Phreaking Not Dead Yet

santos_douglas writes "From Wired comes this article about an exploit involving weak voicemail passwords and automated voice recognition systems for accepting collect calls. The providers involved, SBC and AT&T, don't seem too concerned about their customers receiving tens of thousands in fraudulant charges from places like Saudi Arabia and the Phillipines."

Comments

Old Voice mail exploit

[Lowen Na]

We used to hit 9 three times in a row on the Nike 1-800 number to get a dail tone and make long distance phone calls on Nikes tab. Not really phreaking but it was a phone system exploit

Re:Old Voice mail exploit

[British]

Here's what I did once.

1. Hack a direct dial voice mail #(after hours business)
2. Record the message "hello??.........Yes I'll accept"
3. Call Long distance operator to do a 3rd party billing for a call, give voice mail # to bill to

The call went through, regardless of the fact that the person calling her, and the person she called both had the same voice.

Re:Old Voice mail exploit

[Anonymous Coward]

Sometime in the late 80's/90's with the advent of digital switching systems, it became possible to flag a phone number as "not accepting collect calls" so this seems like more of an "oops" on someone's part than anything else.

Re:Old Voice mail exploit

[Anonymous Coward]

They have an article on Slashdot about people doing that. Give it a read.

Re:Old Voice mail exploit

[Menkhaf]

I wish I was born 10 years earlier. Then I could have been cool too. But unfortunately my parents weren't thinking of me at that time. Stupid bastards.

Re:Old Voice mail exploit

[Anonymous Coward]

4. ???
5. Profit

Re:Old Voice mail exploit

[Shant3030]

Here is what I did once...

I posted on a website how I scammed a large company.

Then I got arrested.

Re:Old Voice mail exploit

[vDave420]

Sigh...

From article:
[Quote]
Here's how the scam works: The default passwords that SBC issues to new users of their voicemail services are in a specific format and are easily guessed.

If the default password is not changed after the system is set up, it's ripe for exploitation by malicious hackers, who have been breaking into SBC voicemail systems and replacing the owners' recorded greetings with recordings of a voice saying "yes" at appropriate intervals.
[/Quote]

So, "you did that once?"

-dave-

Re:Old Voice mail exploit

[zootread]

This little trick worked back in 1996 on the payphones in the town I went to university at:

Go to a regular payphone, dial 1-800 number. Wait for it to hang up on you. You get a strange sounding dial tone (a bit fast). You have a short amount of time (like 5 seconds or so) to dial the long distance number you want to reach, but if you do it successfully your call is connected. You can call local numbers, but you have to dial the area code.

We actually discovered it almost by accident. I told my friend about a similar technique which worked on COCOTS, but involved using a box that you use after the 1-800 number hangs up on you. We had been trying to get a red box to work, and he tried the 1-800 technique on a whim on a regular payphone. He tried using the redbox after the 1-800 and then found that it worked! We tried it a few more times and realized we didn't even need the redbox. I thought it was pretty wild that even in 1996 such a simple hole existed. We exploited the hell out of it until about 6 months later it quit working.

Re:Old Voice mail exploit

[micahmicahmicah]

I worked at Six Flags Great Adventure in Jackson, NJ from 1996-1999. I know that practically every person in the games department knew that there was a phone outside Wardrobe which could be exploited. All you had to do was pick up the phone and dial a phone number, area code first. The instructions on the phone said to dial 1-xxx-xxx-xxxx. Simply leave off the 1.

Social engineering more than phreaking

[JUSTONEMORELATTE]

IMHO, this is more social engineering scam than phreaking. The telephone network is still operating perfectly normally, and the folks doing the hack aren't using any extra-ordinary control over the network.
Interesting read, just the same.

--

Re:Social engineering more than phreaking

[stretch0611]

this is more social engineering scam than phreaking.

No, the article says that people are attacking the system with the default password that SBC sets when the voicemail is installed.

AT&T doesn't seem concerned because they are still charging people for the calls. (Gee, a 30% discount on a $10,000 phone call that a person did not make, how generous -sic.)

SBC probably doesn't care because it makes their competitor (or future competitor depending on your state), AT&T, look bad to consumers when they try to collect the bill.

Thats not 'Real Phreaking'!

[NETHED]

Real phreaking is sneaking out of your parents house at ungodly hours to clip into your neighbor's line, or to build a BlueBox and scream 2600hz down the handset. Those were the days.

Re:Thats not 'Real Phreaking'!

[Anonymous Coward]

Yeah, one good thing about phreaking was that it got you OUT OF THE HOUSE! Unlike computer hacking (yeah, its called hacking not cracking. FOAD ESR!) that keeps you locked up indoors, although the invention of Wardriving is thankfully changing that...

Re:Thats not 'Real Phreaking'!

[unicron]

Back in my day we stole our lineman's headsets from the MaBell truck. None of this pussy catalog order shit you little whipersnapers got these days. And they were even touch-tone! They were rotary! I still have a rotary lineman's headset lying around here somewhere. The rotary wheel is made of cast-iron, I shit you not. Thing weighs like 25lbs and looks like the meanest bludgening weapon ever made.

Re:Thats not 'Real Phreaking'!

[Waffle Iron]

Thing weighs like 25lbs and looks like the meanest bludgening weapon ever made.

It was designed that way so that linemen could use it beat the crap out of teenaged punks who they caught trying to steal their equipment.

Re:Thats not 'Real Phreaking'!

[Pharmboy]

Yeah, one good thing about phreaking was that it got you OUT OF THE HOUSE!

Well yea, so does car jacking, volunteering for charity or skateboarding, but I don't think mom is gonna tell little Johnie to take his blue box, and go outside and get some fresh air....

Re:Thats not 'Real Phreaking'!

[Anonymous Coward]

Hahah, Yes, I remember those days clearly. Except we just raided all the nearby developments, we'd keep tabs on which ones had working phones and make thousands in calls to 1-900 numbers(yes, we were 15 or so) and calling internet friends in foreign countries.

Re:Thats not 'Real Phreaking'!

[pa-guy]

LOL. I've got two of those. The outside is thick plastic, inside everything is waterproofed. These were designed to last forever.

I've also got a really old one with the outside encased in rubber, and little prongs on the tiny rotary mech, so you could dial even with gloves on, at the top of a pole in any weather.

Dad was a lineman for MTS (Manitoba Telephone System). When he died I got all of this stuff, and a bunch of other cool stuff like climbing spikes and safety belts.

Note to all: don't install a resistor across the line to allow free incoming long distance calls when Dad's a lineman. Also, don't build a bluebox using parts you stole from dad's work. The phone company can get quite upset.

Dad was even madder.

Re:Thats not 'Real Phreaking'!

[Jason Straight]

Shit - I just took the wires and touched them together in succession to dial rotary style. ;)

Re:Thats not 'Real Phreaking'!

[Anonymous Coward]

I'll never forget my dad's advice: "Just remember to clip-on once you get to the top of the telephone pole, falling would really suck." :)
(I'm not joking, he really told me this)

Re:Thats not 'Real Phreaking'!

[Pharmboy]

I'll never forget my dad's advice: "Just remember to clip-on once you get to the top of the telephone pole, falling would really suck." :)
(I'm not joking, he really told me this)

So, how often did they let you visit your dad in prison? :)

Not dead yet?

[macshune]

It's just a flesh wound!

Re:Not dead yet?

[Anonymous Coward]

Phraking is as dead as BSD.

Automated System Culpable

[dtolton]

It seems like AT&T is directly at fault here, even though they are warning people to change their default password, this type of scam wouldn't be possible if they didn't have an automated system processing collect calls.

Not only that, but AT&T is the one that chooses the default password, by picking something that is easily guessable they are doubly guilty of allowing this to happen.

Only paying 30% of a scam like this is shameful.

Re:Automated System Culpable

[British]

Then ATT needs to decide if it costs less to issue a random factory-made default password or to handle the fraud costs.

Re:Automated System Culpable

[Anonymous Coward]

You are a little confused about the facts. SBC is the one who provides the voice mail with default passwords. AT&T provides the third party billing. Although it's true that AT&T's collect call billing system uses a default password of "yes". It's not exactly the same thing.

Re:Automated System Culpable

[stretch0611]

It seems like AT&T is directly at fault here...
...Not only that, but AT&T is the one that chooses the default password

Actually, SBC is at fault here. SBC is selling the voicemail system. SBC is setting the same default password for everyone.

AT&T is at fault for allowing someone's voicemail to accept collect calls and also by billing people that never made the calls.

Last, but not least, are the people that leave the default password on something.

Re:Automated System Culpable

[baudbarf]

RTFA, they don't have to pay - the victim does. Once in a while, if they're feeling generous, they pull 35% off the cost - probably because they think it will make the victim more likely to pay.

Re:Automated System Culpable

[abhisarda]

I am at a loss to take sides in this case. In my department, when you open a new email account, they assign the username and say that the password is the first 5 digits of your social security number.

There are posters in the labs *strongly* advising one to change their password once they login for the 1st time. As far as I know it works just fine. If the user continues to use their social security no. and somebody hacks it, the user is totally at fault here.

Since there is the question of huge monetary losses, AT&T should assume responsibility here and ask the users to change their default password the first time they use their voicemail. Im sure AT&T has the technology to ensure that customers change their default passwords. Another way is to assign a hard to remember password so that the customer is *inclined* to change it.

When a website you sign up for assigns its own password, don't most people change it to a one that's convenient to them or do they keep using the uJl24fDSkPa they got in their email? Im betting on the former.

70 % AT&T's fault, 30 % customer's fault.

Re:Automated System Culpable

[polyiguana]

See here for the temporary password, 1234.

Other SBC affiliates may have used the last four digits of the phone number as the default. Real bright these phone company types.

Phreaking

[Cyno01]

For more about Fone Phreaking, check out the grand master... Phone Losers of America

Re:Phreaking

[moonbender]

Short jargon file entry on it. If you're bored some day, be sure to read the report/short story on phreaking in the anarchists's cookbook, it's quite entertaining.

phreaking

/freek'ing/ [from `phone phreak'] n. 1. The art and science of cracking the phone network (so as, for example, to make free long-distance calls). 2. By extension, security-cracking in any other context (especially, but not exclusively, on communications networks) (see {cracking}). At one time phreaking was a semi-respectable activity among hackers; there was a gentleman's agreement that phreaking as an intellectual game and a form of exploration was OK, but serious theft of services was taboo. There was significant crossover between the hacker community and the hard-core phone phreaks who ran semi-underground networks of their own through such media as the legendary "TAP Newsletter". This ethos began to break down in the mid-1980s as wider dissemination of the techniques put them in the hands of less responsible phreaks. Around the same time, changes in the phone network made old-style technical ingenuity less effective as a way of hacking it, so phreaking came to depend more on overtly criminal acts such as stealing phone-card numbers. The crimes and punishments of gangs like the `414 group' turned that game very ugly. A few old-time hackers still phreak casually just to keep their hand in, but most these days have hardly even heard of `blue boxes' or any of the other paraphernalia of the great phreaks of yore.

as always

[spotlight2k3]

can't get the site up, u figure wired could handle the traffic after only 7 posts

Re:Phurst Poast@!

[Anonymous Coward]

Eff this isnt it, i will cauterize my scrotal arteries and BBQ them.

Owch! How committed art thou to geekdom? First Post? Not by a long shot. See the First Cowboy Neal Post,dummbass.

What's the purpose of this?

[PD]

I don't really understand why someone would do this, other than to harass the target. Sure, they get a free phone call, but it's not a phone call to talk to somebody. They are calling and just leaving the line open. Why would anyone bother?

Re:What's the purpose of this?

[agentkhaki]

If I understand correctly, can't you just use third party billing to have the... uhm... third party pay for a call between you and your buddy in, say, Brazil?

Losers

[blackmonday]

Why would'nt the providers be concerned? Let's see, because they might lose money? Hmm..

Not really new ...

[Anonymous Coward]

The basic idea being used here is *really* old, phreaks have been changing OGM's to "- pause - yes, we accept that collect call" and suchlike for ages. The novel aspect is that it's essentially automated, no SE'ing skills required to make a convincing message, due to AT+T and SBC being retards. Still amusing though.

Re:Not really new ...

[Stormin]

Even doing it with automated systems isn't new. At one point MCI had a system (this is when answering machines were fairly rare) that would take the beep from the answering machine as a yes. No modification to the OGM required - just find a number with a machine and hope they don't wonder what these messages that say "Thank you for using MCI" are.

thank god !?!?

[Brigadier]

For a second I thought this meant all my friends with dialers would start calling me long distance. I hated that every five minutes.

please insert more money
hang on dude (holding dialer to hand set)
waiting as dialer mimics the sound of one quarter at a time

You tell me who is right...

[greenskyx]

#1 --> "Victims say that AT&T and SBC know about the scam and are taking no
concrete action to protect consumers from it."

OR

#2 --> "But AT&T spokesman Gordon Diamond said that AT&T has been instrumental
in stopping the scam."

CLUE :

"Later Hatcher was told that AT&T would take 35 percent off her bill,
but she'd have to pay $8,000"

HMMMM.......

Quick summary of the exploit

[Levine]

Users are given a brand new phone system, with some default password used to set voicemail messages. Users did not change that default password. Enterprising na'er-do-wells realize this is going on, use the default password to change the voicemail greetings to "yes, yes, I will accept the charges, yes, yes" and proceed to make free collect calls.

We have a classic case of stupid users.

It's not that I don't feel for them. And I certainly think AT&T/SBC will start provisioning these systems with pseudorandom passwords as defaults. But if you don't change your password, and someone else finds out about it... that's no one's fault but your own.

Should the people who did this be punished? Absolutely, they clearly broke the law. But now, maybe people will begin to realize that security isn't something that they can leave up to third parties -- it's something they need to take in their own hands, lest they find themselves $12,000 up shit creek and lacking any means of locomotion.

levine

Re:Quick summary of the exploit

[mabu]

How difficult is it for SBC to employ a password scheme which isn't so easy to crack?

While it is foolish for the user to not change his/her password, that pales in comparison to the blatant negligence on the part of the voicemail provider, who presumably has plenty of resources and expertise at their disposal, though obviously not evidenced in this fiasco.

Whoever is responsible for this scheme at SBC should be fired. And SBC should be responsible for the victims' bills.

Re:Quick summary of the exploit

[T-Kir]

Well I suppose it's not really restricted to phone systems (me stating the obvious here).... all I have to say is:

login: cisco
password: cisco

And then you can add 'stupid admins/BOFHs' to the list.

Re:Quick summary of the exploit

[Rutulian]

Users did not change that default password.

I agree with you in principle. Users should ultimately be responsible for the security of their accounts. After all, you do usually change the locks after buying a new house, right? The problem with this point of view, however, is that, as a computer geek, I am completely aware of how important it is to have good passwords for any kind of system. For other people this is not so obvious, and that is especially true in this case.

People are starting to realize that networking passwords need to be secure if you care about protecting your data and your system at all. But the voicemail password issue is different. For a lot of people the default password is easiest to remember, and what is somebody going to do? Listen to your messages before you get to them? Change your greeting? I doubt it occurred to very many people, even on Slashdot, that such an exploit could be engineered. Hijacking risk doesn't usually occur to people not accustomed to thinking about such things.

So in this case I side with the victims. AT&T should not have such a lousy authentication system and SBC should have issued better default passwords. If somebody had been the victim of an NFS exploit, we may have criticized them for using NFS and/or not setting it up securely. But ultimately the problem is with NFS for using a lousy authentication system that trusts the client.

Re:Quick summary of the exploit

[yokem_55]

Why can't AT&T have the users change the password immediatly after the first login? I.e, login for the first time with the default password, then FORCE a change of password before anything else can be done in the voicemail system. Combine this with a semirandom set of default passwords, then only accounts that are new would be even somewhat vulnerable.

Re:Quick summary of the exploit

[Levine]

While you're clearly a troll, I hate to see this sort of crap go unchallenged.

It is an industry standard in the telecom world to provide a blatantly-obvious default password. As a poster mentioned below, cisco/cisco is pretty well known. I work for another large network equipment provider, and our default password is also our company name. Why? --because it saves us some headaches when we're doing initial installs, and it is the user's responsibility to insure their equipment is properly secured.

Whoever was responsible for leaving the default passwords unchallenged in a situation that can yield $12k losses should be fired (Well, maybe not quite that drastic). And their company should be responsible for the victims' bills. But I don't see how this oversight by the end-user can be the equipment manufacturer's problem. If you set up an ISP and left your router's default cisco/cisco u/p active, and then were immediately compromised, how would that be the fault of Cisco?

levine

Re:Quick summary of the exploit

[ergonal]

A few years ago I picked up a file from my local BBS that explained about how a phone company here in Australia had voicemail box phone numbers with the password exactly the same as the phone number. All you had to do was find an unused phone number and you had free voicemail. That only lasted a few months or so until the phone company caught on, though. I just, uh.. heard about this, I never compromised those voicemail boxes, no sir!

To sum up, default passwords are a plague to security in many arenas, whether its an admins/end users fault or not.

Re:Quick summary of the exploit

[liquidsin]

Ideally what would be in place is that when someone activates the voicemail service, they have to enter a password right then, or at most have a default password that expires in 24 hours. So long as AT&T knew about the default passwords, which I'm sure they did, I can't say SBC is to blame. AT&T *knew* the risk was there, they could have required their new users to set a new password.

Re:Quick summary of the exploit

[Flower]

No, it was a case of an uneducated user not changing the password. The instructions on changing the password should have been prominently displayed and not buried in the information packet. The system should have forced a password change once it was accessed. Especially when AT&T is expecting the customer to cough up the bill if the system is exploited.

A secure system cannot assume that a user, even one given formal training, will follow best practices. In this case, not putting in a forced password change is negligent.

Look at how MS now does setup for MSSQL. It forces a password change on sadmin. Why? Because it was a reasonable measure to take. Cisco router? The second configuration is to set the enable secret password when using the setup utility. Why?? Because it is reasonable to expect enable mode to be protected. And this is for kit that should be admined by people who will know these steps have to be done.

Why are you expecting more out of Joe and Jane Average?

Re:Quick summary of the exploit

[m0rph3us0]

The customer didnt accept the charges, end of story. It is like someone else using my visa, it isnt my problem if their rep thinks that soemone else signature is mine.

How is it Social Engineering?

[Anonymous Coward]

It works because the ATT system is automated. Did you even read the article?

Re:How is it Social Engineering?

[Pharmboy]

Did you even read the article?

New here, huh?

Before everyone starts talking..

[bazmonkey]

...about how much they love to "phreak", keep in mind that a good deal of us thought girls had "koodies" when the real phreaking was going on.

This ties in with our general hacker degredation. Phreaking is nearly gone, everything today is a DOS attack, a script kiddie, or a win32 virus, etc. Hell, I mutter "All your base..." in my compSci class and I am hard-pressed to find someone that can complete the phrase!

Sad, sad world...

Re:Before everyone starts talking..

[Anonymous Coward]

You're a loser.

Re:Before everyone starts talking..

[Anonymous Coward]

Awesome, it means you have a good set of comp sci students, you're just a fucking freak.

Re:Before everyone starts talking..

[edrugtrader]

... are belong to us.

and it is spelled "cooties"

Re:Before everyone starts talking..

[Elwood P Dowd]

I'm sorry, when was "All your base are belong to us" a phrase only known by an elite few hackers?

Re:Before everyone starts talking..

[bazmonkey]

Apparently for a while. Maybe it's not a part of proper elite hackerdom, but definitely old geek culture. There just aren't many people that know it anymore. I don't really blame them, the joke did get old.

The point was that geek/hackerdom of old was much more colorful, pioneering, even "cultured" than it is today.

Re:Before everyone starts talking..

[PCGod]

Hell, I mutter "All your base..." in my compSci class and I am hard-pressed to find someone that can complete the phrase!

lol, this reminds me of my computer security class. The teacher (who had a Ph.D in Computer Science, was the head of the department, and a lawyer to boot) said "All your base are belong to us". My roommate and I busted up laughing. Everyone in the class was looking at us like we were crazy. I found it rather disappointing that these were all CompSci students that should be up to date on the industry. Only justfies my numerous rants about CompSci students only being there to make money and making the market difficult for myself who actually enjoys working with computers.

Re:Before everyone starts talking..

[Anonymous Coward]

"Old"!?! A year or two is "old"? *sigh*

Re:Before everyone starts talking..

[Anonymous Coward]

WHAT YOU SAY?

Can't be worse than...

[Anonymous Coward]

...when I ordered a calling card from ATT. They embossed my PIN *ON THE CARD* along with the rest of the needed to change a call to my home phone number. Unbelievable.

Re:Can't be worse than...

[FPCat]

I remember when you could call people and social engineer the number out of them

Hi. I'm Mr. XXX from Bell. We believe there has been some unauthorized activity on your account and need the last 4 digits of your calling card number to cancel the card....

Passwords

[rf0]

Going from what I'm reading here it looks like they are using the default password that are shipped with systems. A quick search of google will chuck up the default for loads of systems. So bascically the adminstrators of the system aren't doing the job correctly or am I just misreading this?

Rus

Re:Passwords

[Acidic_Diarrhea]

Yes, those responsible for administration of the system are failing in their duties. Although, for technology (speaking generally now) to gain widespread acceptance, it is a much better and easier road if no formal training or understanding is required. What I mean is that if a person were able to run a phone network without any understanding of good security techniques, the installed base would be higher. Likewise, if a Linux tech weren't needed in a company for Linux to be the accepted platform, the buy-in is much lower and thus the sales of Linux increase.

What I am getting at is that it's in the interest of the manufacturer to implement a system where the password is randomly chosen so this kind of really simple exploit is avoided. This makes the system less technical and more like a microwave - i.e. it just works, you don't need to know how. Because people are using their phone systems like a microwave - they're not considering whether they need to reset the password or choose a lengthy one, whatnot. They just want it to work.

Even worse

[zipwow]

Its not just that the fact the system is automated that is causing the problem, its the fact that the system is automated stupidly that casues problems.

Why can other systems (telemarketers, for example) tell that you've got an answering machine, but the phone company's can't?

And the article claims that they're happy with it that way:

Diamond said AT&T has no plans to change the automated system, "which has proven to be extremely reliable for many, many years."

I'll bet the people with the $12k bills wouldn't describe it as "extremely reliable"...

-Zipwow

Re:Even worse

[Zirnike]

Even just a minor change would be good.

Example: "YOu are about to accept a collect call. DO you accept?" (wait for 'yes', 'yep', 'uh-huh', whatever, interpret it, continue) 'To verify, please say the following word: (random word from set A)' (verify)

It wouldn't even take much effort. Suppose A includes 'toast', 'ummagumma', 'vaccum', 'moose', 'arbitrary', and of course, 'Forty-two'. They're all VERY distinctive, more so than 'nope' and 'yep', which they have to contend with anyway. Have, oh, 20 different lists, rotate them week to week (they're all on some server, not a problem there). Instant secure. Well, not absolute, but by an order of magnitude or 12.

Re:Even worse

[baudbarf]

It would work, but unfortunately, 80% of americans would be too stupid to understand the concept of a "verification word". They'd sit there, looking at their phone, saying,"Ummm... what?" to the machine.

Re:Even worse

[FPCat]

Maybe they could just hire some real people to do this. I doubt that actual operators would fall for the voice mail hack, although you never know....

Re:Even worse

[kesuki]

Then have the system say
"you have a collect call from "(name spoken by collect caller)" If you would like to accept charges say (random word or number) now. (pause) To accept charges say (same random word) now. To repeat this message press the # key"
The pause allows them to say 'umm what' and then figure it out. It's no harder than leaving a message on a voice mail system.

I originally thought of allowing the users to press a number on the telephone pad -- however that would allow them to input a sequence of all the numbers on the keypad into the voicemail message. Using random words is better. # key resets the random word, so that if the person can't pronounce the word so the system can understand it then gives them another chance to try.
Instead of a question, you tell them how to accept charges. you tell them how twice. Most people will be able to figure it out by the second time it's played to them. Those who can't shouldn't be accepting a collect call (or reproducing for that matter).

Re:Even worse

[Nezer]

The problem here is the system says the word. This could then be recorded and played back in an instant. The tone and timbre could also be easily changed instantly with any PC equipped with an SB Live! (or comparable) thus thwarting any attempt by the system to determine if the replayed word is, in fact, the same as when the system said it.

The problem here is that default passwords were easily guessed. This is the telecom's fault. Now, lets say they issued random defaults in a way they could be reasonably sure the owner is recieving it and the luser changed it to something easily guessed (4321, like on your luggage) then it's the user's fault and they should be billed (or at least the phone company should keep open that option).

Re:Even worse

[hoggoth]

> To verify, please say the following word: (random word from set A)

This is similar to typing in a distorted word when signing up for a web site to prove you are a person and not a script.

Isn't it interesting that we finally found a practical use for Turing Tests?

Re:Even worse

[Zirnike]

"with any PC equipped with an SB Live!"

Which, of course, makes the whole 'I have the voice mail password' thing secondary. If you can access the guy's PC, connect it to his phone (to auto-pickup) then play back (from the speakers, right? Modems aren't designed for decent human range sound, I think... so you need something to actually pick up the phone), with distortion, which requires some slight, but non-zero amoung of coding knowledge... See? You've changed a remote access of voicemail problem into a 'someone broke in and screwed with my PC' problem.

Re:Even worse

[MikeVx]

The problem here is the system says the word. This could then be recorded and played back in an instant. The tone and timbre could also be easily changed instantly with any PC equipped with an SB Live! (or comparable) thus thwarting any attempt by the system to determine if the replayed word is, in fact, the same as when the system said it.

You could do this on a number where you had a computer hooked up to the phone line. Since the exploit under discussion involves scamming using a voice mail recording, having the system request a semi-random word would put a serious dent in this kind of fraud. And if you have access to the line to get a computer to find and respond to the challenge word, why not just answer and authorize?

Re:Even worse

[Cyberdyne]

I originally thought of allowing the users to press a number on the telephone pad -- however that would allow them to input a sequence of all the numbers on the keypad into the voicemail message.

No: if they are asked to press, say, 3, and respond by pressing 0123456789, they failed. Just check whether or not the first key pressed was the correct one. That way, any would-be abuser of the system has a 1 in 10 chance of getting through using a pre-recorded message, rather than the near-certainty they have with the current one. A two digit version (to accept, dial 27 now) reduces that to 1 in 100 odds - you'd have to be pretty desperate (or stupid!) to try that one.

Using random words is better. # key resets the random word, so that if the person can't pronounce the word so the system can understand it then gives them another chance to try.

Could work; more complex to implement, though. Just using numbers is simple and foolproof: I'd say a 1% chance of a fraudulent call succeeding is much better than the current setup!

Alternatively: don't do 3rd party billing. Instead, just offer customers a calling card, which would work like a normal calling card but billed to your regular phone bill. Much simpler and resistant to fraud!

Instead of a question, you tell them how to accept charges. you tell them how twice. Most people will be able to figure it out by the second time it's played to them. Those who can't shouldn't be accepting a collect call (or reproducing for that matter).

Hmm...

To avoid being neutered, please repeat after me: supercallifragilisticexpealydotious.
What the f...
Thank you. The doctor will arrive shortly.

But here's the question

[Chagatai]

In the article, it discusses two individuals who failed to change their default password on their voicemail, leaving them vulnerable to a scam where people would make collect calls to their voicemail (after someone gained access to it), where the message was replaced by someone saying, "yes, I'll accept the charges". AT&T agreed that the individuals did not make the calls, but insist that the individuals (or their companies) still pay about two-thirds of the bill.

Here's the real question-should the people be forced to pay the bill because they were too dumb to not understand the words, "change your default password immediately." I say that we have already made things in life enough idiot-proof and AT&T has every right to ask them for thousands of dollars. Call it a "Stupid Bill".

Re:But here's the question

[Xerithane]

Here's the real question-should the people be forced to pay the bill because they were too dumb to not understand the words, "change your default password immediately." I say that we have already made things in life enough idiot-proof and AT&T has every right to ask them for thousands of dollars. Call it a "Stupid Bill".

There is that bumper sticker, "Stupidity Should be Painful." Seems that finally is becoming the case.

I love how people fail to find themselves accountability for their own mistakes. "Yes, I was stupid." I just wish I could hear that in one of these types of articles...

Re:But here's the question

[Anonymous Coward]

If AT&T is in agreement that the individuals did not make these calls, then the only good business decision for AT&T to make is to not charge them for services they did not use. Otherwise, AT&T is a passive participant in the scamming of their customer's.

Re:But here's the question

[JVert]

A system administrator who runs an insecure website which gets hacked and becomes a warez server for a month untill he/she gets a huge bill for bandwidth usage. They have to pay up.

Aunt May gets a voicemailbox last week and gets hacked, revceiving the similar sized bill as the sysadmin. Does getting a voicemail leave you with the same liability as running a website?

(btw the obvious answer is 'no')

And how DARE the phone company keep a collect call connected for over 6 hours, above ALL things this is the worst offence on their end.

But you sir... without calling you an elitist bastard, I just want to say I hate you now.

*thinks for a minute* god I hope I'm not getting trolled...

Re:But here's the question

[shepd]

>If AT&T is in agreement that the individuals did not make these calls, then the only good business decision for AT&T to make is to not charge them for services they did not use. Otherwise, AT&T is a passive participant in the scamming of their customer's.

The real answer is to charge them, but help the user sue the scammers for the business' money back as part of the lawsuit AT&T will surely file.

Now AT&T gets paid for their losses, the business pays for their stupidity in losing a large sum for a year or two until the case is settled, and the scammers pay back what they owe.

Seems simple enough to me.

Re:But here's the question

[antirename]

Yeah, right... you're going to sue someone in PAKISTAN or SAUDI? Who's supposed to pay for the plane ticket to get the alleged phone phreak into the US when the case goes to court? Let's see, Osama Bin Laden ripped you off and now you have a huge phone bill... is your local sheriff's deputy going to serve the warrant? Get real.

Re:But here's the question

[shepd]

>Who's supposed to pay for the plane ticket to get the alleged phone phreak into the US when the case goes to court?

If they're in Pakistan, well, you pay twice the stupidity tax because you were too dumb to block international collect calling. What kind of person would do something that silly?

In that case, the company is clearly so mismanaged they need to pay the entire bill to get a clue (or, preferrably, go out of business).

Consumer Action

[Anonymous Coward]

> "That AT&T would permit third-party phone charges
> based only on the authority of a recorded message
> is beyond belief," Sherry fumed. "Third-party
> billing should be allowed only when a real person
> answers the phone and is able to verify that they
> approve the charges."

How? By saying something? Talk about a frequently occuring Turing Test!!!

Jackass.

Don't pay that bill!

[fname]

My advice to the consumers: don't pay the bill. Write a letter and have your lawyer, stating why you will not pay the bill. There is no legal reason why the victim should be obliged to pay. The biggest joke is AT&T offering a 30% "discount," when there gross margins are probably in excess of 90% for these collect calls.

Don't pay the bill. Call a lawyer, write your congressman, and tell AT&T you WILL NOT pay, and ignore the collection agency. They have no right to engage in a shakedown like this; AT&T is reaping huge profits from the scam victims. This scam costs AT&T almost no money, yet they are reaping giant rewards. Seems like AT&T is the one running the scam.

Re:Don't pay that bill!

[HaeMaker]

I agree, especially since AT&T had admitted she didn't accept the call. She can not be held responsible for a collect call she didn't accept. AT&T has to prove she accepted it.

Re:Don't pay that bill!

[feepness]

There is no legal reason why the victim should be obliged to pay.

And your basis for saying this is...? You have a copy of the contract they signed where...? Your degree is from which law school...?

As someone said above... stupidity should be painful. This seems to be a step in that direction. Granted AT$T is making money off it, and it wouldn't be unwise to contest it. But sweeping generalizations about legality are just as silly as leaving the default password on your account.

Re:Don't pay that bill!

[Anonymous Coward]

There is no legal reason why the victim should be obliged to pay

This, from the same crowd that thinks people are responsible for spam being sent through their open relays, worms being spread through their unpatched boxes, and DDOS being launched from their compromised networks? None of these things are their faults right? They must just be victims.

Re:Don't pay that bill!

[fname]

Fair enough, but here's the problem. The voice-mail box owner (nee: victim) never accepted the charges. The only reason collect-calls can exist is that they rely on the callee (is that a word) to explicitly accept the charges. It seems to me that the flaw is AT&T's, as they do NOT have a system which reliably determines whether the person accepts the charges.

Maybe the box-owners whould secure their systems better, but the basic flaw in the system is that AT&T cannot determine whether a person really accepts the charges. AT&T could solve this in oh-so-many ways (use operators, choose a different script, ask the person to repeat a random phrase, etc.) that would cost AT&T very little money... but, of course, AT&T would lose this business!

Here's my bet for what AT&T does, once sufficient uproar ensues: they'll plug their security holes, and they'll extend a one-time credit as a "courtesy" to their customers. They'll book this as an expense, and keep the bogus calls as revenue, this way they'll show top-line growth! A year later, they'll decide to re-characterize that income to show it as a one-time expense, so it won't hurt their earnings comparisons going forward.

Re:AT&T is responsible

[spotlight2k3]

they can barely get users to change a default password, just think of how hard it would be explaing how to change a random one .....

Turing test for phones..

[pres]

I would think that something simple, like yahoo uses for account creation. Instead of "please say yes", it should be "please say XXXXX" where XXXX is randomly selected.

Re:Turing test for phones..

[Rares Marian]

Please say supeclaifragilisticexpialidocious or Mr. MXPLTSK backwards.

Re:Turing test for phones..

[protonman]

Easily defeated.

You just record & play back whatever they say. You could even use sox or something to fiddle with speed, noise, whatever, to make it sound less perfect.

Asking people to spell words or to complete an easy password cycle (like "Who's the current president of the USA?" or "Knock, knock?", etc. etc.) would be a lot thougher to beat. Thougher to implement too.

Re:Turing test for phones..

[asr_man]

It's a great idea, but changing from a "yes/no" recognition to a digit recognition will result in an order of magnitude increase in processing load. So telco can't go there without reprovisioning with upgraded hardware first. We'll be running RedHat16 by then.

Re:Turing test for phones..

[Anonymous Coward]

you're an idiot, how is this easily defeated, if the word changes everytime the prerecorded voicemail message won't be the same

Re:Turing test for phones..

[asr_man]

> record & playback This can be defeated by existing voice verification technology, which can simultaneously recognize the digit string AND compute its distance from a model of the prompt. If it's too close, the system can reprompt. The distance computation would likely be immune to many of the affects you could apply to the recording that would still result in recongizable speech. The more general "challenge" question just isn't feasible -- automation rates would drop dramatically.

Re:Turing test for phones..

[wnissen]

Your sig is hilarious.

However, your post is also hilarious. I believe you are suggesting that it is possible to remotely program a voicemail system to record and playback the word to the operator. This is difficult, far more difficult than a simple change of the outgoing message. Can you imagine trying to get emacs up and running over a touch tone phone? :)

Walt

Re:Turing test for phones..

[wnissen]

Remember, the problem here is not to program your own mailbox to accept calls, the problem is to program someone *else's* mailbox to accept calls. This is roughly a billion times harder than simply logging into a mailbox with the default password and changing it to a "Yes, I'll accept the charges" recording.

Walt

Re:Turing test for phones..

[AvitarX]

you mean it's happening in 6 months?

that's not too long a wait for such a big company to get it's act together.

OK, the version number inflation joke is old. shame on me.

Re:Turing test for phones..

[lyle_hanson]

Not to be overly picky, but having a system pick a different word from a list hardly comprises a Turing test.

Re:Turing test for phones..

[HTTP Error 403 403.9]

Why even bother with having the caller say something. Why not ask the caller to accept by typing in a four or five digit number? Prevents problems with pronounciation, users with heavy accents or speech problems.

Default Password

[SwansonMarpalum]

I'm curious why everyone is pointing at the telcos when the users should have changed their passwords. While I wouldn't abdicate either party from being guilty, I think that the people who leave their voicemail wide open are just as irresponsible as the telephone companies using an automated system.

There is a solution however and I feel that the easiest would be for SBC to require users to change their passwords upon logging in for the first time. I know that voicemail systems which I have used have made that the very first step, before even allowing you to record your "I'm away" message.

Fix the problem and the rest will fall into place.

Re:Default Password

[realdpk]

They're pointing at the telcos because it's resulting in multi-thousand dollar bills, and the telcos are telling them "tough" when they clearly didn't intend to authorize the calls.

Re:Default Password

[Anonymous Coward]

Well, what if they haven't logged into the account yet? The "phreaker" could just as easily supply a new password.

Re:Default Password

[m0rph3us0]

it isnt the users responsibility to change a password.

it is the phone companies responsibility to verify that the account holder has agreed to the charges.

imagine if someone stole your visa and the excuse that they used was your signature was easy to copy. this isn't a valid excuse for allowing the call to take place.

Re:Default Password

[MadocGwyn]

At at&t WIRELESS, that i work with (note we're a seperate company from the LL provider now. THe voicemail passwords are a default, which the system FORCES the user to change on first connect, it will not allow you to do anything unless you change it, the problem is, that default is always the same, easily guessed number. Another problem is caused by dealers, and cc reps who dont pay attension and just throw voice mail on because they can, and dont tell the user, user dosnt even know they have voicemail so never endevors to set it up, so its sitting there waiting for SOMEONE to set it up, the default passwords have no expiry and ive seen accounts of over 1 year of age, with still the default password. In a company as big as at&t its almost impossible to enforce full security on something so widespread, in cc we have procedures to force them to setup the voicemail but that dosnt control all channels and not everyone does it

An idea to improve the automated collect calls

[Ryu2]

If AT&T is too stingy to use live humans for collect call acceptance, here should be some randomly chosen sort of challenge/response mechanism asked by the voice recognition system (eg, asking a simple question like "what day of the week is it?") or even "please repeat the word I say" (randomly chosen) to ensure that a simple pre-recorded static greeting can't work.

Sort of like the "Turing tests" that services like Yahoo and even Slashdot itself set up to foil automated registrations.

Re:An idea to improve the automated collect calls

[mpost4]

Be careful on how you implement this, there will always a group of people that will not be able to use the feature. Lets take you example of yahoo registration, which is a word that is done via a picture. Well there is a group of people that have trouble registering at yahoo, the group of people who have that problem are the blind. I remember I had to go over to a friends place to help him register for yahoo because their screen reader can not read a image.
How could there be a group of people that have problems with that, well lets take some one that might be mute, they can hear but can not talk but they have a TTY setup but that can not work on the collect call, so they have a recoding of a person saying "yes" to accept now the call is complete and they can hook up their TTY devices and continue on.

Re:An idea to improve the automated collect calls

[Acidic_Diarrhea]

But just as the Yahoo registration has been implemented, wouldn't this be a better alternative to allowing fraud to take place? Yes, you are correct in that some people might be unable to use the system (although a workaround could be found involving the TTY setup) but the majority of users won't be affected and the possibility of fraud is lessened.

Of course, Yahoo has implemented their verification because it's not profitable for robots to register accounts for spamming purposes. On the other hand, the phone company isn't the one getting hit with the bills produced by fraud in a lot of cases.

The system won't get implemented until it's actually less costly to do so as compared to paying a few of the fraudulent charges and leaving the customer with the bag on the rest.

Re:An idea to improve the automated collect calls

[mbstone]

Another group that won't like your idea is: Lawyers. Some of us say "yes" on the outgoing greeting so as to be able to take voice mail from jail and prison inmates.

Re:An idea to improve the automated collect calls

[MattCohn.com]

What's your phone number?

Re:An idea to improve the automated collect calls

[ctr2sprt]

It doesn't need to be that complicated. Seems like currently you need multiple pauses with multiple replies, so just mix up the timing a little. Instead of a .5 second pause, put in a 2 second pause; instead of saying "Hello" right after someone picks up, say "This is an automated call;" things like that. That will make it harder to have a single prerecorded message do the trick.

Ultimately all you have to do is keep trying until the pattern matches, but even if there are only 20 variations that means you have to try 20 times to get one call working. Meanwhile, the AT&T computers are analyzing your collect call patterns and thinking "Hey, something funny is going on..." The computers could then introduce a semirandom enforced delay between collect call attempts - say 2^n minutes between consecutive failed tries - that wouldn't severely hurt normal traffic while dramatically impeding phreaking.

Well, that's how I would do it, anyway. Maybe there's a reason it wouldn't work.

Re:An idea to improve the automated collect calls

[tuxedobob]

Why do the deaf need voice mail?

Old Sk00l Phreaking

[IanCarlson]

Wow! You too, huh?

There was, and still is, great fun to be had with a 7/16" hex wrench.

I'm not old enough to have played with the Blue Boxes, but I sure got my kicks from Red Boxing calls all over the planet, and screwing with the COSMOS system.

Re:Old Sk00l Phreaking

[Rinikusu]

One of the more amusing things I've come across lately is that there's usually a telephone "access" box attached to the exterior of houses these days so the lineman and do some cursory checks without needed access to the interior. Standard jack on the "access" box, with no lock. Just walk up, plug in, dial away...

Re:Old Sk00l Phreaking

[hoggoth]

> box attached to the exterior of houses
> Just walk up, plug in, dial away...

and get shot by the homeowner who figures you are cutting the phones before robbing his house.
I hope you have a "Plan B".

Re:Old Sk00l Phreaking

[The_K4]

Even on older hosues with out that, it's pretty easy to strip off about 2 inches of the outer insultaion and then use clips taht can puncture the inner insulation without breaking the wire. 2 clips later you've got a dial tone. However watch out for being seen......homes are usually a bit better guarded the pay-phones :)

Re:Old Sk00l Phreaking

[LC Gundo]

The old lineman's handsets I, uh encountered, all had little spikes in their alligator clips, so all it took was two well aimed stabs through the insulation, and you had dial tone. Maybe those spikey 'gator clips are still available.

Re:fCBnp!!!!

[Anonymous Coward]

The providers involved, SBC and AT&T, don't seem too concerned about their customers receiving tens of thousands in fraudulant charges from places like Saudi Arabia and the Phillipines."

yet another example of some moron analyzing in a /. article... THAT'S WHAT DISCUSSION IS FOR. report the story, let us decide how to analyze it.

Re:Cereal

[AceM2]

wtf..

Of course it easy money for AT&T

[SmoothTom]

Hmmmmm ... Who's to say AT&T really WANTS to fix this problem.

Every time someone pulls this scam (not Phreak) AT&T makes money. In the two cases cited each one is worth about $8000 to AT&T.

Yes, some will fight the bill, and even win out against AT&T and SBC, but for every one who fights the charge hard enough to win, I'll bet that ten more just swallow and pay.

Uh, who knows, maybe SBS and AT&T are even making the calls, eh? ;o)

Re:Of course it easy money for AT&T

[Anonymous Coward]

Hmmm, indeed...

PHILADELPHIA (Reuters) - AT&T Corp. (T), the No. 1 U.S. long-distance telephone company, gave its new chairman and chief executive officer David Dorman a 32-percent raise and $4.5 million in bonuses to reflect his role in the sale of its cable television unit and his promotion.

That money had to come from somewhere!

Re:Of course it easy money for AT&T

[Anonymous Coward]

Why in heaven's name would they want to fix the problem? Consider:

1: the incremental cost to AT&T of any phone call originating and terminating in their system is so small as to be essentially zero.
2: any call which was billed but not paid for shows up on their books as a loss.
3. such losses are deducted from profits AT LIST PRICE (not the actual incremental cost) for tax computations.

Do the math. If they can't collect on a call which cost them literally nothing but which has a list price of $1.00, they get to treat that $1.00 as an uncollectible bill and write it off as a loss in their taxes. This $1.00 loss might save them $.10 or so in income taxes (don't know AT&Ts tax rate). They just turned nothing into a dime of profit simply by sending a bill to someone who they know won't pay. Neat.

Wish you could do that for your own taxes? Me too.

Years ago I was trying to sell fraud detection software to cell phone companies without much luck. After all, how difficult is it for a real-time billing system to notice that one phone number is being used in two different places at the same time? And why wouldn't they want to be able to do that? A nice financial officer finally explained reality to me.

It would be interesting...

[Pettifogger]

I'd sure like to take a look at the service agreements these people signed with AT&T and SBC. Generally, you are not responsible fraudulent acts, but it sure sounds like AT&T is trying to profit from them. Probably another good reason to dump their service.

If this happened to me, I'd just tell the collection agency to take it to court. Then I'd explain what happened to a jury. Do you really think the average person would "buy" the argument from AT&T?

Also, they should be warned that they're sitting on a customer relations/marketing disaster. How many customers are they going to lose once everyone starts hearing about these antics? Just another example of monumental corporate stupidity.

Way to go, genius!

[Anonymous Coward]

You think you took money out of Michael Jordan's wallet by doing that? Nope! More likely you took food out of the mouths of those poor sweatshop kids.

To atone and realign your karma, you must break into Kathie Lee Gifford's house when she's away and make some lengthy long distance calls.

If it's anything like attbi.com...

[Anonymous Coward]

then they'd be hard pressed to find out where to change the password. I haven't changed my xxx@attbi.com pw (which is "password"!), because I never found the place to do it - and I did look.

(Didn't care that much, since I didn't intend to use it - I have a mac.com account)

People are stupid...but..

[AceM2]

When you pay money for a service that is password protected, an average non-paranoid person will take it for granted. The fact is AT&T or whoever could have easily made it so you can't use the service until you change the password.. I mean, when I got my ATM card, I couldn't use it until *I* set a pin number and such for it.. Why can't the voicemail service people do the same thing? On the other hand.. If a thief picks my lock, I can't sue the lock company.. So I agree, at&t shouldn't be held fully accountable, but still..

Not just user neglagence

[Anonymous Coward]

The thing is, even if you do change your password this kind of exploit is still wide open. A dedicated phreak can set up a wardialer (a program that will call repeatedly if necessary and perform simply touch tone codes to a number) to try all possible combinations. Just have it play something like 00010020030040050060070080090110120130140150160170 18019021022023024025025026028....etc and all possible three or four digit numbers will be hit, thereby cracking the code. A lot of VMBs have it so you can only try one set then call back for another, but this is no problem. Just set the wardialer to try four, then call back and try the next four. Many VMBs have been seized through this method.

Re:Not just user neglagence

[kgasso]

Which is why at our office, I've set up the PBX to lock out accounts after so many failed logins in a row. Sure, if some dumb user doesn't remember his/her password 6 times in a row, I have to unlock it... but I'd rather do that then go to the CEO saying some 19 year old in {insert third world country here} got in through one of our employee's VMB's and dropped to dial-tone, racking up $8k in long distance. On top of the lockouts, I have a pretty anal password policy. No repeating (3 or more alike) or sequential numbers, extension in the password is disallowed, disallowed local area codes/prefixes/zip codes/etc.

Of course in this situation, the most cost effective solution is to ignore the problem and hope people don't notice the new charges on their bill. Hey, money is money even if it's earned fraudulently, right?. Pfft.

Was it clearly a default?

[Anonymous Coward]

Did they make it clear it was a default that needed to be changed? Or did the users think it was like your ATM password, which is unchangeable?

From the article, it didn't seem like the users knew it was a default.

Re:Was it clearly a default?

[MikeVx]

Did they make it clear it was a default that needed to be changed? Or did the users think it was like your ATM password, which is unchangeable?

You mean there still systems that don't allow changes? I can change my debit card PIN at the web site for the bank. I can change my credit union ATM PIN at any Star Network ATM.

As for voice mail, all the systems I've ever used go through a first-time setup where you are asked to choose a new passcode as part of the whole mailbox setup. Now if someone is fool enough to re-enter the default...

Spying on people at what price?

[Anonymous Coward]

Isn't the price of forcing low security (in order to ease the espionage) higher when it exposes us to more frauds?

What I don't get...

[autopr0n]

Is why anyone would ever bother to do this. I mean, one guy mentioned confrence calls, but the calls should end up stored on the answering machine so you couldn't talk about anything identifying... It seems amazingly pointless to me.

I can't belive ATT really wants to soak these people for $8k or whatever. it's idiotic.

Re:What I don't get...

[tuxedobob]

I think the way it worked is that these were "third party" calls. Many pay phones (at least used to) allow you to dial one number, but charge the call to a third party. You enter that third party's number, and if they agree to accept the charges, you can call pretty much anywhere you want, and the third party pays.

Once that third party accepts the charges, I believe they're disconnected from the call.

More on personal responsibility...

[kerika]

Let me get this straight. Person A orders voice mail. Said person: 1. never changes his password 2. never changes his voice message 3. never =listens= to his voice message 4. never gets told by his family/friends that he has an odd message, probably because he... 5. never receives calls May I ask why these people are ordering voice mail service in the first place?!

Re:More on personal responsibility...

[Anonymous Coward]

Sorry bud, but you've got the facts wrong. If you want to use a voicemail system to launch this sort of attack, all you need to do is find out what their password is... wait until you know they won't be home (i.e. new year's, etc), change the message then make your call. If you want to be sneaky, you can change the message right after you make the 3rd party call. No one will ever notice a thing, until the bill comes.

stop that, its not the users fault,

[JVert]

I agree, open relays are the fault of their owners. But this is not the same thing, this is a consumer product. You should not have to assume a $10,000 liability for operating a voicemail box!

seriously old exploit Re:Old Voice mail exploit

[Anonymous Coward]

This is new?? I remember this 10 YEARS ago! Jeeze, AT&T is stupid at best, but still???

Just sue the bastards and put em out of business for 10 YEARS of fraud charges.

Instant solution to open up the last mile of the telephone system heh, heh... :)

Re:Cereal

[zenintrude]

back in "the day", it was discovered that you could spoof the tone for creating a long distance phone call with a toy whistle obtained as a prize from a box of Capt. Crunch cereal...

geez, kids these days...

Nike may lose money

[SHEENmaster]

but I know a certain phone company that got significant profit from such freaks.

Bell Canada's system

[Anonymous Coward]

If you get Bell's voicemail, when you set it up, you are required to enter a new password. It won't let you proceed unless you enter a new password.

How hard would this be for AT&T et al. to set this up?

Can't read the article but...

[allism]

(seems like Wired actually got /.ed?)

We have had something like this happen at our company. The problem is not just the default password here...here is what happened (and yeah, this could be offtopic, but I found it interesting so maybe you will too)

Precursors to the condition:

1. We have multiple 800 numbers running into our phone bank.

2. Phones may be set up to forward phone calls to a remote number, including numbers overseas, if the user has the 4-digit password. (Yes, we actually have a need for that - we're UK-owned)

Here's what happened:

We had someone war-dialing our system to hack the passwords for users. (I am assuming they were using war-dialing since they hit extension 201 first, then 202, etc.) They were calling in on our 800 number, then brute-forcing the 4-digit password.

When the hacker got the password, he/she would set up the phone so that the phone automatically forwarded all incoming calls to somewhere overseas (Pakistan and Taiwan, to name a couple of places).

The hacker then called back and dialed the extension, which automatically forwarded the call to the pre-selected number.

The only solution our IS/IT department came up with was to start requiring everyone to use 8-digit passwords which must be approved for complexity by their department. The calls in to our 800 number didn't stop for a long time.

My companys voice mail server used to get hacked

[eyeareque]

my companys voice mail server used to get hacked all the time. we have over 20,000 mail boxes so toll fraud is something that we just had to deal with. A simple fix for our problem.. turn off the ability to dial out of the voice mail server, and viola, problem solved. :)

"Default Password" is different then no password

[JVert]

The rest of the world doesn't have time to play 'secure the box' against even simple attacks. Yes the users are at a percentage of fault, but its very small and their only out of pocket should only be the time in calling their provider to dispute and eliminate the bill. Alot of us around here are used to learning things the hard way, (there was a time when you could boot a machine without a cooling fan you know).

To the savy default password is the same as no password. But for the rest of the world there is a big difference when you assume how secure something is.

AT&T's fault!

[rMortyH]

You can use a radioshack scanner and plug it into a computer running pd with a DTMF decoder patch and get anyone's voicemail password who has a cordless phone. For some cordless phones, you can even use an old TV set that goes up to channel 83!

You can also get long distance calling cards this way too, I'm paranoid and I now dial these on the cord phone, then pick up the cordless. Are user's responsible for using encrypted phones?

AT&T is clearly at fault for accepting the charges. That is the part of the system that is the weak link, not the voicemail passwords. Someone could have hung an answering machine on their phone line. It's a ridiculous hole.

As for SBC, Their system asks you for your password BEFORE your mailbox number, and if it's right for the phone you're using, it doesn't ask for the mailbox. So, if you have the same password as the person whose phone you're using, you hear THEIR messages, and there is no way to listen to your own! It's rare, but it happens. Telcos are lame.

=Rich

BTW, pd is the greatest, coolest, amazingest piece of linux software there is and hardly anyone seems to use it. You can make a DTMF decoder in no time, or generate any tones you need, and so much more! See the examples.....

Re:AT&T's fault!

[Anonymous Coward]

Yup, or use an old USR Courier modem, dial it, then answer with ATH1%T. It'll decode anything it hears (including A-D!) until you hang it up.

Back in my younger days I had a friend in a nearby suburb on the phone and had the scanner on at the same time. My scanner picked up a local neighbor on their cordless phone, so I conferenced in my Courier (on another line) with the aforementioned command and had it decode what the neighbor dialed.

She paged someone, so we got both that guy's pager number and her number, since it was the thing she plugged in at the prompt. My friend then proceeded to call her (she had call waiting) and paged the living crap out of the guy while he was talking on the phone.

It was great stuff. She kept trying to *69, but my friend was on a different telco and the CLASS stuff didn't work with them as a target in those days. The whole time they were talking, the guy kept saying that his pager kept going off. It was nuts.

She was on an old 46/49 phone, but you could still do it today with most of the stuff out there. Only a handful of cordless phones seem to be anything more than narrow FM, even though the frequencies are higher.

Disclaimer: this was over 10 years ago, and we don't do that sort of thing any more...

Re:AT&T's fault!

[Anonymous Coward]

Sure... good idea... fly to the USA from some far off land, cruise around residential neighborhoods with a scanner, and maybe capture a few passwords. Or, better yet, set up an international network of password catchers, and trade the data over the net. Have you ever listened to cordless phones? People go on and on about nothing, for hours. Your biggest problem would be when your agents went insane from listening to all the idiots.

Phone Call

[a5cii]

Saddam:hallo

Woman:hello who is this?

Saddam:Saddam Hussein

Woman:Howd ye get numba?

Saddam:Georgie Bush's Voicemail tee hee

Dialtone..............

Here's the exploit of this system

[Spameroni]

As a company, just leave one of your box's passwords unchanged and perform the described exploit with the message and USE THE EXPLOIT yourself! 30% savings from AT&T!

I've got a totally different problem with this...

[Elwood P Dowd]

Simply saying "Yes, yes I'll accept" is way, way not legally binding in the first place. There has got to be some kind of legislation that places liability on the consumer in this case, or no one would ever have any reason to ever pay a bill for a collect call.

Until someone explains the contractual obligation involved, we're just talking crap.

current state of security sucks

[primus_sucks]

Just today I forgot my online banking password. All I had to do was call the bank give them my ss#, date of birth, and mother's maiden name and bingo, they gave me a new password. This is information that plenty of ex-wives/girfriends would have access to, not to mention the person from the bank I just told.

A couple of years ago someone apparently printed out checks from a laser printer with my name on them. Any jack-ass with a descent laser printer can make checks and a fake id.

Also today my wife's purse was stolen. I was helping her call credit card companies to cancel her cards. But the credit card companies wouldn't let me cancel them because I obviously wasn't my wife even though I had the answers to all their lame "security" questions.

The whole entire system is fucked up and easily beaten.

Re:current state of security sucks

[Anonymous Coward]

But the femail half of the world could [with the appropriate info]

Having said that when my grandmother phoned up the bank they canceled my mothers card

Re:current state of security sucks

[primus_sucks]

right, that was my point. having a security system with a major component being the sound of someone's voice is stupid.

Re:current state of security sucks

[Anonymous Coward]

lost password and lost purse... sounds like a bad fucking day.

Re:current state of security sucks

[FPCat]

That's why you never give your real name to your girlfriend....

AT&T

[Archfeld]

is using a blind security system WITH no sort of verification. That is stupid insecure and bordeline criminal. As for not changing your SBC password, well DUH, sorry I have NO SYMPATHY for anyone who would use an issued password.

friggin' morons

[Anonymous Coward]

What kind of moron would leave their temporary password at it's default setting? What kind of moron would blame the company that's being exploited for making it easy for customers to setup their voicemail? What kind of moron would expect a company to hold their customers to fraudulent charges caused by some wannabe hacker fucking around with some poor saps voicemail?

Re:"Default Password" is different then no passwor

[squidfood]

The rest of the world doesn't have time to play 'secure the box' against even simple attacks.

I'm leasing a car. I don't have time to play 'lock the door'. It got stolen. Damn car dealer!

I worked for AT&T

[jonskerr]

and we always used to say "We're not their parents" and sustain the charges. But yeah, it IS possible to force the user to make up their own password the first time they use it. Doesn't make it any less difficult to guess most passwords though.
What's annoying in these situations is the user's automatic assumption that somebody else owes THEM something. People act like they have a fundamental right to be lazy and/or stupid and it's someone else's fault when things go wrong.

AT&T bites

[Unixinvid]

Here's a good story, a friend of owned a cellphone with AT&T m-life service. She had it for only 3 months and she found these incoming call charges on her statement. She could beleave that she got charged for calls that she did not receive while her phone was on. I mean AT&T is very evil when it comes to billing. She was very upset about the whole ordeal. After further investigation it seem that telemarketers actually target cellphone users on the m-life service. This creates the problem that AT&T can't handle or won't stop this type of victim hunting. Anyways the point of the story is this "Don't Trust a phone company unless you did research on it"

Re:AT&T bites

[m0rph3us0]

i wouldnt beleave it either. --m0rph

Phreaking is a crime.

[Anonymous Coward]

All phreakers should get put to death. Stealing telephone service is a crime. Anyone who says different is probably a terrorist. Notify your local FBI branch immediately. And don't even THINK about freaking to make that call.

Watch out for fraud!

[rice_burners_suck]

Here's one to watch out for: Fraudulent calls to 900-like numbers in the U.S. Virgin Islands. Yup. Someone can call your house and leave a message, telling you that there is an important matter and you need to call them back. The phone number has an area code that looks NOTHING like 1-900. Kind of like those 877 and 888 numbers that are toll-free, except that these are toll-cost numbers. So you call back and hear a recording, the only purpose of which is to keep you on the line for as long as possible. Next thing you know, you get a phone bill for $1000.00 or so because this company charged you $500.00 a minute for two minutes. It's fraud but it's international, so you're screwed.

I never call back numbers that I don't recognize. If it's important, they'll call me again.

Re:Watch out for fraud!

[kgasso]

500 bones per minute is a little blown out of proportion, but what really counts is how ridiculous this is.

For more info check out http://www.lincmad.com/telesleaze.html

Re:Watch out for fraud!

[glesga_kiss]

There was a similar scam in the UK last year. People were text messaged a "call me" message to their mobile phone, to a similar toll number.

The twist here was that when you phoned up, you heard a recording of an engaged tone. People would keep calling back until they gave up.

Expect similar scams in the US as SMS becomes more common.

My Response

[Icephreak1]

Yawn.

- IP

Consumers, not businesses...

[Anonymous Coward]

Well, here's the thing- in this case, it's a consumer *service,* not a physical product. My mother just got sold on the "Works Package" whilst ordering DSL. Presumably, some cluebies could even be paying the fees without being aware they *have* voicemail on their line- SBC sends you a setup packet, but you're expected to purchase your own voicemail light, which now comes built in on some (mostly SBC-branded) handsets.

In other words, this is directly comparable to an ISP setting all ftp passwords to "username/username" by default; plenty of users are wholly unaware they *have* ftp accounts, and it pushes the problem domain into the 'helpless consumer' sphere, rather than the 'business should've hired a security consultant' one.

Of course, it does give you the option of choosing a different password on first use, but I bet that, at present, it's not checking the origin of 'first use' calls- allowing these guys to 'snipe' recently activated accounts.

There's also a UI issue here; the "login"/outgoing message procedure for multiple mailboxes is poorly documented*- which means that even techies like myself have been slack in enabling multiple boxes for other family members. When you're sharing a mailbox- especially with clueless types- you tend to restrict the password to something everyone can remember... which, if you're a lazy slacker, is the default, since they've already got it written down.

There's also a basic UI issue that forces people to pick weak passwords- what would be one keystroke on an answering machine becomes four with voicemail, and that'd be with speed dial for the voicemail number, and a one-digit password. (Yes, it actually makes you press two digits to check your messages, and there's no option to make it default to shutting up and playing them back after login, even for someone well-versed in the system.)

*Okay, maybe I didn't RTFM closely enough, but nothing tells you what tones to tell people to press if you use a 'custom' outgoing message. Apparently it's just the number of the mailbox.

Even more embarassing

[hibiki_r]

I've seen this kind of scam done to the main spanish phone company, Telefonica. This case was even more embarassing, since the voice mail systems used were owned by the phone company itself. This meant that by the end of the month, nobody reviewed a monthly/bimonthly bill,so finding one single vioce mailbox was enough to call for months!. I suppose that Telefonica's fraud protection system has improved since then. If not, at least this explains their outrageous long distance rates!

Beige Box

[Cyno01]

Who the hell spends ungodly amounts on linemans sets from catalogs, i think the cheapest "test set" in the telephony section of MCM was like $150, its much easier and cheaper to either steal a real one, or make your own damn beige box with a cheap fone and some gator clips.

Re:I've got a totally different problem with this.

[m0rph3us0]

there is legislation about this, it is called contract law. there exists and agreement between you and your telco to provide service for a fee and you agree to pay charges that you accept. since your voicemail is not you you did not agree to accept the service, since you did not agree to the service you are not responsible for the charges. end of story. let them take you to court. the password doesnt matter, you could put your password on the wall of the subway and att doesn't have a claim. one place where the password *MIGHT* matter is if the password was essential to agreeing to the service. (ie. a webpage or such) but in the case of collect calls your person is what matters. it doesnt matter if the person really sounds like you.

wtf is this?

[Anonymous Coward]

Better link here

Only accept a "real person?"

[tuxedobob]

One of the paragraphs from the article:

"That AT&T would permit third-party phone charges based only on the authority of a recorded message is beyond belief," Sherry fumed. "Third-party billing should be allowed only when a real person answers the phone and is able to verify that they approve the charges."

Okay, aside from "say this random word" (which so far is the best idea for how to stop this), exactly how does this person expect an automated system to tell the difference between a real person and an automated system? The audio quality of someone's voice transferred over phone lines is such that I doubt it'd be easy to tell the difference between a voice transferred once and a voice transferred twice (once to the recording, once back).

The trouble with the random word method is that the words would have to be sufficiently different, perhaps containing different numbers of syllables, so that no two words would sound alike. Of course, even with words with different numbers of syllables, one syllable can sound like two with certain accents' pronunciation of dipthongs. Even "toast" can sound like "flower", if you butcher it enough. And I'd be willing to bet that most of the voice recognition, at least for the level that phone companies currently require, is based on vowel sounds rather than consonants. I expect vowels are easier to process.

where is the contract?

[g4dget]

Presumably, accepting third party charges involves some kind of contractual agreement. Normally, that happens when you say "yes" to another person. Can my answering machine, on its own, make legally binding decisions for me now? I don't think so.

AT&T screwed up with deploying voice recognition for this purpose (and presumably continuing to charge operator assist rates); that's their problem. I hope the lawyers are going to have a field day with them.

Call the Public Utilities Comission

[Anonymous Coward]

People in the U.S. should call their state's PUC (Public Utilities Comission) if they have a problem like this with their phone company. The PUC is responsible for regulating telephone service, and from what I've heard, the phone company will become very interested in fixing your problem when they find out the PUC is involved.

bad security normal

[fermion]

This is a general problem. The phone company is not going to spend money to fix it because it does not cost them money. In fact such a bad design may actually make them money. If a voice mail system is misconfigured, as so many insightful people have already stated, that is the stupid customers fault. The fact that the vendor designed a flawed process and a flawed security system is not an issue in the least.

I have recently seen a good example of such bogus security with scary implications. I use a phone system to schedule work. Once you call in all you need is a six digit code to schedule people for work, remove people from scheduled work, etc. A person who guesses a code could cause a lot of trouble, maybe even getting someone else fired. I myself have run across a code or two just by accident. This is a very expensive system, presumable designed by competent professionals. Yet they make such a fundamental mistake. Again, the vendor loses no money as a result of amateur security, and as long as all vendors have such a low level of security, there is no incentive to improve.

Phreaking...NOT dead

[Anonymous Coward]

As long as there's a donkey dick on the telephone pole to cut into with a buttset, phreaking will not be dead.

Contact AT&T

[Bakajin]

Contact AT&T here and tell them you think so also. I just did.

http://www.consumer.att.com/contact/

===
I just read Wired article about AT&T's charging customers for a voicemail exploit which allowed overseas "hackers" to make fraudulent collect calls.

http://www.wired.com/news/infostructure/0,1377,585 17,00.html

I am appalled that AT&T would try to charge the customers for a mistake that is clearly AT&T's. It is AT&T's fault that the automated system accepted a long distance collect call without proper "real" authorization. AT&T was tricked into accepting a fraudulent call, not the customer. The customer did not choose to be involved in this automated system designed by AT&T. Therefore it is AT&Ts fault and it must not charge the customer! Expect a lot more comments on this subject if AT&T doesn't get a conscience soon.
===

Blame the victim? Are you nuts?

[ChaosDiscord]

I see a hell of alot of posts to the effect "they kept the default password, they deserve the charges."

That's just stupid and shortsighted.

People balance security against realistic perceived risk. Realistic worst case risk for failing to reset my voice mail password: someone else hears my voice mail messages, deletes them without my ever hearing them, then records something embarrassing or damaging for my outgoing message. Bad, but perhaps I'm willing to live with that risk.

Getting hit with a $12,000 bill (or a $8,000 bill after AT&T generously reduces it) is completely unreasonable. Prior to reading this article, I didn't realize that this was a potential attack at all. I would have assumed that no company was stupid enough to let an answering machine accept charges on a phone call! You can't assess risks on attacks you aren't aware of. It's simply not possible to protect against all attacks (is your computer TEMPEST secure? Do you shred any documents you throw out with your social security number on them?). People need to balance risks against the cost to defend against them. Some people apparently decided against changing their password. They misjudged the risks because they were unaware that AT&T was doing something insanely stupid that could cost them alot of money.

Also remember that in many cases people are actively encouraged by their employers or service providers to not change the default passwords. I've specifically been told that in a number of cases. Depending on the reasonable risk level, I sometimes change the password anyway. I distinctly remember an ISP I was dealing with being shocked that I would want to change the factory standard password on the ISDN modem they sold us. If I changed it, how could they debug it remotely?)

Re:"Default Password" is different then no passwor

[MillionthMonkey]

I'm leasing a car. I don't have time to play 'lock the door'. It got stolen. Damn car dealer!

That is a stupid analogy.

I rented a car just last week. The guy at the counter didn't say to me, "This car comes with a lock, but it doesn't really lock the car, so make sure you replace the lock right away with a better one." When a rental car is locked, it's locked. It isn't my responsibility to replace the lock. The lock that the car comes with might not be as good as a lock I can replace it with, but failing to replace the lock is not tantamount to leaving the car unlocked. That would be unacceptable. Is a default password that isn't easily guessed too much to ask?

Geeks hear the phrase "default password" and they instantly want to unload on the user regardless of the situation. I can understand an Oracle DBA catching hell for relying on the "scott/tiger" password default. But this amount of responsibility is too much bullshit to unload on the general public. I must have somewhere between ten and twenty passwords to keep track of. Phone companies, ISPs, utilities, banks, web sites, and a whole host of other businesses are always offering products and services that I am not even interested in. A lot of them sign you up automatically. As the economy tanks, the number of gimmicks increases. Companies merge, combine their databases with information about you, alter their privacy policies, and enroll you in stupid programs you don't even know you're in. How the hell should I know if I have a default password set on some stupid account somewhere that I don't even know about? I probably do! Why is it MY responsibility to make sure that no corporate idiots leave my digital ass flapping in the wind?

Besides, we're talking about a password to protect an answering machine. Big deal! If somebody changes my message, I'll just change it back. Only my mother leaves me messages, and if they really want to listen to her, so what? A lot of people wouldn't even bother changing their password on something like this.

In this particular case, it's clear that the Corporate Idiots are at AT&T, and it's hard to blame the hapless fools at SBC for pointing this out. What if I want to have a legitimate answering machine message where I go "Yes... yes... yes... yes I'll accept the charges... yes..."? Now I'm responsible for leaving a message that won't fool AT&T's cheap-ass billing system? (A system whose entire purpose, BTW, was to eliminate human operators with their irritating pay, and benefits, and common sense! This stuff would never have happened twenty years ago, before AT&T decided they didn't want to pay the costs of handling their collect calls with the level of intelligence required to pass a Turing Test.) At no point have I ever consented to collect charges from AT&T. I'm answering questions that haven't been asked of me yet. What could they possibly be thinking? That I have a daughter who ran away from home, and I'm hoping she'll leave a message if she tries to call me collect while I'm gone? Are they on acid?

If you don't consent to charges, you are responsible for 0% of them. Apparently AT&T thinks it means you get 35% off.

Not even close to dead yet.

[Anonymous Coward]

Red boxing is still alive and well in Missouri, Kansas, Illinois, and Wisconsin. I'm sure it still works in other states too, but those are the only ones I have been to recently. Remote beige boxing has become more popular over the years as cordless phones get cheaper. I've seen them around for under $10. All of the old tricks are still around in some form.

1010805

[Anonymous Coward]

Back in the day, I used to pull off the following scam (DISCLAIMER: I was young and foolish then. I'm a good, law abiding citizen now):
COCOTs (Customer Owned Coin Operated Telephones, ie. payphones not owned by the local phone company) were programmed to recognize certain long distance codes (like 1010220 and all the other ones you see dumb comercials for). This was required by law. Unfortunately (for the COCOT owner) these payphones were infrequently maintaned. It used to be that all long distance access codes were 5 digits. At the time, the FCC had just added 7 digit access codes. Many COCOTs were not programmed to understand the new 7 digit codes. So if you simply dialed 10108 (pause) 05, the payphone would interpret this as entering the 10108 LD access code, then 0 (for an operator, which is free). It would dutifully dial 1010805, which got a long distance line, thinking you were talking to an operator. You could then merrily dial any long distance number you wanted, and talk for free.

I'm also reminded of my first Blue Box, a radio shack autodialer modified with a switch and a replacement crystal (stuck to the side with a huge wad of epoxy). Then they started selling these digital voice recorders, which could replay a tone with perfect (enough) fidelity forever.

The thing about these illegal exploits was that I didn't *need* to steal long distance service. It was more about fun and interesting techincal exploits than stealing. This isn't an excuse, just an explanation. It wouldn't have been as much fun if this "youthful indiscression" didn't increase my knowledge of a rather amazing system. For this, I thank the telephone companies. I think I share this viewpoint with a lot of people accused of "just being thieves". True, it is stealing, but at least the motives were more interesting and noble than "just stealing".

And it wasn't all just for personal gain...I remember working with a friend (he did most of the work) to redirect a spanish-speaking 1-800 porn chat line to a notorious spammer at the time....lets see... "Eunuchs Incorportated" IIRC. End result: The spammer's phone was inundated with hot and horny mexican men. That excercised the social engineering aspect of things. We called the 800# provider and convinced them that we were the owners of the 800#. Just had them redirect the line to a different number. Incidentally, this only works with a certain type of 800#'s (The ones that are redirected to standard phone lines).

Anyway, I really hope that 1) the statute of limitations has run out on my crimes and 2) My posting as AC will dissuade investigation. :) It would be unfortunate if I got busted for crimes I commited a long time ago, and wouldn't consider doing now.

newbies

[Anonymous Coward]

back around 94 when surfing around various IRC chatrooms I would often hear someone accuse another of being a "newb" or "noob" yet then find out that the person accused has been on fido.net and such since its beginning and could personally remember administrating their regions usenet hub. Its just that these old veterans didn't find it necessary to "sound" hip and cool, use 1337 talk and generally act like a complete asshole.

Personally I don't worry about nostalgia today but I laugh at what is consdidered useful knowledge. We could manually setup BBS systems including all the hardware, networking, etc back then. Today we have people who wrote a couple of Perl scripts to show thumbnails of enumerated porn pics on websites and they consider themselves a computer scientist or engineer.

not your mother

[Anonymous Coward]

refer to this post. It says it much better than I could.

People DO behave like they are entitled but yet you cannot blame them for something outside their control. If they call up bitching about their voicemail box being "hacked" and vulgarity replacing their sugary sweet greeting then feel free to tell them that is their own fault. This is something a bit more and a bit outside of expectations of users.