Vulnerability Development mailing list archives

RE: Verizon Call Intercept


From: "Mike Smith" <msmith () netlocksmith com>
Date: Tue, 28 May 2002 16:22:36 -0700

The Call Intercept service from Verizon (and
possibly others) is supposed to screen callers
that withhold their callerid or don't have one
because they're out of area etc.... A recorded
voice invites them to leave their name, then puts
them on hold while it contacts the number with call
intercept. They either accept the call or they don't.

I tried this service and found it to have a lot of practical problems.

1) It just asks for a name, records whatever they say, then rings through to replay the recording to you.  That means 
(a) there's no guarantee you'll get the person's actual identity; (b) you're still disturbed by the phone ringing; and 
(c) you still have to pick up to find out who it is!  Kinda defeats the whole purpose of the service.

2) Some people mistake the name prompt for an answering machine, so they leave a message, then hang up.  Since they've 
hung up, the call never rings through, and their message isn't saved anywhere.  The caller thinks you got their 
message, but you're unaware they ever called!  I lost out on a job interview once because of this.

Getting back to the security side of things, the service description says it allows the use of a 4-digit PIN to break 
through.  Do we know whether it really enforces the 4-digit length?  Maybe people are choosing null or single-digit 
PINs.  Or perhaps if you choose "0000" as your PIN, mashing the "0" key long enough might be interpreted as 4 0's 
instead of one long one.

If I still had the service, I'd experiment with blue-boxing it or something, but I've already cancelled it for the 
practical reasons mentioned above.

Mike Smith
<www.netlocksmith.com>
 
             


Current thread: