Slashdot Mirror
Default Passwords Blamed In $55M PBX Hacks
An anonymous reader writes "The Washington Post is reporting that the US Justice Department has indicted three residents of the Philippines for breaking into more than 2,500 corporate PBX systems in the United States and abroad. The government says the hackers sold access to those systems to operators of call centers in Italy, which allegedly made 12 million minutes of unauthorized phone calls through the system, valued at more than $55 million. The DOJ's action coincides with an announcement from Italian authorities today of the arrest of five men there who are suspected of funneling the profits from those call centers to terrorist groups in Southeast Asia."
I'm just amazed they found somebody willing to pay almost $5 per minute for long distance.
admin or password?
Maybe governments should figure out its the 21st century out there, and stop treating phone traffic as a source of tax revenue, instead of treating it exactly like every other kind of electronic traffic (internet, bank transactions, etc), which is tax free the way it should be. Then those "terrorist groups" would suddenly find themselves out of profit.
CAPTCHA: Rackets. How appropriate.
12 million minutes of unauthorized phone calls through the system, valued at more than $55 million.
... or a lot less.
$5 per minute?!! Just to route some packets a bit farther?
And then telcos wonder why IP phones are eating their lunch.
Maybe they're using MAFIAA math... Each minute causes $5 worth of damage to their network...?
These were default passwords on more than likely open ports. I would hardly call that hacking. That would be like walking by a house with an open door and saying you picked the lock by walking inside.
One heck of an expensive lesson to the IT guys responsible. Never leave default passwords is Rule #1. Or at least in the top 3.
Yeah. $55 million dollars in routings costs. Call me an idiot, but I just don't see how they could have used so much electricity that it added up to $55 million dollars. Maybe $54.98 million dollars was for technical support.
If factory-set default passwords were used to gain access to the systems and use them, what exactly did they 'hack' ?
That would seem like a typical case of unauthorized use of a system to me, but hardly qualify as 'hacking'. When legal charges are to be brought, use a correct description of the crime, will you?
"Your honor, there was a gaping hole where the door used to be! I didn't even have to touch the doorknob!"
"I don't care! Since a computer system was involved, you broke into the place, understood?"
access denied
(hint: the default password for the system is "qwert" if this is your first time accessing it)
O.o
His intellectual property back.
What is it with the US gov and the use of MS like default passwords?
http://freegary.org.uk/
Domestic spying is now "Benign Information Gathering"
Wait! before I thought only the NSA by statute and Google (because Google is truly eViL by supplying the NSA (& NASA!) with technology & staff), could listen to my phone calls, transcribe, translate, & index them into perpetuity. But now I'm reading the Italian mafia can listen in too?
Of course this explains why the Italian mafia learned awhile ago to encrypt their own calls. On the job training if you ask me.
FWIW, there's an asterisk module for pretty good privacy: http://www.zfoneproject.com/prod_asterisk.html
http://www.securitymanagement.com/article/new-voip-encryption-challenges-005680
Why not?
That's the kinda thing an idiot would have on his luggage.
Is it illegal to support terrorism by remiss? The people who left those default passwords have indirectly supported terrorists, even if it was unintentional. Can they be sentenced for that, should they be? I think they ought to be fined for it, but I don't think they deserve as harsh a punishment as the people who abused the systems for economical gain.
Do you care about the security of your wireless mouse?
That's the kind of thing an idiot would post in reply to a slashdot post about a luggage combination.
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Replying anonymously to yourself to explain an obscure reference.
Good show, old boy.
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Am I the only one that finds this "terrorism" link a bit absurd. Having travelled in SE Asia I sincerely doubt that this money was filtered into "terrorist" hands. All that has happened here is that a small number of enterprising Philipino's have made themselves rich enough to retire (rich enough for their kids to retire in the Philipines). If they've been caught then they've just made the cops rich enough to retire as well.
It just seems the "evil terrorist" card is played every time law enforcement fucks up and wants to keep people from questioning that.
Calling someone a "hater" only means you can not rationally rebut their argument.
Guys its probably a DISA they discovered NOT CLI ACCESS TO THE PABX.....
Many PABXs have a feature where a specific incoming extension (DISA) is configured to allow calls to be re-routed from the PABX if you enter the correct PIN.
e.g. you dial into the secret number, enter the secret PIN, then from there you have full access to the PABX's destination codes.
so e.g. if your DISA extension is 333-88888, and PIN is 12345, and you dial 0 for external, then dialling this would work: 333-88888-12345-0-(number you want to dial). The call would then be originated from the PABX instead of the caller.
This is mostly used for troubleshooting because in PABX tie line networks your number codes determine how your calls route, with complex tie line networks you end up with destination codes upon destination codes which require a lot of thinking to get right as its basically a huge, layered sequence of static routes.
Anyhow back in my TDM days I used to run PABXs for a large corporation. A few years before I started the EXACT SAME THING happened to us - someone phreaked the PIN code to the disa number - and was then selling calling cards in the phillipines that rerouted using one of our PABX's DISA lol.
That's how you get people's attention. Say it's "funding terrorists".
Did you know that marijuana funds terrorism? That argument has been made repeatedly.
You are welcome on my lawn.
I work for a telco and we notice that the vendors who have IT backgrounds often decide that voice is just another kind of data, and frequently have trouble setting up PBX's (like Asterisk). (You ask them if they'd like that PRI as NI-2 Standard and they just mumble at you.)
..make all default passwords hard to guess!
At first I thought it was trying to claim that 3 men used 12 million minutes of phone time, I mean three women I could believe!
It could be done via DISA... But DISA is usually not enabled by default, neither is Trunk to Trunk Transfer.
The brunt of the civil litigation will be aimed at the VAR's and manufacturers. It will be claimed that the breaches happened on their watch and they are therefore responsible. Toll Fraud Prevention is always one the the major selling points of any Maintenance Contract from the VAR's and PBX makers. Unless the PBX's were bought grey-market, and I think it's pretty unlikely that so many switches are floating around on the grey-market. Most IT departments don't admin their own switches beyond simple MAC... Rarely do you meet anyone in corporate IT that understand Dialplans, CoS, CoR, etc... unless the Telco side is their specialty... sadly, they are a dying breed.
Anyone that bashes the Filipinos as terrorist is simply a bigoted nitwit. If you have spent any time in Telco, you know that some of the best and brightest are the Filipinos techs. Just too bad that a couple of them used their talents for criminal purposes.
One questions that begs to be asked, was it a Cust level default password or a Vendor level default?
So slashdot is now echoing anonymous rumors of blatant lies in its headlines. This is pretty shoddy work, ScuttleMonkey.
55 bucks for 12 minutes of long distance? Not unless you're using an Iridium sat phone! It's typical LEO bullcrap propaganda.
And don't get me started on "financing terrorism". It's the pot calling the snowman "darkie", is what that is.
-I like my women like I like my tea: green-
Actually a lot of organized crime funds terrorism. I'm sure on your travels in SE Asia, you didn't see any so obviously it doesn't exist. If it seems absurd to you, then we're sorry and will try to let reality intrude less next time.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
And it nearly matches the default password on most phone stations I am working with (not the PBX though). And because most customers have a very lousy password retainment and password storing policy, the colleagues keep the phone systems on their default passwords. If you know the extension for the modem that connects to the admin console, you could dial in from outside and go forward to administrate...
But that's just because we are pretty good at labelling everything "terrorist" right now. It always was a tactic of the organized crime to either make the local policy part of the organization or assasinate the policemen who didn't conform. Today assasinating a local police officer surely gets labelled "terrorism".
Are you saying the average cost of a phone call is 4.58$ per minute ?
you need to change your phone company! Calling oversee is usually 5-10 cents max, and maybe 25 centsÂfor far out places.
(unless you really want to call that weird looking pacific island of course...)
That's the kind of anonymous meta-moderation comment /. art.
an idiot would apply to a reply to a slashdot post about a luggage combination and a reply to a reply to a slashdot post about a luggage combination
when they don't recognize the essential humor of recursive, meaningless replies as a form of
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Uh, tell that to the people who lost loved ones in Bali, I'd say there are plenty of radical Muslim terrorists in SE Asia.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
You should not be allowed to get the system running unless you change all the default passwords. Too bad if this a problem. The documentation should say in big letters "NOTE: THIS SYSTEM WILL NOT OPERATE UNTIL YOU PROVIDE NEW PASSWORDS FOR ALL ITEMS THAT HAVE PASSWORDS. To do this please follow these instructions..."
That's literally what telemarketers like to use too.
Wanna bet telemarketers are on the list of targets who failed to set any security at all on their PBX's?
Wanna bet
4321 or 0000 or 1234 or 12345 or 00000 was what they had their annoying kit set to I even saw 123 being used as a password.
I worked for a telemarketer before. (Flame suit on) I did, and I noticed a theme, no firewall, simple guessable passwords everywhere. I wanted to add firewalls, and make all the default passwords harder to crack, but they weren't interested. The only thing they wanted me to do, was drill, pull twisted pairs, mount all their crap on the wall, hook it all up, get the video surveillance, workstations and digital dialers up as quick as possible. They already had an admin for the 600 win98SE workstations, and the dns server and win2000 server. I got finished, got paid, and I got the hell out cause everyone was either annoying, or pretty creepy anyway.
At some point there has to be some kind of shared responsibility. I mean with lists like this well known for years now.
Na, I guess not, just spy on everyone's communications and fry motherfuckers when they start to cost too much after the fact. It's the retarded American way.
That old chestnut. If you keep repeating the same old line people will stop listening. The families of the Australian Bali bombing victims would resent their problems being used in this fashion, they would like to move on with their lives rather then have this dragged up for more pointless fear mongering. So I'd say the same to you, why don't you go and remind these people of what they've lost and why they should be afraid, you'll be picking yourself up off the pavement for being an arsehole mate.
There is no mass fear of the great terrorist poltergeist that you describe. More Australians have died on Western Australian roads this year then have died in terrorist attacks in the last 10 years, sorry if this shatters your illusion that terrorism is an imminent threat.
Calling someone a "hater" only means you can not rationally rebut their argument.
Citation needed?
Actually, if you travel to SE Asia and have half a clue you see a lot of organised crime, or at least what we westerners consider to be organised crime. Crime and corruption is rife in the poorer SE Asian countries, particularly the Philipines, so much so that it is its own economy. Every business must pay off the police in order to operate (they call this Tea Money), same for many gangs which operate in that area (taxi drivers, scamers and touts are the most common types in tourist areas). Not all crime is being used to support terrorism, the same as all petty crime in the US is not being used to fund the KKK.
Secondly, I wouldn't call the Moro Islamic Liberation Front (yes that is their real name) a true terrorist organisation as they have never struck outside the Philipines. This is the organisation you were referring to in your link. This organisation is fighting the government in the southern island of Moro, even the article you linked to referred to them as separatists. Further more you wouldn't even know about them if you were to travel to Luzon, which is where the two largest international airports in the Philipines are (MNL and CRK).
Yes it does seem absurd to me, considering the amount of crime and how little of that actually gets funnelled to Terrorism I've applied Occams Razor to this situation and every bit of logic tells me that this was for someone's personal gain. The small chance that this could actually end up in the hands of a group like Jamah Islamia is so tiny that its not even worth mentioning let alone making a big issue out of. It's far more likely that this was someone's get rich quick scheme.
Sorry if a bit of common sense has gotten in the way of your baseless fear mongering, I'll try to let reality intrude a little less next time.
Calling someone a "hater" only means you can not rationally rebut their argument.
I'm just shocked that no one ever thought to change the password! Even a weak password is better than default. I guess someone will be writing a 10 page paper, aka, an SOP.