Feeds

Crackers favour war dialling and weak passwords

The old ones are still the best

  • alert
  • submit to reddit

The Essential Guide to IT Transformation

InfoSecurity Europe With all the talk about zero day exploits and sometimes esoteric vulnerabilities its easy to lose sight of the role of older, less sophisticated techniques as a mainstay of cracker activity.

During a hacking debate at InfoSecurity Europe yesterday, black hat hacker KP said that when he broke into a network he did so 90 per cent of the time through an unprotected modem, often through war dialling.

War dialling involves systematically trying to locate the numbers associated with corporate modems through testing each extension of a corporate phone system in turn.

"Intrusion detection systems are no real deterrent for me because I get in through the back door," he said. "Many networks are constructed like Baked Alaska - crunchy on the outside and soft in the middle."

KP often takes advantage of weak or default passwords to break into networks, and only uses social engineering attacks on telco companies.

Coldfire, another cracker speaking at the debate, said he too only used social engineering (persuading people to give confidential information over the phone), against telco suppliers.

"Hackers don't like talking to people - remember we're socially inadequate," he joked.

In response to customer demand, security testing specialists NTA Monitor this week launched a service to test against war dialling vulnerability.

"This isn't particularly sexy," said NTA Monitor's technical director Roy Hills. "But we're seeing high demand for this low-tech service."

The issue of war dialling and insecure modem connections was highlighted last month when BT inadvertently published the private remote access numbers of thousands of its customers on its Web site. The list was supposed to include the dial up numbers of ISPs, but modem numbers of private companies and people were published as well by mistake.

BT swiftly pulled the information from the BT Together site but now before the monster telco earned brickbats from security consultants. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.