”. I have downloaded the latest 2.4 beta and the exploit still exists.
tl;dr Attacker needs your IMEI.
http://www.ifc0nfig.com/cerberus-exploit-accessing-any-device/