Penetration Testing mailing list archives
Re: listening to people/offices when on-hold on the phone
From: "Jarrod Frates" <jfrates.ml () gmail com>
Date: Fri, 22 Jun 2007 11:12:43 -0700
Many years ago, when call-waiting was still a relative novelty, I found that I could occasionally hear the conversation on the other connection. It was very, very faint, and I had to really hold the phone to my ear to be able to make out anything clearly, but sometimes people spoke loudly enough to allow me to make things out clearly. I overheard a few interesting things here and there, including some more candid things about people I knew than I expected to ever know. Now, with hold systems that are frequently indistinguishable from mute, it's not that difficult to set this up, and I do keep this in mind when I'm told that I'm put on hold, especially by someone withing my own enterprise. Politically (in)sensitive comments can come back and bite one rather severely
From a legal standpoint, I wonder what the effects of this are. If
you tell someone that they're being put on hold, is there a presumption that you're blocking all voice traffic over that circuit? If there's nothing that's been said about monitoring, does pressing the mute button instead of hold constitute monitoring of the line? You are one of the active parties on the call, and so long as you're not recording the conversation, you're probably not falling afoul of wiretap laws, but these can sometimes be ambiguous. Interesting question there, Robin. Jarrod On 6/22/07, Robin Wood <dninja () gmail com> wrote:
Hi Imagine the situation, you get a message to call someone, your call gets answered by an automated system which says there may be a few minutes wait and gives you the bad hold music. You hit the hands free button on the phone and get on with work while you wait for it to be answered. Unless you mute the call, the person/system on the other end of the call could be listening in while pretending to be on hold and potentially hear all that is going on around you. It is a random attack vector but it could allow an attacker to pick up all sorts of information. I thought about it while sitting on hold for over 30 mins trying to get through to my mobile phone support line last night. If they had been listening they would know what I had for dinner. Anyone tried listening in like this? Anyone got any comments? Robin ------------------------------------------------------------------------ This List Sponsored by: Cenzic Are you using SPI, Watchfire or WhiteHat? Consider getting clear vision with Cenzic See HOW Now with our 20/20 program! http://www.cenzic.com/c/2020 ------------------------------------------------------------------------
-- Jarrod Frates GAWN ------------------------------------------------------------------------ This List Sponsored by: Cenzic Are you using SPI, Watchfire or WhiteHat? Consider getting clear vision with Cenzic See HOW Now with our 20/20 program! http://www.cenzic.com/c/2020 ------------------------------------------------------------------------
Current thread:
- listening to people/offices when on-hold on the phone Robin Wood (Jun 22)
- Re: listening to people/offices when on-hold on the phone Jarrod Frates (Jun 22)
- Re: listening to people/offices when on-hold on the phone Joel Eusebio (Jun 22)
- Message not available
- Re: listening to people/offices when on-hold on the phone Robin Wood (Jun 24)
- Message not available
- Re: listening to people/offices when on-hold on the phone rajat swarup (Jun 26)
- <Possible follow-ups>
- Re: listening to people/offices when on-hold on the phone ebk_lists (Jun 22)
- Re: listening to people/offices when on-hold on the phone David Gutierrez (Jun 25)