Mark R. Taylor Take no prisoners! http://americantruckersatwar.com AmericanTruckersAtWar Discussion Group http://youtube.com/ironponyexpress --- On Mon, 9/15/08, milford421 [EMAIL PROTECTED] Thanks to Ruthr. Someone's been chatting a lot during the weekend, but picking up FEMA's PBX network as their main carrier might not have been the smartest thing to do. Over 400 calls, lasting from three up to ten minutes were placed through their network, a breach made possible due to an insecurely configured Private Branch Exchange system : "A hacker broke into a Homeland Security Department telephone system over the weekend and racked up about $12,000 in calls to the Middle East and Asia. The hacker made more than 400 calls on a Federal Emergency Management Agency voicemail system in Emmitsburg, Md., on Saturday and Sunday, according to FEMA spokesman Tom Olshanski." Calls were placed to exotic locations such as Afghanistan, Saudi Arabia, India and Yemen, with Sprint originally detecting the compromise and blocking all outgoing long-distance calls from the location. If you're to assume a zero day vulnerability was used in process you'd be wrong as an unpatched vulnerability is just as useful as a zero day one : "At this point it appears a "hole" was left open by the contractor when the voicemail system was being upgraded, Olshanski said. Olshanski did not know who the contractor was or what hole specifically was left open, but he assured the hole has since been closed." With no shortage of vulnerabilities allowing automated reconnaissance for easily exploitable systems to happen, perhaps if you were to assume that you would be targeted "in between" next to being exclusively targeted this wouldn't have happened, as I doubt this phreaker knew he was using FEMA's network in the first place. Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and E-crime incident response. Dancho is also involved in business development, marketing research and competitive intelligence as an independent contractor. He's been an active security blogger since 2007, and maintains a popular security blog sharing real-time threats intelligence data with the rest of the community on a daily basis. http://blogs.zdnet.com/security/?p=1765 August 21st, 2008 FEMA's PBX network hacked, over 400 calls made to the Middle East Posted by Dancho Danchev @ 4:07 am Categories: Hackers, Governments, United States of America Tags: FEMA, DHS, VoIP, Private Branch Exchange, Dancho Danchev Someone's been chatting a lot during the weekend, but picking up FEMA's PBX network as their main carrier might not have been the smartest thing to do. Over 400 calls, lasting from three up to ten minutes were placed through their network, a breach made possible due to an insecurely configured Private Branch Exchange system : "A hacker broke into a Homeland Security Department telephone system over the weekend and racked up about $12,000 in calls to the Middle East and Asia. The hacker made more than 400 calls on a Federal Emergency Management Agency voicemail system in Emmitsburg, Md., on Saturday and Sunday, according to FEMA spokesman Tom Olshanski." Calls were placed to exotic locations such as Afghanistan, Saudi Arabia, India and Yemen, with Sprint originally detecting the compromise and blocking all outgoing long-distance calls from the location. If you're to assume a zero day vulnerability was used in process you'd be wrong as an unpatched vulnerability is just as useful as a zero day one : "At this point it appears a "hole" was left open by the contractor when the voicemail system was being upgraded, Olshanski said. Olshanski did not know who the contractor was or what hole specifically was left open, but he assured the hole has since been closed." With no shortage of vulnerabilities allowing automated reconnaissance for easily exploitable systems to happen, perhaps if you were to assume that you would be targeted "in between" next to being exclusively targeted this wouldn't have happened, as I doubt this phreaker knew he was using FEMA's network in the first place. Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and E-crime incident response. Dancho is also involved in business development, marketing research and competitive intelligence as an independent contractor. He's been an active security blogger since 2007, and maintains a popular security blog sharing real-time threats intelligence data with the rest of the community on a daily basis. --~--~---------~--~----~------------~-------~--~----~ You received this message because you are a member of the "News Sarasota" Google group... To read more, go to: http://www.newssarasota.com http://newssarasotaezine.talkspot.com To hear more, go to: http://thecaptainsamerica.podomatic.com Enjoy the priviledge you now share with others who want to know what others don't... Thanks, Matt Bruce Managing Editor News Sarasota.com Retired 25 Year Fire-Rescue Captain Host Of: "The Captain's AMERICA" Show Heard From 12 noon to 1 PM ET Monday Thru Friday LIVE On Net Talk World.com Across America & Around The Globe At The Speed Of The Internet... Weekend's Overnight on The Accent Radio Network... Check Out: http://thecaptainsamerica.com http://www.nettalkworld.com For more options, visit this group at http://groups.google.com/group/News-Sarasota... To post to this group, send email to [EMAIL PROTECTED] To unsubscribe from this group, send email to [EMAIL PROTECTED] -~----------~----~----~----~------~----~------~--~---
