Welcome, Guest. Please Login or Register
SAYNOTO0870.COM

<---- Back to main website

 
Home Help Search Login Register

Page Index Toggle Pages: 1
Send Topic Print
VOIP 'Call-Jacking' Hack Unleashed (Read 2,944 times)
mikeinnc
Full Member
***
Offline


Ofcom - quis custodiet
ipsos custodes?

Posts: 225
Perth Western Australia
Gender: male
VOIP 'Call-Jacking' Hack Unleashed
Jan 24th, 2008 at 4:51am
 
Quote:
Now there's a way for attackers to hijack a user's voice-over-IP service: "call-jacking" could let the bad guys launch sophisticated phishing attacks as well as perpetrate lucrative toll fraud.

Researchers from the hacker group GNUCitizen have released a proof-of-concept for call-jacking via a BT Home Hub user's router. The attack exploits cross-site request forgery (CSRF) and authentication bypass vulnerabilities in the router that were previously discovered by the researchers. The attack works even if the default password in the router has been changed.

"We believe that this technique, which we coined as 'call jacking,' is completely new. There is nothing like this in the public domain as far as we know," says Adrian Pastor, a senior IT security consultant for an unnamed penetrating testing firm in London. "The beauty of the attack is that the victim user thinks he/she is receiving a phone call, but in fact he/she is making the phone call and paying for it. We find this quite innovative and unique, hence the need for coining a new term."

The exploit could be used in a phishing attack, where the victim would get a phone call from his "bank" after clicking a link in a phishing email. Phishers typically don't know their victims' phone numbers, he says, so the phone call would help the attacker appear legitimate and gain the victim's trust.

Another attack scenario involves toll fraud, where the victim's router would be forced to dial a toll number. "Premium numbers are very expensive, and allow the identity who registered them -- in this case, the attackers -- make money every time someone dials them," Pastor says.

And the catch with call-jacking is that the victim thinks he or she is receiving a phone call, Pastor says. The victim's phone rings and shows an "incoming" call on the screen -- but his phone instead is actually dialing out to that number.

Pastor and his fellow researcher on the project, Petko D. Petkov, tested the POC on BT Home Hub 6.2.6.B, but expect other versions to be vulnerable as well. Only BT customers using the BT Broadband Talk service are at risk, they say. BT Home Hub is one of the more popular home routers in the U.K.


http://www.darkreading.com/document.asp?doc_id=143828&f_src=drdaily

Oh great! Another scam involving the fantastically useful 08xx premium numbers in the UK.   Angry

Back to top
 
 
IP Logged
 
reggie
Full Member
***
Offline



Posts: 199
Re: VOIP 'Call-Jacking' Hack Unleashed
Reply #1 - Jan 25th, 2008 at 10:10am
 
Please for the benefit of those of us who are not familiar with phone jargon cold you please explain in plain and simple English what this is all about

"Researchers from the hacker group GNUCitizen have released a proof-of-concept for call-jacking via a BT Home Hub user's router. The attack exploits cross-site request forgery (CSRF) and authentication bypass vulnerabilities in the router that were previously discovered by the researchers. The attack works even if the default password in the router has been changed."
I'm sure that I'm not the only one who finds the above paragraph incomprehensible
Back to top
 
 
IP Logged
 
irrelevant
Senior Member
****
Offline



Posts: 409
Re: VOIP 'Call-Jacking' Hack Unleashed
Reply #2 - Jan 25th, 2008 at 6:26pm
 
Without knowing anything specific about this, but knowing a little about the technology, it looks to me as if they can embed a link in an email that appears like a "call me" type link, but actually instructs your BT Home Hub (with integrated voip service) to phone them and connect the call to your handset (so it rings, making you think it's an incoming call.)
Back to top
 
 
IP Logged
 
Page Index Toggle Pages: 1
Send Topic Print
(Moderators: Dave, CJT-80, Forum Admin, DaveM, bbb_uk)

Website and Content © 1999-2024 SAYNOTO0870.COM. All Rights Reserved.
Written permission is required to duplicate any of the content within this site.

WARNING: This is an open forum, posts are NOT endorsed by SAYNOTO0870.COM,
please exercise due caution when acting on any info from here.


SAYNOTO0870.COM » Powered by YaBB 2.5.2!
YaBB Forum Software © 2000-2024. All Rights Reserved.


Valid RSS Valid XHTML Valid CSS Powered by Perl Source Forge