The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [109]
In terms familiar to people knowledgeable about phone systems, the PBX was connected to a digital telephone service known as a T1, configured as Primary Rate Interface ISDN (integrated services digital network) or PRI ISDN. What this meant was that every time a call was placed from Panda, setup and other call processing information went out over a data channel to the phone company’s switch; the information included the calling party number, which (unless blocked) is delivered to the caller ID device at the receiving end.
Jack’s friend knew how to program the switch so the person receiving the call would see on his caller ID, not the actual phone number at the Panda office, but whatever phone number he had programmed into the switch. This trick works because local phone companies do not bother to validate the calling number received from the customer against the actual phone numbers the customer is paying for.
All Jack Dawkins needed was access to any such telephone service. Happily his friend and sometime partner in crime, Charles Bates, was always glad to lend a helping hand for a nominal fee. On this occasion, Jack and Charles temporarily reprogrammed the company’s telephone switch so that calls from a particular telephone line located on the Panda premises would spoof Victor Martin’s internal telephone number, making the call appear to be coming from within Starbeat Aviation.
The idea that your caller ID can be made to show any number you wish is so little known that it’s seldom questioned. In this case, Linda was happy to fax the requested information to the guy she thought was from PR.
When Jack hung up, Charles reprogrammed his company’s telephone switch, restoring the telephone number to the original settings.
Analyzing the Con
Some companies don’t want customers or vendors to know the telephone numbers of their employees. For example, Ford may decide that calls from their Customer Support Center should show the 800-number for the Center and a name like “Ford Support,” instead of the real direct-dial phone number of each support representative placing a call. Microsoft may want to give their employees the option of telling people their phone number, instead of having everyone they call be able to glance at their caller ID and know their extension. In this way the company is able to maintain the confidentiality of internal numbers.
But this same capability of reprogramming provides a handy tactic for the prankster, bill collector, telemarketer, and, of course, the social engineer.
VARIATION: THE PRESIDENT OF THE UNITED STATES IS CALLING
As co-host of a radio show in Los Angeles called “Darkside of the Internet” on KFI Talk Radio, I worked under the station’s program director. David, one of the most committed and hardworking people I’ve ever met, is very difficult to reach by telephone because he’s so busy. He’s one of those people who doesn’t answer a call unless he sees from the caller ID that it’s someone he needs to talk to.
When I’d phone him, because I have call blocking on my cell phone, he could not tell who was calling and wouldn’t pick up the call. It would roll over to voice mail, and it became very frustrating for me.
I talked over what to do about this with a long-time friend who is the cofounder of a real estate firm that provides office space for high-tech companies. Together we came up with a plan. He had access to his company’s Meridian telephone switch, which gives him the ability to program the calling party number, as described in the previous story. Whenever I needed to reach the program director and couldn’t get a call through, I would ask my friend to program any number of my choosing to appear on the caller ID. Sometimes I’d have him make the call look as if it was coming from David’s office assistant, or sometimes from the holding company that owns the station.
But my favorite was programming the call to appear from David’s own home telephone number, which he always picked up. I’ll give