4 ms·
This article is making all sorts of illogical conclusions from the stories it's telling. First, how was the company hacked "through their corporate phone syste
by fpgaminer 12y ago
This article is making all sorts of illogical conclusions from the stories it's telling. First, how was the company hacked "through their corporate phone system"? They were hacked through social engineering and malware. The phone network was just used for reconnaissance. I'm sure hackers have been mining phone networks for decades. Not that this story isn't interesting, but the conclusion doesn't lead from the tale.
Second, how does he know the bank's phone system was compromised, just because he couldn't reach it? I'm no expert on phone systems, but it seems like any number of other possibilities are at play here. Like, the bank's phone system actually being down and the call minion he talked to not being in a position to know anything about it (common). Or maybe the call center was up, but it was inaccessible for a brief period of time. I can't imagine phone systems are very reliable. Again, an unsubstantiated conclusion.
Third, he also concludes the bank's records were compromised, leaking his phone number. I get fake calls from "banks" a few times per year, even ones with the right names. I see no reason to assume the bank's records have been compromised, just because you coincidentally got a fake call with your bank's name. Either it was coincidence that the name matched his current bank, or the information leaked through the usual means (bank selling your information to third-parties, who turn out to be unscrupulous or have their information stolen; or any retailer you've used your banks credit/debit card at selling your information).
Fourth, how does any of this lead to the conclusion that "[w]e’ve lost control of our phone network"? These were all typical phracker activities that have been occurring for decades.
And finally, the mention of the Do Not Call list is also a non sequitur. It's only loosely related to what the author previously mentioned.
I'm all for being security aware, but I'm not seeing the story here. In my honest opinion, this looks like a big pile of FUD with no useful substance and it surprises me that it's on the HN front page right now.
- dubwubz 12y agoThat depends on the phone system. Asterisk isn't particularly reliable; it actually crashes at 100 concurrent calls. If you're talking about a good CO switch like a 5ESS or DMS-100, they're extremely reliable, well engineered machines. They consistently meet and exceed five nines reliability.
- MichaelGG 12y agoNot that I have any love for Asterisk, but modern versions can handle that load. As can FreeSWITCH despite its... interesting... threading model, as can OpenSIPS. On top of that, who cares what a single process can run? It's better to run one per core anyways. I had several servers, each running several FS instances and scaling wasn't really an issue. I even ran a 5 nines 9-1-1 service off Asterisk, as embarrassing as that is. We missed one call in 18 months during a hard maintenance cutover, but handled it manually, but of course it was only one part and relied on the rest of the PSTN. With a SIP proxy in an HA setup, almost surely the biggest downtime is going to be operator error or IP connectivity issues. Or someone changing their signalling subtly, but OTOH 5ESS and DMS aren't totally identical in behavior either. (Though fair enough, the "software" guys haven't shown the same uptimes, overall, as the old style switching, true.)
- kimi 12y agoThis is a myth. One single Asterisk instance may handle 200-500 calls nowadays, but if you cluster them, you may grow carrier-size networks out of them. There are a number of large scale Asterisk deployments that handle tens of thousands of parallel calls with carrier-grade reliability.