Slashdot Mirror
Default Passwords Blamed In $55M PBX Hacks
An anonymous reader writes "The Washington Post is reporting that the US Justice Department has indicted three residents of the Philippines for breaking into more than 2,500 corporate PBX systems in the United States and abroad. The government says the hackers sold access to those systems to operators of call centers in Italy, which allegedly made 12 million minutes of unauthorized phone calls through the system, valued at more than $55 million. The DOJ's action coincides with an announcement from Italian authorities today of the arrest of five men there who are suspected of funneling the profits from those call centers to terrorist groups in Southeast Asia."
I'm just amazed they found somebody willing to pay almost $5 per minute for long distance.
admin or password?
Maybe governments should figure out its the 21st century out there, and stop treating phone traffic as a source of tax revenue, instead of treating it exactly like every other kind of electronic traffic (internet, bank transactions, etc), which is tax free the way it should be. Then those "terrorist groups" would suddenly find themselves out of profit.
CAPTCHA: Rackets. How appropriate.
12 million minutes of unauthorized phone calls through the system, valued at more than $55 million.
... or a lot less.
$5 per minute?!! Just to route some packets a bit farther?
And then telcos wonder why IP phones are eating their lunch.
Maybe they're using MAFIAA math... Each minute causes $5 worth of damage to their network...?
These were default passwords on more than likely open ports. I would hardly call that hacking. That would be like walking by a house with an open door and saying you picked the lock by walking inside.
One heck of an expensive lesson to the IT guys responsible. Never leave default passwords is Rule #1. Or at least in the top 3.
If factory-set default passwords were used to gain access to the systems and use them, what exactly did they 'hack' ?
That would seem like a typical case of unauthorized use of a system to me, but hardly qualify as 'hacking'. When legal charges are to be brought, use a correct description of the crime, will you?
"Your honor, there was a gaping hole where the door used to be! I didn't even have to touch the doorknob!"
"I don't care! Since a computer system was involved, you broke into the place, understood?"
You are forgetting the reciprocal costs of phone calls. You break out of the network to another telco, most of the time there are costs per minute. You pay for access to the circuit. Add international calls to this and the numbers climb.
Most telcos have reciprocals in place that say if Telco A made 1000 minutes of calls to Telco B, and Telco B made 1000 minutes to Telco A, they call it quits. Now if A made 1000000 minutes to B, B wants its money. And A has nobody to send the bill to because they were stupid and didn't change the passwords.
Trying to become famous by taking photos. Visit my homepage please.
access denied
(hint: the default password for the system is "qwert" if this is your first time accessing it)
O.o
Wait! before I thought only the NSA by statute and Google (because Google is truly eViL by supplying the NSA (& NASA!) with technology & staff), could listen to my phone calls, transcribe, translate, & index them into perpetuity. But now I'm reading the Italian mafia can listen in too?
Of course this explains why the Italian mafia learned awhile ago to encrypt their own calls. On the job training if you ask me.
FWIW, there's an asterisk module for pretty good privacy: http://www.zfoneproject.com/prod_asterisk.html
http://www.securitymanagement.com/article/new-voip-encryption-challenges-005680
Why not?
That's the kinda thing an idiot would have on his luggage.
Is it illegal to support terrorism by remiss? The people who left those default passwords have indirectly supported terrorists, even if it was unintentional. Can they be sentenced for that, should they be? I think they ought to be fined for it, but I don't think they deserve as harsh a punishment as the people who abused the systems for economical gain.
Do you care about the security of your wireless mouse?
That's the kind of thing an idiot would post in reply to a slashdot post about a luggage combination.
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Am I the only one that finds this "terrorism" link a bit absurd. Having travelled in SE Asia I sincerely doubt that this money was filtered into "terrorist" hands. All that has happened here is that a small number of enterprising Philipino's have made themselves rich enough to retire (rich enough for their kids to retire in the Philipines). If they've been caught then they've just made the cops rich enough to retire as well.
It just seems the "evil terrorist" card is played every time law enforcement fucks up and wants to keep people from questioning that.
Calling someone a "hater" only means you can not rationally rebut their argument.
Guys its probably a DISA they discovered NOT CLI ACCESS TO THE PABX.....
Many PABXs have a feature where a specific incoming extension (DISA) is configured to allow calls to be re-routed from the PABX if you enter the correct PIN.
e.g. you dial into the secret number, enter the secret PIN, then from there you have full access to the PABX's destination codes.
so e.g. if your DISA extension is 333-88888, and PIN is 12345, and you dial 0 for external, then dialling this would work: 333-88888-12345-0-(number you want to dial). The call would then be originated from the PABX instead of the caller.
This is mostly used for troubleshooting because in PABX tie line networks your number codes determine how your calls route, with complex tie line networks you end up with destination codes upon destination codes which require a lot of thinking to get right as its basically a huge, layered sequence of static routes.
Anyhow back in my TDM days I used to run PABXs for a large corporation. A few years before I started the EXACT SAME THING happened to us - someone phreaked the PIN code to the disa number - and was then selling calling cards in the phillipines that rerouted using one of our PABX's DISA lol.
..make all default passwords hard to guess!
At first I thought it was trying to claim that 3 men used 12 million minutes of phone time, I mean three women I could believe!
Actually a lot of organized crime funds terrorism. I'm sure on your travels in SE Asia, you didn't see any so obviously it doesn't exist. If it seems absurd to you, then we're sorry and will try to let reality intrude less next time.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
But that's just because we are pretty good at labelling everything "terrorist" right now. It always was a tactic of the organized crime to either make the local policy part of the organization or assasinate the policemen who didn't conform. Today assasinating a local police officer surely gets labelled "terrorism".