Slashdot Mirror
Hacked Business Owner Stuck With $52k Phone Bill
ubercam writes "A Canadian business man is on the hook for a $52,000 phone bill after someone hacked into his voice mail system and found a way to dial out. The hacker racked up the charges with calls to Bulgaria. The business owner noticed an odd message coming up on his call display (Feature 36), and alerted his provider, Manitoba Telecom Services. They referred him to their fraud department, who discovered the breach. MTS said that they would reverse the charges if the hacked equipment was theirs, but in this case it was customer owned. The ironic part is that the victim's company, HUB Computer Solutions, is in the business of computer and network security. They even offer to sell, configure and secure Cisco VoIP systems. Looks as though they even couldn't manage to secure their own system, which doesn't bode well for their customers." This certainly isn't the first time someone has exploited the phone system and stuck another with the bill. Maybe it's time for the phone company to get their fraud detection and prevention services at least on par with the credit card companies'.
Seriously there guys, why would Mr. HUB Computer Solutions let something as embarrassing as that hit the press?
"Oh hi, I got my PBX hacked (possibly because of my 4 character PIN "security") and lost 50 grand on calls to Bulgarian criminals, how about paying me to set up your computers?"
Maybe it's time for the phone company to get their fraud detection and prevention services at least on par with what the credit card companies have done.
Dude, it wasn't the phone company's equipment - hence the "outrageous" charge to the consumer.
Shouldn't the telecom provider be able to identify the phone number(s) in Bulgaria that the hacker called? If a hacker is calling Bulgaria, I'd think there's probably some international crime or identity theft ring centered there that the phone company and government officials would want to know about. Either that, or the hacker was calling about the whereabouts of his mail-order bride.
This certainly isn't the first time someone has exploited the phone system and stuck another with the bill. Maybe it's time for the phone company to get their fraud detection and prevention services at least on par with what the credit card companies have done.
As long as the customers are responsible for the charges, they have no business reason to invest in fraud protection.
Bruce Schenier refers to this as an externality, and had written about it a number of times in the context of credit card security and computer security.
http://www.schneier.com/blog/archives/2007/01/information_sec_1.html
http://www.schneier.com/blog/archives/2006/03/credit_card_com.html
http://www.schneier.com/blog/archives/2005/10/preventing_iden.html
I don't find this suprising in perspective of what people in the service sector usually have for themselves.
After all, what kind of car does your mechanic drive? Do you know when your mechanic last did an oil change on their own car?
Hint - the mechanic's car is usually fixed last, if ever.
In similar light I knew a cardiologist a few years back who died of heart failure.
It isn't easy to find time to maintain for yourself the same kind of equipment that you are paid to keep up for others.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I hear bulgaria has the best phone sex lines confirm/deny?
Why should the phone company be responsible for their customer's incompetence? If they installed it... maybe... but they didn't. Now, as far as a compassion standpoint... the company should at least help out some.
I had a phone cable dug up recently because MTS didn't mark it on a cable locate. The responses ranged from "sorry, you're out of luck" to "where else are you going to go for phone service?" I feel bad for the guy, but unless he takes it to court he isn't getting any help from MTS.
They say a little knowledge is a dangerous thing, but it's not one half so bad as a lot of ignorance. - Terry Pratchett
It is strange that MTS doesn't monitor extreme spikes in phone use. They claim that they don't have the resources to monitor anomalies, but it should be relatively straightforward to write a report that queries billing totals that are n times a customer's long term average. After all, few companies would see a legitimate spike of 20 or 30x normal billing from month to month. What it boils down to is that MTS doesn't want to be responsible for identifying fraudulent billing (lest the victim use that as grounds to get the charges waived), and the easiest way to avoid legal responsibility is to bury their heads in the sand.
Let's assume these calls cost $3.00 for a minute.
$56,000 / 3.00 = 18667 Minutes.
18667 / 60 (min/hr) = 311 Hrs.
So that means nobody noticed as this guy called for almost 2 full weeks of talk-time??
($3.00 is an assumption as I have no idea what actual international rates are)
Still, if this is even in the ball-park, that's a hell of a lot of talk time going unnoticed. You'd think the system would flag if you suddenly doubled your usage over a period of time.
Sorry, but no sympathy for this guy. It's his company's equipment which was hacked. His telecom company isn't responsible for his equipment, and if they're nice, they'll alert him to the calls. They make money when those calls are made, and why should they be responsible for alerting a customer who's making phone calls. Yes, the calls are going to Bulgaria, but that doesn't mean a telco should alert every person when they make a phone call overseas.
"The only constant in the universe is change." - Unknown author
Is there not a way to just block the ability to direct dial International Calls at the Phone company level. That way a calling card could be used to only dial international?
If the phone company does not offer such a protection, they are in a manner condoning such abuse are they not?
I was also under the impression that YOU had to be the one that actually 'in good faith' placed the calls for it to legally billed to you. I am not sure about US/Canadian telecom laws?
If a stranger hacks my WIFI encryption in my neighborhood and downloads child prOn, warez, illegal MP3, etc.. through my router/IP that DOES NOT mean that I did it and I AM NOT responsible for those communications/transfers as I have made reasonable accommodations to prevent that (plus I shutter to think that any of my neighbors are into any of that).
I would simply be responsible for getting a better protected router or some other commonplace and reasonable standard process of WiFi protection.
Similarly, this firm likely had made reasonable efforts to NOT have their phone system hacked, and therefore did not make the calls and thus should not be made responsible for them. The phone company should protect their customers 'in good faith'.
He should be looking to the company that installed the system for compensation, not MTS.
The phone bill is exactly stolen services....and for the phone company to sell that should be illegal.
THL phish sticks
Davison has a four-digit password on the voice mail. That doesn't stop professional hackers, said Brett Rhodes, an expert in the field who runs SME Teleresources Inc. in Winnipeg.
I once saw a web site with a list of all 4-digit pins on it. I mean like, every single one!!!! There must be... hundreds.. no... thousands of possiblities! Keeping or distributing such a list should be illegal.
...and there is no, I mean, NO excuse for what this guy allowed to happen, from the perspective of a telephony engineer.
Point #1: how weak is your security that an external entity can log in and gain access?
Point #2: why in the world does his voice mail system have a class of service that allows outdialing? Typically a telephony engineer restricts the class of service on the ports connecting to the phone system so that they can only pass calls to the phone system itself, not to the outside world.
This guy is unbelievably lazy, and the fact that he wants someone else to pay for his mistakes is insane. He fails at life.
---don't make me break out my red pen.
Everyone here seems to have this blame the victim for getting hacked, but, why should we have to do this security stuff at all? Why can't we just execute the criminals. Everything is all about put up shields, pay tons of money for security, and its as if the criminals have more of a right to our systems than we do. Enough already. This guy shouldn't have to pay any money at all, regardless of whether he had the shields up, or not. People ought to be able to have a relative sense of security about themselves, and if we have to behead 50,000 convicted hackers and identity thieves and hang their bloated corpses off of bridges as an example to others, then, lets get on with it.
Death to hackers, that's the best security policy that any country could have.
This is my sig.
Because the water company doesn't own the pipe six inches to the left, and the company that got their water hijacked was a "pipe security" company.
This is an interesting legal point.
It seems to me a lot of lawsuits come down to "what are the damages"?
If someone steals a physical item, how is its value determined - retail or wholesale? The "actual damages" are a lot lower than the retail price of lots of things, but especially phone service.
This issue is a bit more complicated than you think.
I work for a Telco. We flag to clients when they accrue silly spends to foreign numbers. This happens around the $100 mark generally. Why did this go unnoticed for so long? Incidentally this is completely the responsbility of the end client. Anyone could ring Bulgaria for hours on end and then blame "teh criminalz!!!11". Secure your equipment better.
That's not because Bulgaria rocks - it's because you're from Utah.
Weaselmancer
rediculous.
They're no different than any regional telecom giant. People in Alberta and BC can give you horror stories for days about dealing with Telus, and I imagine there are similar stories in Ontario and Quebec about Bell and Rogers. I deal with MTS Allstream pretty regularly as they sold us (and manage) our PBX and I don't have any major complaints, but then they actually have to compete out here.
This poo is cold.
I had a Panasonic key system and my employee left some default passwords in place. It was hacked to route incoming calls to a new outgoing line, and $14,000 worth of calls were made to Indonesia. It took many discussions with Verizon, threats back and forth, and some letters to the FCC to get Verizon to drop the charges.
It is rare for these agreements to even approach 3 cents a minute nowadays, phone cards are proof of that because they usually average about 1-2 cents profit per minute because the competition is brutal. The phone companies are charging sometimes 50 times the amount they pay. So did you get that, MTS is charging 1.33 Canadian and you can get phone cards for around 4 cents a minute US. So around 40,000 minutes of calls which would cost around 1500 bucks US they are trying to get him to pay around 45,000 US or about 30 times cost. Are people really that stupid to still be sticking with a land line when they won't even spit on your asshole before raping you?
I have friends in Georgia, Russia and the Ukraine and I just use a cheap skype router and talk to them that way, it works better than the phone system. 90% of the people under the age of 35 in those countries do the same. So my question would be who were the calls to, who was making them and why can't they charge one of them?
An Education is the Font of All Liberty
You are obvoiusly basing this on your experience in the United States. Here in Canada it is much different. Our Telcos are regulated by the CRTC - and therefore they do not provide any such luxuries as "spit". They get right to the point.
There's one easy solution to this. Call and threaten to cancel your service. Bell, Telus, Rogers all the same. Whomever you speak to first in 'Customer Service' will try to talk you out of it. Be persistent without actually canceling, unless you REALLY want to. In no time, you'll be transferred to another department. These are their customer saving or retention team people. They're there to save you from selling your soul to the competition. With these guys, you can get better and cheaper plans, better and faster service and every effort will be made to help you in the future. If you have some really mucked up billing issue save yourself of the hundreds of phone calls: threaten to cancel. I almost guarantee it will be fixed in 2 business days and not 2 months.
I just thought I'd share this information with others. I'm willing to bet our southern neighbours will enjoy this nugget too. If the big companies cannot provide good service, let their CEOs see how many people are threatening to cancel service. Shareholders wouldn't be too happy would they?
Now some politician is going to start making us enter CAPTCHAs every time we want to make a call..... To protect us.....
Knowing Google's lust for data collection, the Soviet Union is still alive and well inside the psyche of Sergey Brin....