Unlisted Number Address Exploit is still UP -- No Changes by Acceller

[David Farber <dfarber () cs cmu edu>]

Begin forwarded message:

From: Lauren Weinstein <lauren () vortex com>
Date: December 21, 2007 12:05:05 PM EST
To: dave () farber net
Cc: lauren () vortex com
Subject: Unlisted Number Address Exploit is still UP -- No Changes by  
Acceller



Dave,

Just to be clear, so that IP readers don't think that the risks have
suddenly vanished, the Acceller unlisted number address exploit
described in

http://lauren.vortex.com/archive/000347.html

is still up and running fine.  There is no evidence of any changes
by Acceller as of around 0845 PST.

David's report that the number he tried wasn't in the database (if
not present, it will request an address) simply means that one
number isn't included.  I did explicitly note in my discussion that
only landline numbers were present (as far as I know), some
proportion of those numbers were missing, and that some information
was not 100% accurate.  However, reports coming in suggest that my
earlier estimate that about 80% of landline numbers would come up
correctly still seems pretty close to the mark.

I received a particularly telling report this morning from someone
who tested an inbound-only number deep in a rotary hunt group and
had the address come up correctly.  This tends to implicate the ILEC
(that is, the phone company) as the data source in that case at
least.

I will of course report back if I have any evidence of changes in
the operation of Acceller's sites in these respects, but there
is none so far.

--Lauren--
Lauren Weinstein
lauren () vortex com or lauren () pfir org
Tel: +1 (818) 225-2800
http://www.pfir.org/lauren
Co-Founder, PFIR
  - People For Internet Responsibility - http://www.pfir.org
Co-Founder, NNSquad
  - Network Neutrality Squad - http://www.nnsquad.org
Founder, PRIVACY Forum - http://www.vortex.com
Member, ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com




-------------------------------------------
Archives: http://v2.listbox.com/member/archive/247/=now
RSS Feed: http://v2.listbox.com/member/archive/rss/247/
Powered by Listbox: http://www.listbox.com