Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Crackers favour war dialling and weak passwords

Crackers favour war dialling and weak passwords

by Nikola Strahija on May 22nd, 2002 With all the talk about zero day exploits and sometimes esoteric vulnerabilities its easy to lose sight of the role of older, less sophisticated techniques as a mainstay of cracker activity. During a hacking debate at InfoSecurity Europe on Thursday, black hat hacker KP said that when he broke into a network he did so 90 per cent of the time through an unprotected modem, often through war dialling.


War dialling involves systematically trying to locate the numbers associated with corporate modems through testing each extension of a corporate phone system in turn.

"Intrusion detection systems are no real deterrent for me because I get in through the back door," he said. "Many networks are constructed like Baked Alaska--crunchy on the outside and soft in the middle."

KP often takes advantage of weak or default passwords to break into networks, and only uses social engineering attacks on telco companies.

Coldfire, another cracker speaking at the debate, said he too only used social engineering (persuading people to give confidential information over the phone), against telco suppliers.

"Hackers don't like talking to people--remember we're socially inadequate," he joked.

In response to customer demand, security testing specialists NTA Monitor this week launched a service to test against war dialling vulnerability.

"This isn't particularly sexy," said NTA Monitor's technical director Roy Hills. "But we're seeing high demand for this low-tech service."

The issue of war dialling and insecure modem connections was highlighted last month when BT inadvertently published the private remote access numbers of thousands of its customers on its Web site. The list was supposed to include the dial up numbers of ISPs, but modem numbers of private companies and people were published as well by mistake.

BT swiftly pulled the information from the BT Together site but not before the monster telco earned brickbats from security consultants.

-copyright www.theregister.co.uk-


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »