NetNews Usenet Archive 1993 #3/NN_1993_3.iso/spool/comp/dcom/modems/19867

Internet Message Format | 1993-01-23 | 3.7 KB

Xref: sparky comp.dcom.modems:19867 alt.security:5354
Path: sparky!uunet!elroy.jpl.nasa.gov!sdd.hp.com!saimiri.primate.wisc.edu!caen!uwm.edu!ogicse!verdix!islabs!fasttech!zeke
From: [e-mail] (Bohdan Tashchuk)
Newsgroups: comp.dcom.modems,alt.security
Subject: three way calling gives security (Was: Caller ID products?)
Message-ID: <[e-mail]>
Date: 22 Jan 93 23:29:00 GMT
Article-I.D.: fasttech.1993Jan22.232900.14950
References: <[e-mail]>
Organization: Fast Technology   Beaverton, OR
Lines: 63

>If one is not interested in security then one wouldn't try to use a
>dial-back modem to that end.  If someone is using a dial-back modem that
>dials back on the same line then one is fooling themselves.  There
>isn't any added security over the case were one just adds another
>password to the login process.

>>  Callback makes it *harder* to get access to a system, not impossible.

>Dial-back is just a bandaid for modems.

>>It keeps the person who gets a number and password from getting in.
>>It means the cracker needs more info and expertise to get access.

>They already have the number.  There is no added info needed.  Its the
>same one that they just called.  They just have to call back.  The
>added password is a benefit however.  One can get the added password
>without the dial-back baggage.

There CAN be a lot of added security.

You just use a trick I read about on the net a long time ago. I've posted it a
number of times since, as well.

The answer is THREE WAY CALLING. Not call waiting. Three way calling by itself.
In most phone systems with direct lines (ie, no local PBX in the way), you are
guaranteed that even if a hacker keeps calling back, he can't spoof you.

What you do is go offhook, wait for dialtone, then flash the hook, then wait
for a second dialtone. In a Telebit WorldBlazer for example, the ! operator
will flash the hook. Because of the way the phone company switch works, it
it won't give you a second incoming call after you flash the hook. Note that
if you had call waiting, that would be a whole different situation, since you
then could potentially get two simultaneous incoming calls.

The hook flash is out-of-band to any incoming caller. He has no way of
preventing it. The first dialtone you get might be a hacker spoofing you,
but not the second dialtone.

So, now that you have a dialtone you KNOW is provided by the phone company,
you can dial whatever number you want. Eg, when you do a callback to an
employee's house, you KNOW it's the employee's modem that answers, and NOT
the hacker's modem. A hacker would have to patch into the phone wires outside
of an employee's house in order to intercept the callback. The same applies to
uucp connections as well.

Of course, this doesn't work for employees calling in on business trips, but
there are different methods of giving employees access in that case. For
example, having them dial local packet switching network numbers and then
telnetting in via TCP/IP ports.

Three way calling allows callback to provide much better security than your
post implied. But I personally haven't had any problems with hackers, and so
haven't found it necessary to pay the extra $$$'s each month. So I don't know
if the dialback feature of the WorldBlazer is flexible enough to do this hook
flash stuff by itself, or if an external getty-like program would be required.

This same trick applies whether or not you dial out on the same or different
line as people dial in to. If someone finds out the phone numbers of your
outgoing lines, they can spoof you unless you do something like this or get
the phone company to block incoming calls.

--
Bohdan              The Clinton Administration -- America Held Hostage -- Day 3