DefCon Contest Rattles FBI's Nerves 136
snydeq writes "A DefCon contest that invites contestants to trick employees at 30 US corporations into revealing not-so-sensitive data has rattled nerves at the FBI. Chris Hadnagy, who is organizing the contest, also noted concerns from the financial industry, which fears hackers will target personal information. The contest will run for three days, with participants attempting to unearth data from an undisclosed list of about 30 US companies. The contest will take place in a room in the Riviera hotel in Las Vegas furnished with a soundproof booth and a speaker, so an audience can hear the contestants call companies and try to weasel out what data they can get from unwitting employees."
The group organizing the contest has established a strict set of rules to ensure participants don't violate any laws. Update: 07/31 04:45 GMT by S : PCWorld has coverage of one of the day's more successful attacks.
Dumbasses @ FBI (Score:4, Interesting)
What dumbasses at the FBI and in the financial industry:
"The list of target organizations will not include any financial, government, educational, or health care organizations;"
Re:Dumbasses @ FBI (Score:5, Funny)
"Do you have Prince Albert in a can?"
Re: (Score:1)
It's illegal to ask someone their password ??
I mean, I don't see what I'm doing illegal if I call some compagny and ask what is their router password... They are those in the illegality if they give my sensitive data from their compagny no ?
Re: (Score:2)
If you make any false claims at all then it would probably come under wire fraud.
A straightforward "Please tell me your password" probably isn't illegal (IANAL though)
Keep in mind though that false claims would probably include *implied* things as well so even if you speak no word which is not the truth you may still be trying to mislead someone and there's probably laws covering that.
Re: (Score:2)
The definitions of unauthorized access to a computer system vary quite a lot by state, but rest assured, all 50 states have their own laws against accessing a computer system against the owners wishes.
Even if you finagled router logins from a company(*), the courts could find such information does not constitute authorization to use the login to access private data on the network.
*This of course being wildly unlikely, since even if they're open to clients outside the LAN, the only people who would have the
Re: (Score:1)
Hm.. so what happens if a social 'hacker' (after they already obtained credentials) uses social engineering techniques to get "permission" from an employee to login to a router that the employee has no business giving permission for someone to log in to?
"Hi, i'm the networking consultant. I've received a report that internet speeds in your department at company XXXX are slow, and i'm ready to fix that and speed things up. I just need your permission to..........
Re: (Score:2)
Probably depend on weather you really were the networking consultant for their company.
Getting authorization to enter the bank vault from the janitor is fairly meaningless if the janitor hasn't the right to grant that access.
previous I was refering to merely obtaining the info, using the passwords would probably be a different matter.
Re: (Score:2)
Seriously. This is supposed to be a contest, a challenge of information security.
No point in fighting a war of wits with the unarmed.
Re: (Score:2)
Seriously. This is supposed to be a contest, a challenge of information security.
No point in fighting a war of wits with the unarmed.
After reading Kevin Mitnick's "The Art of Deception", I now firmly believe in P.T. Barnum's adage that there is a sucker born every minute. The fact the Fools, Boobs and Idiots were possibly out finessed by some kid/ tween/ teen/ adolescent in information harvesting goes to show you that BA's, MA's and PHD's are probably over-rated. Just like that /. article somewhere else in this compendium states.
Re: (Score:2)
Re: (Score:2)
More educated people might be more likely to be fooled since they "know" they are too smart to fall for any funny business. Nothing like arrogance to blind someone.
Re: (Score:2)
You must be confused. Education does not affect one's ability to not get fooled in the first place, so there's no reason to under-rate it as you do.
True, education does not affect one's ability to be fooled, but experience does.
I have had the pleasure to work with engineers, the first year it was "I'm the engineer" and I say, "I've been working here for the last ten years". The second or third year there seems to be a mutual agreement that we could learn from each other except for the fact that I already knew this. The fourth year seems to be the one that the engineer seeks my input prior to starting a project to ensure that it does not conflict with o
Re: (Score:2)
You don't seriously believe that they were worried about being targeted, do you? Half these people outsource to the same overseas/unregulated call centers, so the same social engineering tricks will work and there's nothing that can be done about it without looking stupid. The other half have employees that are almost certain to fall for social engineering tricks but are "well-connected". In academia, you can kick someone upstairs* in situations like that. In a business, there's rarely an upstairs to kick t
Re: (Score:3, Interesting)
Well then the contest isn't hardly impressive, is it?
Because those are the very places that real black-hats would target, so those are the ones with the measures in place to intercept attempts at social-engineering exploits.
How hard is it to talk your way into a grocery store's customer list?
Re: (Score:2)
We're talking about a bunch of hackers here. When I went to my first Defcon, I was socially ackward as all get out. It would have been fantastic to observe real life social engineering in progress. Given the insane size of convention these days, I'm sure that even if a small fraction of the attendees are like I was, that's a few hundred people who would be interested in a social engineering demonstration. Hell, that they can even setup a soundproof booth to do the exhibition in the first place is a testi
Re: (Score:2)
We're talking about a bunch of hackers here. When I went to my first Defcon, I was socially ackward as all get out.
Ah, so you fit right in.
Re: (Score:2)
Damn straight. I was so lame that I got up and walked out of Mark Ludwig's presentation on virii and polymorphism.
Re: (Score:3, Interesting)
Because those are the very places that real black-hats would target, so those are the ones with the measures in place to intercept attempts at social-engineering exploits.
I work at one of those places, and I gotta say... those "measures" aren't as stringent as I'd like them to be. That is to say - we get employee training (CBT) once a year to refresh our knowledge of various procedures, and it touches briefly on social engineering (a single slide).
Now - I'm in the IS department, so it may be that those in lending ops, etc have a different story. For us the "measures" in place rely solely on the common sense of each employee.
Scary, isn't it?
Re: (Score:2, Interesting)
Re: (Score:2)
I'm actually surprised how easily security has been compromised, if employees are subjected to cock & ball torture to "refresh" their knowledge of proper procedures. I wouldn't forget in a hurry.
Re: (Score:2)
Re: (Score:3, Insightful)
Unfortunately - yes! Hide the head in the sand, that seems to be the answer nowadays for any- and everything? For a long time, excuse me - started in 60's, I was either responsible of or designing systems and infrastructures for safe and secure, often global environments - can't say that they were perfect, nothing ever is. Time to time (often) the hired security testing groups / companies were able to find some problems, even if documents in wastebaskets - in IT(?) which should have known better, but the ma
Re: (Score:2)
What dumbasses at the FBI and in the financial industry:
"The list of target organizations will not include any financial, government, educational, or health care organizations;"
Why? Because the division at the FBI responsible for cyber crimes asks what they plan to do? And then is satisfied by the answer?
I hope they also send an agent to learn and take back ideas on what works to help companies avoid issues.
This is refreshing (Score:5, Insightful)
It's nice to see the hacker community making a move to acknowledge its roots. Social engineering is the oldest and easily the most challenging/rewarding form of real hacking.
What's more gratifying, beating the password out of a hash after weeks of brute force or having the mark just tell you in a five-minute phone call?
Re: (Score:3, Funny)
Re: (Score:2)
You forgot to tell me to get off your lawn, old timer. :P
Re:This is refreshing (Score:5, Funny)
I prefer to beat the password out of the mark after 5 minutes of brute force.
Re: (Score:3, Informative)
http://xkcd.com/538/ [xkcd.com]
That is all.
Re: (Score:2)
Ah yes, rubber hose decryption. Effective but not for the faint of heart.
Re: (Score:2)
Whoosh.
GP was referencing an XKCD page, involving a few cheap hardware tools, as opposed to expensive "brute force" password cracking.
Re: (Score:2)
uhhhh uhhh whoosh xkcd *farts* *sniff sniff*
Hi! Welcome to Slashdot!
Re: (Score:2)
Wow, the population of grim humourless dicks on slashdot seems to have expanded considerably these last few months.
Re: (Score:2)
Re: (Score:2)
"Try being an individual if you manage to find the guts. Until then, be comforted by your membership in another group you've not yet recognized, for the population of cowards like you has remained roughly the same."
says an Anonymous Coward.
Re: (Score:2)
If you really don't see the irony in that I guess my original assertion was correct.
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
It's nice to see the hacker community making a move to acknowledge its roots. Social engineering is the oldest and easily the most challenging/rewarding form of real hacking.
What's more gratifying, beating the password out of a hash after weeks of brute force or having the mark just tell you in a five-minute phone call?
Wait until the Chinese (or name your ethnic group here) get a load of this. The sophistication of the American haxorz is limited by the human languages they speak.
Okay, be honest. (Score:5, Funny)
Who here clicked the link to www.social-engineer.org before thinking about the potential consequences?
Have you just been had? :-)
Re: (Score:2)
Very close, actually.
Re: (Score:2)
You mean "who read TFA"?
This is slashdot. Presumably there are some things they don't teach at hacking school.
Rules and Do-Not-Do list (Score:5, Informative)
The CTF Rules
Each Social Engineer is sent via email a dossier with the name and URL of their target company chosen from the pool of submitted names.
Pre-Defcon you are allowed to gather any type of information you can glean from the WWW, their websites, Google searches and by using other passive information gathering techniques. You are prohibited from calling, emailing or contacting the company in any way before the Defcon event. We will be monitoring this and points will be deducted for "cheating".
The goal is to gather points for the information obtained and plan a realistic and appropriate attack vector. The point system will be revealed during the Defcon event. All information should be stored in a professional looking report. 1 week prior to Defcon you will submit your dossiers for review to the judging panel.
They will be sent their time slot (day/time) to perform their attack vector at Defcon. At Defcon each social engineer will be given 5 minutes to explain to the crowd what they did and what their attack vector is.
They are then given 20 minutes to perform their attack vector and points are awarded for information gathered as well as goals successfully accomplished during the process.
A scoreboard will be kept and at the end some excellent prizes will be awarded.
The Flag
The "flag" is custom list of specific bits of information, which you will have to discover during your 20-minute phone call.The judging panel created the list, and points will be awarded for each item present on the list. This list will be presented to you on the day of the event
THE DO NOT LIST:
Underlying idea of this contest is: No one gets victimized in the duration of this contest. Social Engineering skills can be demonstrated without engaging in unethical activities. The contest focuses on the skills of the contestant, not who does the most damage.
Items that are not allowed to be targeted at any point of the contest:
1) No going after very confidential data. (i.e. SS#, Credit Card Numbers, etc). No Illegal Data
2) Nothing that can get Social-Engineer.org, Defcon, or the participants in the contest sued
3) No porn
4) At no point are any techniques allowed to be used that would make a target feel as if they are "at risk" in any manner. (ie. "We have reason to believe that your account has been compromised.")
5) No targeting information such as passwords.
6) No pretexts that would appear to be any manner of government agency, law enforcement, or legally liable entity.
7) The social engineer must only call the target company, not relatives or family of any employee
8) Use common sense, if something seems unethical - don't do it. If you have questions, ask a judge
If at any point in the contest it appears that contestants are targeting anything on the "No" list, they will receive one warning. After the one warning they are disqualified from the contest.
Re: (Score:3, Insightful)
If they aren't going after confidential data, then what exactly is the point here? What I mean is, why would a company care about non-sensitive data, so what protections/security/whatever are they supposedly penetrating here?
Re:Rules and Do-Not-Do list (Score:5, Insightful)
Not everything needs to be about obtaining damaging information. Imagine talking to a random stranger and trying to solicit information from them. It's not as easy as it sounds.
Seriously, try this some time, just go up to a stranger and get their middle name. It will be harder than you think in most cases, if not impossible.
Social Engineering is a skill. You have to be very good to go under the "what the fuck does this guy want" radar. You have to be able to read people without seeing them and be able to think very quickly in a very dynamic situation. Again, all while staying under their radar.
Getting confidential, personally sensitive, or business critical information isn't the point nor appears to be the goal. Merely being good with your social skills (and we're talking a special breed of nerds here, no offense to them though), no great with them, is the point. Having a laundry list of weird and/or "not normally given out" information and trying to gain it, that's going to be hard.
Re: (Score:2)
"Excuse me sir, what is your middle name?"
Re:Rules and Do-Not-Do list (Score:4, Insightful)
[ignores you like a homeless guy asking for a dollar for more booze and walks away]
Good try.
"Excuse me sir, I'm with the [state] joint anticrime taskforce." [flashes official looking id printed up not long before] "We're performing random checks on the citizens in this area. May I see a photo ID?"
[citizen hands him his drivers license].
"Thank you Mr " [reads last name from ID] ". We've already had several instances today where criminals have attempted to run when asked for their identification. Have a wonderful day. We appreciate your cooperation."
His middle name was Henry. He was born October 28, 1955.
I know, in the game you're not allowed to pretend to be from a government agency. It just made this easier. If you're digging for personal information, you just have to craft "who" you are to be something where they'd want to hand over the information without asking too many questions.
Re: (Score:2)
Re: (Score:2)
I noticed on the list that they didn't say medical was out of the question. "Hi - we're calling from [insert local hospital name]. There's nothing to be alarmed about - just a minor computer glitch - we have two entries with the same first and last names. Have you ever seen Dr. [insert bogus doctor] in emergency? You're not sure? How about doctor [insert another] in the past two weeks? No. Thank you. To prevent any future problems, I'm going to enter your full name into the computer system - just remembe
Re: (Score:2)
That works on the assumption that he's been to the local hospital. I haven't been to a hospital as a patient in about 10 years. That was for a car accident (that I still hurt from). Even knowing that, and the city I live in, there are about a dozen hospitals that I could have gone to. But the general idea would work, it just needs some tuning. A (fake) common billing provider for the local hospitals may work. It doesn't have to be the real billing provider. Most of us don't know who us
Re: (Score:2)
Re: (Score:2)
Yup, my pre-existing condition isn't something I try to hide. If I were to ever file a workers comp claim, I know their insurance minions would be all over my history, checking every database in existence. It's not hard. My auto and health insurance both show it. The doctors records show it. My prescription history at the pharmacy shows it. Regardless of how protected HIPAA data is suppose to be, folks seem to get a hold of it somehow.
My injuries are well documented, so it'
Re: (Score:2)
Re: (Score:2)
My driver's license doesn't have my middle name printed on it, just the initial.
Re: (Score:1)
They don't have middle names here in Japan! NOW WHAT?!
Re: (Score:2)
I don't think you get my point.
If I'm sitting on the bus and you sit down near me and say hello, I'll go ahead and say hello back. If you then comment about the weather I'll respond about the weather. We can have a nice conversation about a local sports team, you might ask me if I was at the game yesterday and I'll tell you no, I wasn't. You can go ahead and pat yourself on the back about extracting that information with your mad social engineering skills, but the reality is all you've done is be part of no
Re: (Score:2)
I do understand you and I'm sorry your imagination isn't able to come up with scenarios where there could be information that people normally wouldn't give out that also wouldn't be considered sensitive.
What version of MS/Open Office are you running?
Who do you use for offsite backup?
Who supplies your cat5e/6 cable?
Try cold calling a business and getting one of those answered let alone all 3. The "wtf are you asking for" alarm will go off insanely fast. So now you have to come up with a scenario where yo
Re: (Score:2)
Sorry. No matter how much you want to wiggle around, you don't get to tell me what I consider secret.
(And if you've never received a call asking those questions, then you obviously don't actually work in IT. Getting a call from a salesman asking about your current sources isn't that uncommon and it's not secret.)
Re: (Score:2)
I sit on th
Re: (Score:2)
First, you have an elaborate fantasy life.
Second:
What makes you think you know two things? Maybe you know ten things:
3. I have nothing to hide, but I think you're cute and am planning on giving you a hard rogering after we've had dinner.
4. I have nothing to hide, but you've threatened my family and I am planning on stabbing you in the eye socket with a steak knife at t
Re: (Score:2)
Because this exercise, conducted WITH OUT ethical stops, would lead to compromised internal data.
Re:Rules and Do-Not-Do list (Score:4, Interesting)
what if that info just comes out? like the other s (Score:2)
what if that info just comes out? like the other side just start saying it all or some act's like a VP that need help and some one just gives them way to much info?
Re: (Score:2)
Wait back up to the part where the organisers can detect wrongdoing before the contest starts because "we will be monitoring this." How?
Re: (Score:2)
Doesn't this cover everything?
I've heard it said many times that you can be sued for anything.
"Nothing that can get Social-Engineer.org, Defcon, or the participants in the contest sued"
The companies could sue for their feelings being hurt, they could sue for damage to their reputation, they could sue for the wasted time of their employee, they could sue the organizer for being ugly, they could sue for the sky being blue.
Now weather they'd win for some of those things is a different matter.
Re: (Score:1)
Re: (Score:2)
No mention of not being able to use LinkedIn. Awesome.
Cached Versions (Score:1)
If they go to my bank... (Score:1)
Re:If they go to my bank... (Score:4, Insightful)
And yet you continue to do business with them. It's pretty obvious why they don't have to do much.
Re:If they go to my bank... (Score:4, Interesting)
Sometimes that info comes from places you'd rather it not. I got a letter a couple years ago from the VA (United States Veterans Affairs). I was in the military for about a month, almost 20 years ago. (It was a preexisting disqualifying medical condition, for anyone who really wonders.) They sent it to a friends house where I frequently got mail. It stated that my personal information may have been compromised due to a breach of the VA computers. I had seen the news story about it about a month before and didn't think it would apply to me. It's so comforting that I was in a system I shouldn't have been in, and they lost my information to unknown parties, who could be doing almost anything with it. Since they knew a valid address for me, nowhere near where I lived when they collected the data, I have to assume they kept addresses updated from another source.
Ya, I'd rather not do business with the VA, but apparently they know about me.
Sometimes I wonder about banks that I've done business with in the past. Some have closed and merged so many times, I have no clue who they are now. A friend of mine got a nasty letter from a bank a couple years ago. He had closed his account with them over 20 years before that. Apparently when they merged with other banks, to fluff their "account holders" numbers, they reopened closed accounts. After the mergers, they started assessing fees to the accounts. He was now on the hook for all kinds of fees they assessed the closed account plus interest. When he tried to straighten it out, the bank couldn't find the record, other than the fact that he owed the money. He still gets calls from collections every once in a while asking for the money.
Re: (Score:1)
lol
Not-so-sensitive?! (Score:4, Funny)
"If you don't tell me, I'll look at the dumpster behind your building and read the name on it!"
Re: (Score:2)
yeah exactly!
And how hard is it to get an operator job in a call-center?
If someone really wants information low-paid operators have access too, how about getting a job there and have access to whatever you like?
It's more risky if they know who you are and are physically on site, not to mention a lot more time consuming.
I feel sorry (Score:5, Insightful)
I feel sorry for the poor fish in the barrel that gets shot on this one.
Unwittingly, right now, some guy/gal is sitting in their cubical and is on the cusp of getting the phone call that thrusts them into the international spotlight when the tape of the winning team's efforts is played. They might even lose their job for doing nothing more than, well, doing their job, or answering a harmless set of questions.
Re: (Score:2)
I also feel sorry for the poor fish in the barrel. What would be interesting to monitor is how far up the management chain the sh*t flies.
In a more perfect world, those that succumb to social engineering would then have their bosses/supervisors subjected to the same social engineering, and if they fail, their bosses/supervisors would then be subjected to social engineering....
Re: (Score:3, Interesting)
Re: (Score:2)
... that boss might be smart enough...
Isn't that a bit of an oxymoron?
*ducks*
Re: (Score:2)
They might even lose their job for doing nothing more than, well, doing their job, or answering a harmless set of questions.
If they lose their job for doing their job, then they can lose their job for doing their job any old time, not just if they are used to win this contest. What is far more likely is that they will lose their job for doing something they thought was their job: giving away information they are not really supposed to. And they should lose their job in this instance. It does not matter if someone is trying to fool them, or if they are just idiots. If they can't do the job, then they need to not have it.
rattles FBI nerves... (Score:1)
they probably set the whole thing up so they could document the attempts rather than dream them up on their own so they could develop a counter procedure policy.
Re: (Score:2)
Careful, that creaking sound that comes from your chair isn't actually a creak.. The gubment put a listening device in it and sometimes you hear feedback from their end. In fact, that's how you can tell it's a new version of the bug. They can whisper suggestive things to you as a form of mild brainwashing. I mean, really, your libido isn't that great, they're just failing to get you to go to the kiddie porn sites. Sadly they only keep catching you viewing the granny porn.
Shhhh!
No, this is good (Score:4, Insightful)
Re: (Score:2)
- They decided to "increase security" by forcing people to use stronger passwords and to change their
I can verify this (Score:5, Informative)
Posting as AC for obvious reasons, and I can't offer anything in the way of proof (again, for obvious reasons) but I do work for the US Navy in a division that deals with intelligence. We've been getting floods of emails from up on high warning us about Defcon "threats" and that we shouldn't answer any questions from people who call us that we don't know, etc etc.
Re: (Score:3, Insightful)
Wait, so what do the higher-ups expect you do on ordinary days when Defcon isn't running? Be less vigilant and answer any and all questions posed? What silly advice. What's a good precaution in the week of Defcon should be good *all*of*the*time*.
All they're really trying to avoid is potential embarrassment if something gets in the news.
Re:I can verify this (Score:5, Insightful)
That doesn't mean it's not worth occasionally reiterating, especially when there's a specific reason to believe there may be an increased chance of something happening.
It's not like they're spending millions of dollars to defend it or something, just sending a few emails.
Re: (Score:2)
"we shouldn't answer any questions from people who call us that we don't know, etc etc."
Yeah, I never get a virus because I open only mails from my friends.
Re: (Score:2)
It's funny because if your higher-ups had actually read the rules that Defcon posted (you know, done a bit of research), they would have realized that the military is not being targeted. If anyone gets a call pumping them for personal information, it's not going to be due to this defcon event.
Re: (Score:2)
Nice try. Next time make your social engineering more subtle.
The information they want is almost too innocuous. (Score:3, Funny)
1.) Get a list of past DefCon attendees from the company.
2.) Find prior attendees NOT attending the current DefCon.
3.) Call those prior attendees up and say "DefCon this year is doing a social engineering CTF, can you help me out by providing some silly and innocuous data about your company/building?"
This could work surprisingly well, so long as you got somebody willing to play along and help you "cheat."
In fact, this approach (or something similar) would probably be so common and so effective that there might be a rule added against it.
What would be particularly funny is if you didn't actually check if they were attending this year, and the "victim" was sitting in the audience!
Re: (Score:1, Offtopic)
I haven't been to a Defcon yet. Shit always comes up. But, don't they still take cash at the door? Do you have to provide a photo ID? I've been to several conventions where I observed the people ahead of me and when they don't ask for an ID, I just give a fake name and pay cash. I used to have a bunch of ID badges for "JW Smythe" hanging on my office wall (when I had an office) from various places. I don't feel it's necessary for every schmuck in the world to know who I really am.
ahem... (Score:3, Insightful)
"The group organizing the contest has established a strict set of rules to ensure participants don't violate any laws. "
I think what REALLY scares these guys (the Feds and the Banks) is that they know damn well that MOST hackers out there do not limit themselves with any silly, self-imposed rules.
Just imagine what the contestants could do without legality/illegality issues hindering them. Anything learned here will simply be repeated, by someone, with no such hindrances in place.
Can they spoof CallerID? (Score:4, Interesting)
On my desk phone at work, if someone calls from their desk or a number that is currently listed in the directory, their name and number shows up on the display. It's pretty obvious if someone calls up from an outside line. Now if the contestant is allowed to try to spoof my company's phone system into thinking they are from say, HR, more power to them..
Re: (Score:3, Informative)
The usual approach is to call someone pretty much at random, and ask to be transferred to the real target. That person then sees an internal number (typically of someone they don't know) calling them and to some degree lets their guard down.
Re: (Score:3, Informative)
Usually it's not that tough to get info. I always maintained an East coast US phone number, regardless of where I was working. I was always doing work things from my cell phone, like dealing with datacenter folks.
Sometimes in the course of normal work, I'd need to acquire access for a coworker to a site. My name was usually listed as a person authorized to make account changes. If it wasn't, I knew the people who would be. A few times, I called as the owner of the company,
Re: (Score:2)
Ya, I didn't go out looking for any samples of his emails to use. I know even as verbose as I usually am, if I'm just sending a note over to HR saying we've hired someone, that could be a one-liner. I don't know how many people he hand picked back in the day, but if I remember their (MS) structure right now, he doesn't even have a hand in that. I suppose it could happen, but it would probably be more of an email to a department manager saying "I want this guy working here. Interview and
Re: (Score:2)
It's trivial to spoof caller ID in the U.S. Heck, at work our ISDN provider gladly accepts any 10 digit calling party number we feel like providing them. This is the prime reason why you DON'T want to enable pin-less calling from your "home" number, when using calling card services.
Pin-less calling means that the calling card system uses caller ID to bypass the pin. At one point I made a bet with a friend, that I can pick any popular calling card access number, random 10k numbers from a 1M+ metro area area
Re: (Score:2)
Is this what the cyberczar wants? (Score:3, Insightful)
Just the other day we had a submission about how we aren't prepared for the "cyberwarz" because we can't get people who knows this sort of stuff, or thinks along these lines.
Well, damn, seems to me this would be a great excerise for the fbi/ hls, and whoever else to see about hiring/training peeps for those sort of jobs.
Of course, that makes sense and wouldn't be used.
Re: (Score:1)