Instruction manual

Introduction
2-6 Issue 9 May 2003
If the system allows uninterrupted, continuous access, a war dialer
can crack a 6-digit code within 6 hours. The codes are then
distributed via bulletin boards or pirated voice mailboxes, or are sold
to call sell operators. Some systems hang up after a specified
number of invalid access attempts, thereby extending the amount of
time required to crack the code. However even if a hacker is
disconnected, he or she may call back repeatedly in an attempt to
crack the code.
■ Network-based activities
—
Shoulder surfing
Network hackers use video cameras in airports supposedly to take
pictures of their family, but they are actually taking pictures of people
using their calling cards. Hackers may also use an audio tape
recorder to capture calling card numbers as they are spoken to an
operator. This technique is known as “shoulder surfing.”
—
Social engineering
“Social engineering” is a con game hackers frequently use. It is
sometimes referred to as “operator deceit.” The success of this con
requires gullibility or laxity on the part of the operator or employee,
of which the hacker takes full advantage.
For example, hackers call an employee, claim to have the wrong
extension number, and ask to be transferred back to the operator.
The call looks to the operator like an internal call. The hacker then
asks for an outside line. Often, because operators do not know any
better, they will connect the hacker to an outside line.
Another example of social engineering is a hacker calling the
operator and pretending to be a telephone maintenance repair
person. They make statements like: “I am a qualified telephone
repairman testing your lines. Please transfer me to 900 or 9#;” or “I
need to verify your DID number range.” An untrained operator may
provide the requested transfer or information, giving the hacker
more ammunition with which to crack your system.
— Dumpster diving
Hackers obtain switch and security information by browsing through
company trash cans. They are looking for discarded phone bills,
corporate phone directories, and access codes. The “found”
information can be used to make fraudulent calls.
—
Alternate carrier access
If your system is not secure, hackers can dial out by using carrier
codes that bypass routing restrictions you have placed on your
primary carrier’s features.