Feeds

Crackers favour war dialling and weak passwords

The old ones are still the best

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

InfoSecurity Europe With all the talk about zero day exploits and sometimes esoteric vulnerabilities its easy to lose sight of the role of older, less sophisticated techniques as a mainstay of cracker activity.

During a hacking debate at InfoSecurity Europe yesterday, black hat hacker KP said that when he broke into a network he did so 90 per cent of the time through an unprotected modem, often through war dialling.

War dialling involves systematically trying to locate the numbers associated with corporate modems through testing each extension of a corporate phone system in turn.

"Intrusion detection systems are no real deterrent for me because I get in through the back door," he said. "Many networks are constructed like Baked Alaska - crunchy on the outside and soft in the middle."

KP often takes advantage of weak or default passwords to break into networks, and only uses social engineering attacks on telco companies.

Coldfire, another cracker speaking at the debate, said he too only used social engineering (persuading people to give confidential information over the phone), against telco suppliers.

"Hackers don't like talking to people - remember we're socially inadequate," he joked.

In response to customer demand, security testing specialists NTA Monitor this week launched a service to test against war dialling vulnerability.

"This isn't particularly sexy," said NTA Monitor's technical director Roy Hills. "But we're seeing high demand for this low-tech service."

The issue of war dialling and insecure modem connections was highlighted last month when BT inadvertently published the private remote access numbers of thousands of its customers on its Web site. The list was supposed to include the dial up numbers of ISPs, but modem numbers of private companies and people were published as well by mistake.

BT swiftly pulled the information from the BT Together site but now before the monster telco earned brickbats from security consultants. ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.