Slashdot Mirror
FEMA Phones Hacked, Calls Made To Mideast and Asia
purplehayes writes "A hacker broke into a Homeland Security Department telephone system over the weekend and racked up about $12,000 in calls to the Middle East and Asia.
The hacker made more than 400 calls on a Federal Emergency Management Agency voicemail system in Emmitsburg, Md., on Saturday and Sunday, according to FEMA spokesman Tom Olshanski."
The hacker was in New Orleans. So they were obligated by official policy to ignore his calls.
SJW: Someone who has run out of real oppression, and has to fake it.
More importantly how was this accomplished?
In an age of IP Telephony it seems kind of silly and ends up just being vandalism
"Would you, could you, with a goat?" Dr Seuss
Shouldn't this be 'phreaker'? The article even states the break-in was over their PBX (i.e. a convential phone system, not VoIP).
ilovegeorgebush
ha ha ha
I never understood why someone would or could make exhorbatent amin long distance phone calls. The only thing I can figure out is that some nerd was busy talking to his girlfriend on vacation.
While (Idiot.onphone) {
"Hang up!"
"You!"
"No You!"
"No You Hang up!"
}
Twelve Grand?! Is this another indicator of inflation? Who is billing this out? For 12 grand the phone companies should give you a phone that will work for life, from anywhere, to anywhere. Are the same people responsible for claiming that a quarter of schwag has a "street value" of fifty grand?
Apparently most calls were short, from 3 to 10 minutes. Assuming these calls were all longer, like the max of 10 minutes, then for 400 calls to total $12,000 the government must be paying a minimum $3 per minute for these calls.
Either someone is massive exaggerating the scope of this theft or some idiot in procurement failed to put our national security infrastructure on the international calling plan.
He kept calling that damned annoying Verizon guy.
"You're in Thailand now? Can you hear me now?"
http://blindscribblings.com - Tasty pop-culture in conceptual fashion.
I sense a no call list in our future.
sounds like a cover up for a terrorist who has been working in Homeland Security for years and got caught making a phone call!
that is, if you have an active imagination...
There used to be people standing beside pay phones in Chinatown, give them ten bucks and they'll give you a stolen calling card, with which you could make as long a call as you liked. Whole villages would line up and call home, 48-72 hour calls were not unheard of. But now? Skype, VOIP, and a whole forest of cheap calling cards.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
So he doesn't have a Skype account?
I don't read your sig. Why are you reading mine?
DHS is like the laughing stock of government security. Being PBX Phreaked with a 15 year old hack is just bad... Hope the next administration isn't this incompetent.
Where is the "Ignorant" mod tag?
What are the odds he/she used a default password to gain access? I mean this is the government we are talking about here.
This phreaker could have been a terrorist attempting to make calls back to headquarters in the Middle East.
Since 2003? FEMA really needs to tighten up!
----- You know you have ego issues when you register a domain in your name.
"Many companies are moving to a higher tech version, known as Voice Over Internet Telephony."
Yes, I keep hearing about VoIT....
Man and I thought my iPhone bill was expensive...
400 calls totalling $12,000.
That is, about $30 per call.
And from the article: "Most of the calls were about three minutes long, but some were as long as 10 minutes."
As long as 10 minutes? Not only did FEMA have a badly configured phone system, they must have had some of the crappiest call plans I could possibly imagine. I mean, where were the calls terminating? The moon?
Your tax dollars at work.
Do you or your partner snore? - Visit www.snoring.com.au
You're doing a heck of a job.
Please help metamoderate.
The $12,000 is not that hard to believe given the following:
1. have you ever seen what the "regular" phone company charges for international calls? Why do you think that there is such a huge market for things like Skype and the "International Phone Cards" you see in every gas station here in SC?
2. Many countries' phone companies add charges to the phone calls, and of course the phone companies pass those back to the customer. Why should it cost more to call Japan than to call China? It does, because the Japanese phone company charges extra fees, and it's worse if you call a Japanese mobile phone from the US. (It's funny, in many cases it's actually _cheaper_ to call a Chinese mobile phone than to call a Chinese land-line.)
3. Time of the call - the charges discussed above vary based on the time of day. Usually, during "daylight" hours and "work days", calls are more expensive. Given the places called, you're pretty much hosed because unless you timed it carefully, you fit at least one of those conditions either at the origin or the destination.
4. Connection charges. Come phone companies have a "connection" charge for making an international call - an up-front charge before they even start tallying minutes. (Also, most companies round up to the next whole minute, so if you talk for 1 min 1 sec, you're billed for 2 minutes.
So, yes, $12,000 is quite believeable.
CNN had a front page article about how a cyber attack could do more damage than any other act of terrorism. Now this...
Bye-bye internets...get ready for broadcast with tracked user clicks.
If anybody ever doubted that these clowns are better at sucking up tax dollars and destroying the US Constitution than providing security, look no further for the proof.
Osama must be laughing his ass off.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Maybe he was calling the middle east prophets to invoke another hurricane on New Orleans.
slashdot rocks
Hacking PBXes was ok 15 years ago.
Hacking them now is pretty much guaranteed to get him caught.
Oh well...
Olshanski did not know who the contractor was or what hole specifically was left open, but he assured the hole has since been closed.
"I don't know who it was or what they did or didn't do, but I assure you they fixed it."
What's funny is that no one noticed this until after the fact... did nobody notice the hack taking place? Was accounting out to lunch on this one? You'd think with an organization the size of DHS they'd be processing billing reports daily.
It honestly makes me sad to see tax dollars spent this way and the person who did this if caught will probably end up spending 7 years in a federal prison and for what really, exposing government incompetence?
I honestly wonder if DHS had their receptionist setup the PBX.
"You're doing a heck of a job brownie..."
If Richard Stallman's house gets burnt down, I'll go 'haha'.
Because it's funny and exposes security weaknesses and we don't like the individual(s), yeah.
Its quite possible the person who broke into the PBX also sold the information on how to make 'free' calls to wherever which would result in multiple people accessing it simultaneously thus making it possible to rack up $12,000+ in very short periods of time.
09F911029D74E35BD84156C5635688C0
+2 Troll is Slashdot's way of saying groupthink is confused
I mean really, I know the /. janitors are determined to bring tabloid-standard reading levels in, but you'd think they'd at least get *that* bit right.
Assuming the phone was "off the hook" for the entire 48 hours and only one call is placed at any given time, that's 2880 minutes, or $4.17 a minute. Any phone company charging that kind of rate per minute will get call into the capital by state utility commission (AT&T charges just over a buck a minute for cellphone roaming calls originating in Asia.)
ELOI, ELOI, LAMA SABACHTHANI!?
What sort of crap is this story?
With my long distance plan I pay $0.05 per minute anywhere in North America and ditto even into Australia.
$0.05 * 60 * 24 = $72 per day.
Saturday + Sunday = 2 days.
What part of this story makes no sense?
I noticed a weird account in our VM system; on investigation it was trying to call an overseas toll line repeatedly. Our phone vendor said that the hacker will do this to get a kickback on the charges. Luckily, we had overseas calls blocked by our provider, so we didn't have any real problems, but we're strict about everyone having passwords now.
As has been said before: language changes
And has also been said before: So what - that doesn't cause random errors made by uninformed ignoramuses to magically become correct usage.
That's exactly the process by which language changes, dude. When people start using terms incorrectly and people don't understand what they mean, those people are wrong. When the incorrect usage overtakes the correct usage and more people will understand the "incorrect" usage, then it's no longer "incorrect." Use of the outdated form may in fact come to be incorrect later on.
Language is about conveying meaning. Any language rules that exist, exist to standardize and facilitate communication. That means that what the most people understand something to mean is what it actually means. If you have to explain the terms you're using by using extra language, you're doing it wrong.
It's entirely possible to have a niche vocabulary among nerds that holds the old usage of crackers, phreakers, and hackers. To expect an AP article to use those terms is stupid. The majority of people reading the article wouldn't understand what they mean, but they do in fact understand precisely what they meant by the word "hacker."
Warning: Opinions known to be heavily biased.
Having a little difficulty accepting the changing meaning of "successful" are we?
The same passwords that allow one to make calls, could allow him to check voicemail. But thats ok, these FEMA guys are obviously too smart to leave sensitive information on voicemail.
Note that all the calls went to middle east countries, including Afghanistan and Yemen, both Taliban havens.
That's a mighty big assumption. How do you know they weren't trying to stuff the phone ballot boxes for "Afghani Idol" and "Yemeni Idol"?
With that little bit of semantics out of the way, I wonder what system they were running. Audix perhaps?
Years ago (late '80s) someone discovered a non-password protected user extension on our System 85 PBX, and used the standard Audix dial out request to make a bunch of calls to Central America. This was a common practice by phone thieves at the time. Find an unlocked Audix account on any corporate phone system and use it to call out to foreign phone numbers. The perpetrator would typically charge multiple users through the course of an evening to allow them to call home. Generally it would not be noticed by the victim until the monthly billing cycle, and in the case of our office, by the time internal billing passed that on to the individual at the departmental level, that was two months. At that point they would finally convince the end user to the importance of setting a user password. Duh.
Internally, we used to search for open extensions internally and use it to change their greeting message or to pull some other sophomoric prank like reprogram all their speed dial buttons to the local 'psychic hotline' or the VP of the division.
Also, in many hacking cases the quoted damages include the cost of hiring someone to patch the security vulnerability. I'm sure that in this situation that is also true; i.e., that $12,000 is a $500 phone bill and a $11,500 consultant fee.
-b
No offense, but I've stopped responding to AC's.
400 phone calls, mostly lasting about 3 minutes. Some lasting as long as 10 minutes. Let's say they averaged about 5 minutes per call. That would be 2000 minutes of calls.
$12,000 / 2000 minutes = $6/minute
It doesn't matter how many people were making the calls. That shouldn't change the billing rates. Clearly there are serious problems in this story. One of those problems is security. Another is the "truthiness" of the story line.
Translation: "Nothing to see here, one day story, move along, kthxbye. [scrambles out through the press room door]"
I think FEMA is actually looking pretty smart here. Clearly, they don't pay $5-10/minute for phone calls. So that $12,000 must include the cost to patch the security holes, hunt down lingering trojans, etc.
That seems pretty cheap to me. They could have paid somebody $75,000 to design their system up front, and keep paying their salary to maintain the system.
Or they could cross their fingers and hope nobody exploits their lack of design. If somebody does manage to find their weakness and exploit it, $12,000 in emergency response is a small fee to pay.
It was a lot cheaper than paying for responsible design. They can afford six of these incidents each year and still save money.
At this point it appears a "hole" was left open by the contractor when the voicemail system was being upgraded, Olshanski said. Olshanski did not know who the contractor was or what hole specifically was left open, but he assured the hole has since been closed.
Un hunh.
He doesn't know what happened but he knows what happened and it has been fixed...
Some people just don't put the required effort into their lies.
Emmittsburg, MD? There is only one major FEMA facility there, The US Fire Administration National Fire Academy. Happens I am going to be there for a week next month. Wonder if the phreaker will offer instructions so that I can call home free too. Beautiful campus btw, about 3 miles from Camp David
"This illegal activity enables unauthorized individuals anywhere in the world to communicate via compromised U.S. phone systems in a way that is difficult to trace," lol. Well of course its difficult to trace. Anyone with enough cajoles knows this. All you have to do is go to a phone box out in the middle of nowheresville and patch into it (illegal of course) and make calls. Its all untracable to the actual person who did it, but not untraceable to the poor schmuck who has to pay for the bill the calls were made from. Of course there are more ways to do this then the one described, but my point is it is completely feasible to do this so the person is completely untraceable. The fact that these are known issues in the PBX system and have been known for, oh 20yrs, is ridiculous that they're able to still occur. I've read many a story both online, in 2600, and when reading about Mitnick's escapades and those things usually happened back in the 80s. Hell, find a lineman's handset clip it to any phone line and viola free phone calls at least for you. Really....its not *that* hard.
"When the people fear the government, there is tyranny. When the government fears the people, there is liberty."
It was Captain Crunch
Actually, this is /. I suppose I didn't really need that link did I?
America, Home of the Brave.
is this terrorism? or just plain old hacking?
what's the point of breaking into a federal telephone system to call asia and the middle east?
surely if you have the know-how to pull that off, you could have gotten the calls for free anyway?
so what was the point? was it a diversion? or a lesson hack?
They're using their grammar skills there.
Obviously we need a bigger Security Fence.
If I called China on Friday night and stayed on the phone solid 'til monday morning it wouldn't cost $12K, so how do you rack up that much in calls in a weekend?
> And now...we're wanting to put THEM in charge of our medical care? Scary.
Hell no! That would be absurd. All people want is government-sponsored health insurance so that you don't go bankrupt from a lapse in insurance coverage.
Government mandated health care is fraught with problems as you can see in Canada. Most countries in Europe manage just fine with a health insurance model, because it more naturally allows for competition while ensuring public access to treatment.
That said, if we ever get it, it will probably be under constant attack from people trying to destroy it by privatizing it.
/teenytinyfont WARNING : Free FEMA Trailer contains Formaldehyde odor, arsenic-laced timbers, and lead-based paint from China. May cause dizziness, nausea, difficulty breathing, asphyxiation, and death. If you have any of these difficulties, please call 1-800-FEEMA, extension SUX, we will get back to you within sixteen to eighteen months.
localhost: cat > loctxt
reply to by BitterOldGUy (1330491) on Thursday August 21, @09:53AM (#24688687)
$slashdotusername
^D
localhost: md5sum loctxt
31c435d849a8dc7ae0d60d0576c16508 loctxt
Olshanski did not know who the contractor was or what hole specifically was left open, but he assured the hole has since been closed.
"I don't know who it was or what they did or didn't do, but I assure you they fixed it."
Hey, I know Olshanski...
He wouldn't know if HIS hole was left open. He thinks high-tech is a rotary-dial phone.