Hackers rediscover war dialling

Unsecured modems offer easy access to corporate systems.

Hackers are again using war dialling to break into corporate networks, security experts have warned.
NTA Monitor said that companies are not taking sufficient precautions against war dialling, which involves scanning telephone lines to find unsecured modems and create backdoors into corporate networks.

The practice emerged as an issue in the early 1980s but, while most companies have forgotten about it, hackers are now reacting to increased security in corporate networks.

A survey conducted by NTA Monitor between August and September showed that the issue had been widely overlooked, with 22 per cent having no knowledge of the hacking method.

Almost a quarter of respondents admitted that there are unauthorised modems attached to their systems, with as many as 20 rogue modems present at one site.

Over a third of organisations had found unauthorised modems in the past, but 68 per cent had no controls in place to detect modem scanning attempts on their systems.

This means those companies have no way of knowing whether they have been attacked or whether they have unsecured modems attached to their systems.

Four out of five firms had never conducted a third-party war dialling test run against their systems.

On average, modems are found in 0.75 per cent of a corporate's telephone number range, so a mid-sized company with 10,000 numbers will typically contain 75 modems.

"This should cause major concern, as it only takes one unsecured modem to permit a hacker to gain access to an organisation's systems," said NTA Monitor's technical director Roy Hills.

"Imagine the situation for a company with 5,000 extensions over 20 sites. How can it ever be sure that no rogue modems are attached to any of those lines, without testing them?"


Source : http://www.vnunet.com/News/1144060

wow, that brings back memories of boxes, laptops and many a sleepless night ;)

I guess what they say about history repeating itself is true.

This has never really died out. I think they are just bringing it to the front of everyone's brain again so that people do not forget to audit for modems as well.

Quote:

---

Originally posted here by Juridian
This has never really died out. I think they are just bringing it to the front of everyone's brain again so that people do not forget to audit for modems as well.

---

I think I'd have to agree with you here.

It never really went anywhere. Yet it is still a very valid point of entry.

Sometimes the hardest things to see, are those that you have already grown past. Never forget your roots. They are the reason you are, who you are.

No real point in locking the doors, if you are just gonna leave the windows unlocked.

:o

Quote:

---

Brisbane Broncos captain Gorden Tallis said he had relinquished the greatest honour in rugby league by announcing his retirement from all representative football.

Tallis was set to lead Australia on the Kangaroo tour of Great Britain and France next month but said his body had "sort of fallen apart" and could no longer handle the rigours of top-level football.

---

Quote:

---

Those who do not learn from histroy are doomed to repeat it.
~George Santayana

---

I really had'nt thought about war dialing since prolly 96 when my friend used to "do it" though he never really succeded I don't think. I agree and think its should be an issue becuase a whole bunch of users are still on dialup........ WTF with the big red letters FAQ, football???

It's not just the users that are on dialup. Alot of companies have people who put unauthorized (and some are authorized) modems into their machines and hook em up to phone lines. They think it will be easier for them to have remote access this way instead of going through the proper channels....though it also gives the attackers another point of entry.

Right on with the roots theory.
I belive that war dialing has always been in effect, althought using as a method of access may have decreased in priority recently as Broadband has become readily and cheaply available. However, the focus on making such a creature of necessary evil secure has left the security of modems under a layer of dust. The statistics are amazing. It would probably not be a bad idea to know at all times how many modems are in your data center. (Don't forget to look under that raised floor)

let the world no on anti online hnehe i hate ****ing war diallers remminds me of black and wight moveis to over rated or under rated but if people are that easy then what thay say is true the past wich was known is but the __________. hehe keep on rolling you *******s

****e you kno typos are a drage white is what i ment to say

On a related issue: WHile trying to determine a security company to carry out a security audit a couple of years ago one of the contenders claimed to be able to scan the network and detect computers that have a modem attached. Since they didn't get the job we never found out more about this.

Is there a tool out there that can run across a network and determine if there is a modem installed?

LanGuard Network Security Scanner from GFI Software Ltd. has some capability. In limited testing, it has had some success in locating modems on my network. I haven't really put it to the test and as yet I have no idea what it's real capabilities are -- just know it reported accurately on a small number of test machines.

Tiger Shark, Yes, it is possable as stated here: http://lists.insecure.org/lists/pen-.../Nov/0403.html

Basically this guy chose to use NT's remote regestry feture and looks through there for modems. I'll see if any one has a tool out on the net, but untill then check that link.

Quote:

---

Basically this guy chose to use NT's remote regestry feture and looks through there for modems. I'll see if any one has a tool out on the net, but untill then check that link.

---

That's the trick LanGuard uses.

Thanks... But let me rephrase......

Is there a tool out there that doesn't cost an arm and a leg... I'm a non-profit and LanGuard is horrendously expensive as far as I am concerned...

Just a script would be useful or I'm gonna have to try writing one myself and that could end in tears...... ;)

Another way I have seen it done is basically wardialing a block of phone numbers owned by the company or organization, then following up on all the hits. I think there are a number of tools out there for that, some of them may even be legal. :) This is not as hard as it sounds since so many companies have blocks of numbers and, if you are running an audit, the business office usually knows which phone numbers they are paying bills on.

introgrammer

I have no idea what it is that you are (ab) using............it will kill ya!

animal tranks?

You have to stop it now!....just re-read your post....when you descend from the ceiling...you will understand me.

God Bless

You can use the Windows Management Interface (WMI) to hunt down hardware installed on systems, or SMS, if you are so inclined. I've had mixed success with SMS, but am going down that road one more time with the new W2003 version.

I feel lucky in that we have a digital phone network. So, the only way you are going to get a modem working here is to have us install an analog phone line for you. We make it very tough and expensive. We can also point to the exising modems in the network and can lock the access immediately, if necessary.

Couple years ago, I had one faculty person come in with a cheapo internal modem that was fried. He had installed it and plugged it into the digital phone port. He brought it to me, thinking maybe I could make it work. I said, "Gee, those don't work here, did you know that?"

There are software methods of auditing it....the most popular method is to simply find the block of phone numbers the company uses and just run a war dialer.

Sorry guys. haveing a hard time with my life so i kinda just babble :| just pass me by next time i babble im sorry ...:|

wardialing.....telenet....those were the days.
Nothing like racking up a 100 dollar phone bill for 20 minutes on a VAX in russia.