‘Swatting:’ A Very Personal Version of a ‘Smurf Attack’
Wired posted a story including a telephone version of the “Smurf Attack” we learned about in class. The story was posted because of new developments concerning the suspects but the actual attack was done back in 2005.
On May 1, 2005, Richard Gasper of Colorado Springs was woken at nearly 4am to a swarm of police deputies. The deputies, having expected a desperate gunman holding hostages, held Gasper for over 90 minutes despite the fact that he walked out of the house, unarmed and quite confused.
Gasper was the victim of what is called ‘swatting.’ Prank calls were made to Emergency services, making threats of murder and hostages while spoofing the caller ID to make it appear as if the calls were coming from inside Gasper’s home. The term comes from the potential swarms of SWAT teams that surround the victim’s house.
Comment by cbhacking
March 3, 2008 @ 2:01 am
The linked article is well worth a read. While any particular aspect of the attacks might not take so much skill or equipment – the SWATting, for example, apparently uses a commercially available device to change your Caller ID and then just a bit of social engineering – the overall security ramifications are staggering. Phones, like email, are something that people tend to think of as sufficiently secure, even if they know that there’s no guarantee of security. However, attacks such as these expose just how insecure the system really is; almost anything is possible, from using social engineering to tap a phone line from the provider to sneakily forwarding a phone number directly to the FBI.
In a way, the SWATting and such are the least of the attacks, though they are the most likely to result in physical harm (several people have been injured when police burst into their homes). Using aspects of the phone system that nobody except the phreakers and phone technicians know, it appears you can gain all kinds of access and cause considerable harm to somebody – everything from placing fraudulent calls to, say, Child Protective Services, to stealing somebody’s identity.
While the article suggests that these attacks are usually carried out against other phreakers, in a sort of ongoing dominance war, there’s nothing that stops them from being carried out against others – the Gasper family mentioned above were attacked because their teenage daughter refused to have phone sex with a blind kid who goes by “Lil Hacker” and is considered one of the best in the field right now. Not meaning to sound alarmist, but perhaps it’s worth seeing if anything can be used to increase the security of your phone. From the perspective of the service providers, something really ought to be done. A few suggestions:
Use an authentication scheme for interacting with the phone switching hardware (or a better one, if there is in fact one in place). It’s all computerized these days; such special-purpose software shouldn’t be too hard to harden sufficiently.
Implement policies at phone companies to make impersonation of employees more difficult. It could be something very simple – the ability for the employee to call back whoever called into the office initially, for example, would at the least make social engineering attacks much harder.
Either don’t rely on Caller ID at all, secure it (properly, at least for police purposes) or, as a last resort, try to solve the problem through legislation: make it illegal to spoof Caller ID.
Sorry for the long comment.
Comment by alpers
March 3, 2008 @ 2:33 pm
I never understood the reliance on caller ID for tracing calls (from a 911 standpoint). I understand it’s simplicity, but it seems that you should be able to call a tracert on the phone network similar to what computers on a network (like the internet) can trace a routing path, if telephones are becoming more computer-dependent.
And yes, I strongly reconmend reading the Wired article, it’s a very well-written article. 🙂