Vulnerability Development mailing list archives

RE: Phone Switches + telephone banking etc


From: ash <ashcrow () phreaker net>
Date: 07 Jun 2002 14:00:50 -0400

Cordless phone can be picked up by scanners. Of course it does depend on
model and make. For instance, V-Tech phone are usually the simplest to
pick up since so many people have them and they use the same bands
defaultly. The only part that can be tough about scanning cordless
phones is when they make jumps to other channels (a lot of 800mhz +
phones do this). You just have to keep on with it and find the new
jumped channel which can usually be found with research on the phone
type.

Of course, things might be a bit diffrent in the UK.

Cheers,
Ash

I was thinking today about phone switches, many of them are 
connected to
the internal LAN. Many of them record all the keystrokes made by the
individual phones (this is the important bit). If one could 
compromise a
phone switch (or where ever it stores it's logs) then making 
free calls
would be a minor issue. The prize in this situation could be 
who phoned
what bank and if you can get the key presses then if that person has
used the automated telephone banking service, you will have ( at a
minimum):

 the account number 
 sort code
 any verification number


has any one done any work in this area ?

I know many banks ( at least in the UK) will say not to use their
service through cordless phones, maybe they should increase to include
corporate phone switches.



Q
 
-- 
#####################
Quentyn Taylor
Sysadmin - Fotango
#####################
RFC 882 put the dot in .com.




Current thread: