Comments on: ‘Swatting:’ A Very Personal Version of a ‘Smurf Attack’ http://cubist.cs.washington.edu/Security/2008/03/03/swatting-a-very-personal-version-of-a-smurf-attack/ Mon, 06 Oct 2008 14:13:06 +0000 http://wordpress.org/?v=2.6.2 By: alpers http://cubist.cs.washington.edu/Security/2008/03/03/swatting-a-very-personal-version-of-a-smurf-attack/#comment-2949 alpers Mon, 03 Mar 2008 22:33:18 +0000 http://cubist.cs.washington.edu/Security/2008/03/03/swatting-a-very-personal-version-of-a-smurf-attack/#comment-2949 I never understood the reliance on caller ID for tracing calls (from a 911 standpoint). I understand it's simplicity, but it seems that you should be able to call a tracert on the phone network similar to what computers on a network (like the internet) can trace a routing path, if telephones are becoming more computer-dependent. And yes, I strongly reconmend reading the Wired article, it's a very well-written article. :) I never understood the reliance on caller ID for tracing calls (from a 911 standpoint). I understand it’s simplicity, but it seems that you should be able to call a tracert on the phone network similar to what computers on a network (like the internet) can trace a routing path, if telephones are becoming more computer-dependent.

And yes, I strongly reconmend reading the Wired article, it’s a very well-written article. :)

]]> By: cbhacking http://cubist.cs.washington.edu/Security/2008/03/03/swatting-a-very-personal-version-of-a-smurf-attack/#comment-2892 cbhacking Mon, 03 Mar 2008 10:01:21 +0000 http://cubist.cs.washington.edu/Security/2008/03/03/swatting-a-very-personal-version-of-a-smurf-attack/#comment-2892 The linked article is well worth a read. While any particular aspect of the attacks might not take so much skill or equipment - the SWATting, for example, apparently uses a commercially available device to change your Caller ID and then just a bit of social engineering - the overall security ramifications are staggering. Phones, like email, are something that people tend to think of as sufficiently secure, even if they know that there's no guarantee of security. However, attacks such as these expose just how insecure the system really is; almost anything is possible, from using social engineering to tap a phone line from the provider to sneakily forwarding a phone number directly to the FBI. In a way, the SWATting and such are the least of the attacks, though they are the most likely to result in physical harm (several people have been injured when police burst into their homes). Using aspects of the phone system that nobody except the phreakers and phone technicians know, it appears you can gain all kinds of access and cause considerable harm to somebody - everything from placing fraudulent calls to, say, Child Protective Services, to stealing somebody's identity. While the article suggests that these attacks are usually carried out against other phreakers, in a sort of ongoing dominance war, there's nothing that stops them from being carried out against others - the Gasper family mentioned above were attacked because their teenage daughter refused to have phone sex with a blind kid who goes by "Lil Hacker" and is considered one of the best in the field right now. Not meaning to sound alarmist, but perhaps it's worth seeing if anything can be used to increase the security of your phone. From the perspective of the service providers, something really ought to be done. A few suggestions: Use an authentication scheme for interacting with the phone switching hardware (or a better one, if there is in fact one in place). It's all computerized these days; such special-purpose software shouldn't be too hard to harden sufficiently. Implement policies at phone companies to make impersonation of employees more difficult. It could be something very simple - the ability for the employee to call back whoever called into the office initially, for example, would at the least make social engineering attacks much harder. Either don't rely on Caller ID at all, secure it (properly, at least for police purposes) or, as a last resort, try to solve the problem through legislation: make it illegal to spoof Caller ID. Sorry for the long comment. The linked article is well worth a read. While any particular aspect of the attacks might not take so much skill or equipment - the SWATting, for example, apparently uses a commercially available device to change your Caller ID and then just a bit of social engineering - the overall security ramifications are staggering. Phones, like email, are something that people tend to think of as sufficiently secure, even if they know that there’s no guarantee of security. However, attacks such as these expose just how insecure the system really is; almost anything is possible, from using social engineering to tap a phone line from the provider to sneakily forwarding a phone number directly to the FBI.

In a way, the SWATting and such are the least of the attacks, though they are the most likely to result in physical harm (several people have been injured when police burst into their homes). Using aspects of the phone system that nobody except the phreakers and phone technicians know, it appears you can gain all kinds of access and cause considerable harm to somebody - everything from placing fraudulent calls to, say, Child Protective Services, to stealing somebody’s identity.

While the article suggests that these attacks are usually carried out against other phreakers, in a sort of ongoing dominance war, there’s nothing that stops them from being carried out against others - the Gasper family mentioned above were attacked because their teenage daughter refused to have phone sex with a blind kid who goes by “Lil Hacker” and is considered one of the best in the field right now. Not meaning to sound alarmist, but perhaps it’s worth seeing if anything can be used to increase the security of your phone. From the perspective of the service providers, something really ought to be done. A few suggestions:

Use an authentication scheme for interacting with the phone switching hardware (or a better one, if there is in fact one in place). It’s all computerized these days; such special-purpose software shouldn’t be too hard to harden sufficiently.

Implement policies at phone companies to make impersonation of employees more difficult. It could be something very simple - the ability for the employee to call back whoever called into the office initially, for example, would at the least make social engineering attacks much harder.

Either don’t rely on Caller ID at all, secure it (properly, at least for police purposes) or, as a last resort, try to solve the problem through legislation: make it illegal to spoof Caller ID.

Sorry for the long comment.

]]>