AT&T Concerned About H2K2

An anonymous submitter forwards this possibly-authentic note about today's H2K2 conference. If you're in the New York area and you love computers and nice hotels, come on down. Anonymous writes "So I get into work, and what do I find in my mailbox? Why, nothing less than a warning cautioning me to be very careful talking to people from July 12 to July 14. (Not me specifically, you understand, it went out all over). Full text follows."

****************************************************************
AT&T Network Fraud Advisory
July 11, 2002
****************************************************************
Possible Hacker Social Engineering Attempts
Friday July 12 - Sunday July
14, 2002
===================================================
Caution:
------------
Be careful about giving information to anyone you don't know and those making unusual information requests by claiming to be an AT&T employee or customer. The H2K2 (Hackers on Planet Earth 2002) Hacker Conference will take place this weekend, Friday, July 12 to Sunday to July 14, 2001, [ed. note: 2001?] in New York City. This conference will be a gathering of over five thousand computer hackers, guest speakers, and computer enthusiasts. http://www.h2k2.net In 1994, 1997 and 2000 at the previous Hope (Hackers on Planet Earth) Conferences, live demonstrations of "social engineering" techniques were performed in front of thousands of hackers and other attendees. The hacker panel dialed live into AT&T offices and centers and demonstrated how to get proprietary information by pretending to be an AT&T employee and customer. These calls were recorded and videotaped by the hackers and are sold as instructional material at future hacker conferences. There is a very high likelihood that AT&T will be a target again this weekend. The social engineering contest is scheduled for Sunday July 14th, at 4 P.M. ET, (1 PM PT). During this period hackers may be dialing into AT&T to get information. AT&T Network Security would like to warn our employees to be on guard this entire weekend for any unknown person calling and claiming to be an AT&T employee to request proprietary information or claiming to be an AT&T customer with unusual requests. Remember, if anyone, who is unknown to you calls for proprietary information or make unusual requests, please follow your procedure by requesting additional information to ensure the person is who they say they are before giving out any information. If the person is claiming to be an AT&T employee, please request name, callback and HRID #. Then verify through POST or the email global address list if the information is correct and even request to call the employee back at their contact number. If the person is claiming to be an AT&T customer verify this by requesting additional info on their account like address and SS# and even request to call the person back at their contact number listed on the account. Please be on guard for any unusual requests. Verify the person is an AT&T employee or a legitimate customer and if they have a need to know the information they are asking. If you can't verify employment or number, don't give out the information. If you are still in doubt regarding the legitimacy of the caller, then speak to a supervisor regarding the situation before proceeding further and inform the caller you will call them back. If you still have questions you can call the Security Hotline [phone]. Remember you do not want to be the lucky guest of honor on a telephone call from the hacker conference this weekend with thousands of hackers listening to you and attempting to scam AT&T out of proprietary information. Please be on guard.
- - - - - - - - - - - - - - - - - - - - - - - - -
Source: AT&T Network Security
*******************************************************************

So?

[Sc00ter]

Given the type of people that go to H2K2 this seems like a good idea. Just trying to get people that might not have a clue a heads up as to what's going on. Sure, not EVERYBODY at H2K2 does these type of activities, but there will be a large number of Skr1p7 K1dd13z out there that will, and people should be prepaired.

Re:So?

[An IPv6 obsessed guy]

I agree that this is a prudent move. Really, though, don't you think folks should be on guard for this type of thing, say, always?

Re:So?

[darkfrog]

not EVERYBODY at H2K2 does these type of activities, but there will be a large number of Skr1p7 K1dd13z out there that will, and people should be prepaired.

Am I the only one that gets tired of the skript kiddie buzz word? I guess it's no longer used for skript kiddies, but for anything someone else doesn't appreciate.


Soon we'll have people saying... "Damn Skr1p7 K1dd13z with assault riffles and bullet proof vests came into my house today andd seized all my computer equipment, allong with any other electric device (phone, paper shredder, refrigerator, disposal) for evidence."

hehe

A script kiddie has NOTHING to do with social engineering! Learn a new buzzword.

Re:So?

[Mtgman]

A script kiddie has NOTHING to do with social engineering! Learn a new buzzword.

I disagree. If you read the memo you'd have seen that the point of these seminars is to produce material that, for lack of a better word, can be used to train people to execute social engineering attacks. A HOWTO of sorts. I can easily make the comparison between such a group of published materials and a rootkit. In both cases the "1337" hacker is just following a script.

Luckily, with humans on both sides there is much more chance for a screwup or someone being caught.

So I think the script kiddies analogy is accurate, in both cases it's someone who would not have been able to design these attacks themselves using how-to kits to comprimise systems. In this case they're carbon-based, not silicon-based, but the analogy is sound.

Steven

Re:So?

[Anonymous Brave Guy]

Actually this type of activity is used daily all over the world to obtain information which is later used to break into systems, by true hackers.

True hackers write good code for fun or profit. If you're going to be pedantic, the term you're looking for is "cracker".

Hah

[iONiUM]

If you still have questions you can call the Security Hotline [phone].
Can't the hackers who read slashdot (probably most of them) just call this number instead now?

Furthermore, why doesn't Microsoft have a security hotline?

Re:Hah

[JWSmythe]

I get the feeling the operators at [phone] are about to be slashdotted themselves.. Can AT&T take 1/2 mil simultanious calls to their security hotline? hehe

Re:Hah

[douglas jeffries]

Can't the hackers who read slashdot (probably most of them) just call this number instead now?

i'd hope their "Security Hotline" would know better than to hand out information to anyone who happens to call. but you never know...

Re:Hah

[Pig Hogger]

Furthermore, why doesn't Microsoft have a security hotline?

They had one, but it melted down.

Re:Hah

[tswinzig]

Can't the hackers who read slashdot (probably most of them) just call this number instead now?

Yeah, but uhhh why exactly would they want to?

Re:Hah

[espo812]

Yeah, but uhhh why exactly would they want to?

Because social engineering the security hotline is a much better hack than just social engineering the front desk?

Microsoft's Security Hotline

[schmaltz]

The all-knowing Google found a number for "Microsoft Product Support Services Hotline-Virus-related product support"

1-866-PC-SAFETY (866-727-2383)

http://www.microsoft.com/usa/government/security.a sp

A call to this number rang about twenty times, then was picked up by a voicebot: "Your party is not picking up. Your call will now be disconnected."

Re:Hah

[Patrick13]

ya know.... 800 numbers have global caller ID. I wouldn't recommend calling this number from, say, your workstation, at the place where work for a living.

Some security!

[PaperTie]

They have to take special precautions since there's some conference? What about the rest of the year?

Re:Some security!

[alanjstr]

Its just a reminder. Its already standard practice at companies like that to verify information of the callers. Just like the police normally patrol the streets, reminders go out when they think people need to be extra cautious.

Re:Some security!

[Peyna]

Its already standard practice at companies like that to verify information of the callers.

Apparently while it may be "standard practice", it isn't followed very much of the time. It's very easy to convince people you are someone else even with very little of their personal information. How often have you called somewhere and to make sure you are you, they read your address to you and ask if it is correct? Imagine if when you booted up your OS instead of login: and password: it asked for whatever personal information you had, then made a judgement call as to whether or not you are actually you, without demanding a specific username and password combination?

Re:Some security!

[elandal]

How often have you called somewhere and to make sure you are you, they read your address to you and ask if it is correct?

Not often. Usually they ask for my name, date of birth, and address. Not AT&T (I'm not their customer), but other companies. Except that phone companies love obscure numbers ("It's Your phone line installation service code, in the right-upper corner of Your phone service contract" or whatever - anyway not the customer ID or alike) I can't remember and to get it, I first need to dive into a pile of papers.

Just a couple of days ago I received a call regarding a fax I had sent, and I was asked the usual basic information and whether I had sent the fax, and if I could verify the request I made by stating it (shortly) now on phone. After I stated my request on phone, it was OK'd, and later that day I had confirmation fax on my table.

I think that was pretty good. Of course, my request was somewhat unusual, so it might have triggered a "use the strong procedure" attitude.

Re:Some security!

[ph0rk]

and how often are you calling internal AT&T numbers posing as an employee? (perhaps rightly so).

All the megacorps do this, if nothing else, simply because the company is so damn big the person has never heard of you, your manager, or your manager's manager.

Re:Some security!

[DNS-and-BIND]

Who the hell cares about AT&T nowadays anyway? Maybe back in the day, but in 2002? This "advisory" is just some guy they hired who used to go to cons, and he's trying to justify his job by issuing spurious bulletins. I'd like to see some of the other crap the AT&T security mandarins put out...probably just as worthless as this one.

Also, interesting how AT&T apparently requires a SSN to be a customer...the only people who need an SSN are the federal government and your employer.

Re:Some security!

[Ageless]

Uh, do you not have any utilities coming in to your home? Almost every single utility I have uses SSN and requires it for transactions.

As for your statement. Your employer is not allowed to require your SSN but you are required to provide a way for them to tax you. That can be a tax id or something but doesn't have to be SSN.

The difference is that if a company has a policy then they can choose to not do business with you. If you don't want to provide SSN, well, Long Distance isn't a right.

SSN = ID Number

[inKubus]

Yeah, I don't even know why we still call them Social Security Numbers. It's a farce. It is your unique National Identification Number, whether you like it or not.

Re:Some security!

[Anonymous DWord]

Not quite true. Here's what it says on the paper that comes with a brand shiny new SS Card:

YOUR SOCIAL SECURITY CARD

The Social Security number shown on your card is yours alone. Record your number in a safe place in case your card is lost or stolen. Protect both your card and your number to prevent their misuse.
...
Some private organizations use Social Security numbers for record keeping purposes. Such use is neither required nor prohibited by Federal law. The use of your Social Security number by such an organization for its own records is a private matter between you and the organization. Private organizations cannot get information from your Social Security record just because they know your number.

Any Federal, State, or local government agency that asks for your number must tell you: whether giving it is mandatory or voluntary, its authority for requesting the number, and how the number will be used.
...

Emphasis mine.

Re:Some security!

[sysadmn]

If you had bothered to read the article, you'd note that it says that AT&T was burned by this in the past, and they'd like to avoid being burned again. I'd hardly call this "spurious" or "worthless".

Re:Some security!

[theBraindonor]

Precautions? Ha!

How long has the industry known that the easiest way to hack most networks is through social engineering?

Despite warnings from everyone--from government to researchers--social engineering continues to work.

Posting a warning to employees will at most protect the company from the unpracticed social engineering tricks. Social engineering is nothing more than the practiced con-job that has been around since one caveman had something another caveman wanted.

It's Bayesian

[GlobalEcho]

Actually, it makes good statistical/economic sense to concentrate caution on periods of higher risk.

Let's say that AT&T has two modes: careful (C) and reckless (R). Now clearly it costs more in terms of employee time to be careful than reckless. (Say it costs C=$10 and R=$1 respectively. ) Assume Careful catches a proportion q_c of social engineering attempts while Reckless lets a proportion q_r succeed.

Now assume that at a given time there is probability p that someone on the line is trying to social engineer them. Assume also the costs of being hacked (in embarassment or whatever) are uncorrelated, and average $H. Assume the benefits of a legit phone call are $B.

We can now compute the payoff from being careful versus reckless.

V_C = B (1-p) - H p q_c - C

V_R = B (1-p) - H p q_r - R

It's clearly quite possible for either V_C or V_R to be larger depending on the coefficients.

If you could make a function giving q as a function of cost, you could solve for V=0. This would tell you exactly how careful to be, given a particular present level of riskiness p.

Re:It's Bayesian

[GlobalEcho]

I guess that wasn't really Bayesian, was it? Oh, well.

Re:Some security!

[Bostik]

They have to take special precautions since there's some conference? What about the rest of the year?

My thoughts exactly. This gives me the bad feeling they are enforcing their security policies only because having yet another "breach" would be really bad PR. But why aren't they enforced all the time as rigorously? Costs. It costs both time and money to go through the entire protocol, not to mention the additional cost of properly training the employees to follow these rules.

I'm actually willing to bet some beancounter added 2 and 2 and came to the conclusion that having that much bad PR would cost the company more than enforcing the security policy strictly for a few days. Anyone care to guess how many days it takes for the situation return to "normal?"

Editors, again....

[Anonymous Coward]

It might be useful to indicate that the Anonymous Coward is an AT&T employee of some sort, not an AT&T customer that some might think of at first.

Should be common practice

[Bartmoss]

This kind of behaviour should be common practice, really.

Re:Should be common practice

[Bartmoss]

I mean AT&T's safeguards, of course. ;-)

Paranoia

[LeiraHoward]

Just watch: after a note like that, I'll bet someone at the hacker conference takes that as a challenge, and some dumb worker forgets/disregards this warning, and gets made "guest of honor" at their conference, anyway.

I just hope that whatever information they're looking at, it won't be mine.

On another note, if this hacker convention is so well publicized, why aren't there hordes of policemen preparing to descend upon the unsuspecting hackers? Especially with all the cracking down that the FBI/police force have been doing lately on people who uncap their cable modems, or share wifi connections....

Re:Paranoia

[Mr. Slippery]

On another note, if this hacker convention is so well publicized, why aren't there hordes of policemen preparing to descend upon the unsuspecting hackers?

Because being interested in computer security is not (yet) a crime? The attitude may be different, but the content is really no different that what you'd get at a computer security conference.

Wish I could make it, but I've got a full weekend here.

Re:Paranoia

[ImaLamer]

Your comment is silly.

The people who attend these conferences are usually not interested in as much "black hat" hacking as you may think. It would be hard to find a reason to arrest much less convict many of the attendants.

These places are sometimes the places where new technologies are invented or destroyed (that is, if flaws are found... your new cell phone for example may provide to be a great scanner etc...).

Think of it as a conference for computer security but above all electronics engineering...

Re:Paranoia

[Patrick13]

My job apparently blocks the h2k2.net site

this site [anonymizer.com] may let you look at it. Also if you email yourself the URL to a hotmail account [hotmail.com], hotmail will frame it, also, ask jeeves [aj.com] will frame it, if you can find it in their index. Anyhow, that may let you circumvent the block.

Re:Paranoia

[heliocentric]

With the lack of security people working for the government, the cons serve as a recruitment rich environment. Problem is, they won't hire people with a record usually.

Their other problem is they pay so low. I don't have a record, I have a MS degree in CS focusing on crypto and other security items and the best pay from the NSA would still force me to live out of my car.

What a great fuss about nothing

[gowen]

I regularly get emails saying "A person has been seen acting suspiciously on campus, and ran away when challenged. There has been a spate of robberies by extra vigilant," and nothing is made about it. It doesn't mean we're not to be vigilant the rest of the time, just a timely and worthwhile heads up.

What makes this different except the criminals involved are 'l33t and say stuff like "Mad propz".

Re:What a great fuss about nothing

[gowen]

What makes them criminals? Did I miss something?

Obtaining confidential information by deception is usually a criminal act, yes.

Re:What a great fuss about nothing

[Peyna]

I suppose, but what I see in this case is more an attempt to point at a huge hole in these systems and say "Hey, fix it your morons." Locking up people who do it isn't going to fix the problem. They are only trying to point out a problem with how information is given out. Obviously, someone could easily do this with more malicious intents.

Re:What a great fuss about nothing

[edbarrett]

So what does "mad props" mean anyway?

The Set Decoration Is Not Amused.

Re:What a great fuss about nothing

[Fulcrum of Evil]

> The Set Decoration Is Not Amused.

make g00gly eyes at prop

>The Set Decoration is becoming agitated

moon props

>The Set Decoration attacks! It hits! it Hits!

Run away

>The Set Decoration attacks! It hits!
>You have died. Your score is 3 out of a possible 666. Play again? (y/n)

Ahh, PR security

[Omnifarious]

Only be secure when the world might be watching, and at all other times be lax. Sounds like a fantastic policy to me.

Re:Ahh, PR security

[Peyna]

Yup, it's okay the rest of the time to give out personal information to random people on the phone. I experienced this the other day with the local electric company.

My sister and I had rented an apartment together a year ago, and there was a problem with how the electric bill was handled when it was shut off. I called up and spoke to the person and then outright asked them to check my sister's records for any correlating information. I gave him her name, and he gave me her address, phone number, and a whole crapload of other information, with no indication that we were actually related other than that we shared the same last name. Granted, she really is my sister, and I already knew the information he told me, I was quite surprised they actually gave that information out to someone other than the account holder.

Re:Ahh, PR security

[jayhawk88]

Maybe it's my age, but I'm not seeing the paragraph that says "After this is all over please return to our policy of giving out whatever information a caller should ask for". It's just heads-up to their service reps.

Re:Ahh, PR security

[CaseyB]

It's a more like telling your guards to be more alert when there's a horde of barbarians camped just outside the city walls. That doesn't imply you expect them to be lax normally.

heh, this is amusing...

[night_flyer]

almost as funny as the story run by FOXNEWS.com [foxnews.com] saying "al Qaeda operatives have infiltrated WorldCom" (last two paragraphs on the page)... seems they didnt read the whole story at foxnews.com... it was a joke commentary by Arnaud de Borchgrave

the story outlining foxnews erronious reporting is here [thestreet.com] (Item #4).

HA! Social Engineering!

[Havokmon]

Kudos to the guy who got AT&T to give us their proprietary info on what security precautions they take before giving out confidential information. ;)

meta-social engineering

[Ristretto]

It would be an especially clever case of "meta" social engineering if the AT&T number was false. Haven't checked, but it's an entertaining notion. People calling the 1-800 number would certainly feel that they were speaking to actual AT&T representatives (having called the official number themselves) and would then be arguably more likely to release personal information.

Re:meta-social engineering

[mwood]

Of course, that sword cuts both ways: it could be a telephonic honeypot. :-}

Re:meta-social engineering

[rot26]

You may actually be on to something. haha.

And they almost certainly record the ANI spill (essentially "super caller id" that can't be blocked) from each call.

Re:meta-social engineering

[Monkeyman334]

Yeah, that would be a good one. Just so you know, the correct term is "reverse social engineering" where the user is completely dependent on the "hacker" to help them. Get more information on social engineering here [umd.edu].

I can see it now

[chabotc]

First they get a valid name and number from some poor smugs home page or usenet posting, then they will call AT&T..

att> Hello how may i help you
hacker> Hello this is from . Hey i'm sorry to have to call you now, specialy with all this H2 stuff going on, but i need some information on
att> Umm, well sir i need to ..
hacker> yea i know, i also saw the memo, my HRID is and my number is . Shall i hold while you check?
att> Nah, i gues thats ok, what did you need again?

this would be the uba hack ;-)

Addendum:

[cybermace5]

Dear Employees:

The previous memo failed to mention another warning sign of hacker social engineering attempts. If you hear the song "Halcyon-On and On" by the music group Orbital, hang up the telephone immediately. We will be holding information sessions at all regional offices for telephone support personnel, where you will be trained to recognize this music within several seconds. DO NOT confuse this warning sign with the last five minutes of Mortal Kombat! It is better to be safe than sorry. Thank you for your cooperation, and stay Hacker-Free(tm) during this period of "l337n355".

OT: Orbital

[|<amikaze]

That song is great :) Orbital has a lot of good music other than Halcyon and On and On. I highly recommend them

Help, they are attacking me !

[FullClip]

Now I would try to dial into the Security Hotline
("Security Hotline [phone]") and
to pretend to be an alarmed AT&T employee ;)

Or dial someone from AT&T pretending to be
from the Security Hotline.

Social Engineering attacks are so easy ...

Hah

[acceleriter]

And they thought no one would post that warning which now contains

- the resolution procedures in case of doubt about a callers identity

- the "security hotline" phone number.

Nice going, AT&T.

Re:Hah

[Florian Weimer]

I'm not really comfortable with Slashdot publishing phone numbers at all. Whose one is next? Yours? Mine?

Disrupting web sites by posting links is one thing, but posting internal phone numbers which are used to deal with critical problems is really, really bad.

Re:Hah

[Kredal]

Just call 867-5309, and ask for Jenny.

Now I bet *THAT* one has never been tried before.

Tee hee.

Be on guard THIS weekend.

[Restil]

What about after the conference is over? At least at the conference the actions aren't malicious, they're just demonstrated to prove a point. Implementing proper procedures to the employees and making sure they're followed EXACTLY would go a long way toward preventing social engineering. This is NOT a new problem, and it also underscores the simple fact that the least secure part of any network is the user.

-Restil

Re:Be on guard THIS weekend.

[Zocalo]

I can almost here the intro to the session now; "OK, we are now going to perform some live demonstations of Social Engineering. If you want some easy meat to try out your new l33t 5k1llz when you get home; try the local AT&T offices, as they should be letting their guard down nicely by Monday thanks to some prep work we did on Friday...". ;)

A Beautiful Thing...

[Yoda2]

Telemarketing AT&T.

The notice should have asked the employee's to have the caller put AT&T on their "Do not call list"!

Should they also

[af_robot]

call for FBI agents to guard their garbage bins?!
Those hackers can also use "garbage engineering" techniques to get proprietary information.

perfect security

[constantnormal]

At my employer's firm, we have perfected the art of repelling those out to gain information by a 2-pronged approach. We run the callers through a maze of automated phone forwarding recordings to (eventually) a person who has no clue about anything.

Re:perfect security

[zerOnIne]

you work for verizon, don't you?

Re:perfect security

[dh003i]

At my employer's firm, we have perfected the art of repelling those out to gain information by a 2-pronged approach. We run the callers through a maze of automated phone forwarding recordings to (eventually) a person who has no clue about anything.

Isn't that the way every company's support is?

For example, you call the police and you get:

Please enter the abbreviation for the state you are in

TX.

Please enter the letters for the city you are in

DALLAS.

Please enter your zip code

25636

Please enter your telephone number

485-1253

Please enter your last name

SMITH.

Please enter your first name

JOHN.

Please enter your sex

MALE.

Please tell us do you jerk off with your left or right hand

LEFT.

Please tell us what you are calling about: Enter 1 for reporting a crime in progress, 2 for reporting a past crime, 3 for reporting a crime you have reason to believe will be committed, 4 for inquiring about a suspect, 5 for filing complaints, 6 for all other issues

1.

Please identify the type of crime being committed: 1 for murder, 2 for rape, 3 for child molestation, 4 for torture, 5 for assault, 6 for robbery, 7 for drinking while driving, 8 for public indecency, 9 for all other types of crimes.

2.

Please identify the gender of the offender raping the victim

MALE.

Please hold. Your call will be answered in the order that it was received. Average wait times range from 30 minutes to 1 hour

10 min: Thank you for your patience. All of our police officers are currently busy. Please hold. Your patience is appreciated.

20min: Thank you for your patience. All of our police officers are currently busy. Please hold. Your patience is appreciated.

59 minutes: We're sorry, due to circumstances beyond our control, your call has been disconnected. Please call the police number again and re-enter your complaint.

Re:perfect security

[ethereal]

"Why don't you just tell me the name of the movie you want to see?"

Number is legit

[jloukinas]

I called the 800# it is legit.

J

Ignore the memo!

[L. VeGas]

If we're forced to follow basic security procedures, it means the hackers have already won.

AT&T is so being attacked

[defile]

Now the target is absolutely irresistable. They're going to read the notice out loud at the conference and then call AT&T just to make a point. I bet they were even planning to call a different company this year.

Of course, AT&T may be doing this to trap them --it's curious that they say h2k2 several times and clarify it instead of just saying "group of hacker terrorists". Or maybe they really are just that stupid.

Either way, it should be fun. I've got my ticket.

good thing this was posted by anon

[jd142]

I bet AT&T would just love to get their hands on the person that posted this. AT&T did a very responsible thing: they saw a potential threat to the security of their customers, i.e., a lot of people who are reading this (and even if you don't pay AT&T directly, you might use their lines if you have a cable modem), and sent out a warning to remind their people. They included reminders of proper secure behavior. And what is the first thing an employee do? Leak the number and protocols to an outlet read by the people who are most likely to try and breach security. If you were my employee you'd get in some serious trouble.

Many people who do the social engineering hack make fun of companies for having clueless employees or employees that don't follow basic guidelines. So for those few who make fun of AT&T for doing this, I'd say you can't have it both ways.

We should be applauding AT&T for reminding their people of basic security precautions.

Re:good thing this was posted by anon

[Lando]

Speaking as an ex-ATT employee. It's really not a problem with sending the memo out to the world...

These are the standard policies that ATT uses to verify the authenticity of calls. It's nothing out the ordinary, just a reminder to people that they should be verifiying identity before they give out information.

Re:good thing this was posted by anon

[dh003i]

The posting of this message was not harmful or malicious to AT&T or its security issues. Its only informative; you could say it may even give customers higher confidence. The person who posted it did nothing that would get him/her fired. If he were fired, (s)he'd have valid grounds to sue.

Furthermore, the reactions to this haven't been negative. There's nothing wrong with AT&T taking reasonable measures to insure that private customer information is kept private, and that the general security of their networks is maintained. Indeed, if they did anything else, that would be wrong and irresponsible.

Speaking as a cyber-libertarian, I can say that cyber-libertarian ideals don't include giving crackers free reign to break into confidential or private information. Indeed, if you allow such, you're destroying liberty, because you lose privacy rights. Cyber-liberties -- as Lessig has said -- can be violated not only by the government, but also by corporations, organizations, and other individuals.

Security in large companies

[Diabolical]

Problem lies perhaps in the fact that AT&T is a big corporation. People are numbers and numbers can be forged/stolen easily without too much trouble. What if an AT&T employee that just got sacked took a list with him with the information and just threw it on the internet.

I know that these kind of security precautions exist in every big corporation (i work for a top financial corp). I also know that they NEVER work. No-one knows you by the face, only a name or a number is known, and these are easy too come by.

Besides, most system breaches are done from the inside anyway. I know that our company had more internal issues then external.

Videotaped!

[MavEtJu]

These calls were recorded and videotaped by the hackers and are sold as instructional material at future hacker conferences.

Now that gives an interesting movie, seeing a hacker calling an AT&T employee... You'll have more fun listening to Brain Damage [2600.com]:

"Brain Damage" was a two hour call-in show hosted by Emmanuel (using the name Eric Corley) which aired from 1988 to 1995. The show covered all kinds of serious topics as well as non-serious ones. Favorite regular features included

Confuse The Operator, highlights from Radio Moscow, and a reading of the lunch menu by the university lunch lady. Callers contributed their over-the-phone songs, stories of their lives, and features such as the "Math Teacher Spy." There were fewer and fewer shows in the later years until it finally came to an end on January 29, 1995.

Public Radio rules! :-)

Wow.

[mindstrm]

Funny thing is, this probably won't help.

I know when we tell everyone about a new virus, and yet another reminder not to run things even if they are from someone you know, some otherwise intelligent people still go out and run it, and when you ask, they say "Well I know you warned me, but MY friends would never do something like that"

So I can see it now "Well I know there was a warning out.. but he SAID it was an emergency"

This is a Dood Thing(tm)

[bigjocker]

That e-mail proves the meeting has acomplished one of its goals. Thanks to H2K2 AT&T is being more careful with the private info.

Isn't that what we all want? At least that's the reason why I support those kind of things.

It's ironic

[BobRoss]

Why should it take a hacker conference to get AT&T to put out such a warning? I would like to think that such policies are already in place, and that employees are trained to minimize the risk of social engineering from the start.

I guess that's just wishful thinking though...

Re:It's ironic

[suwain_2]

I was under the impression that is was more of a "You already have these procedures, but take extra care this week..." deal, rather than a "Let's teach you basic security fundamentals!" type of thing.

Sort of like saying "The roads are icing up, drive carefully." -- it's just a heads-up to remember to follow the procedures. Or so I hope...

Yes, probably

[wirefarm]

But I think this falls under the category of "heightened awareness".

Cheers,
Jim in Tokyo

Re:It's ironic

[shren]

Why should it take a hacker conference to get AT&T to put out such a warning?

There have been warnings about more general con-men around for years - even some of thier tricks are well known. There's always the classic movie, "The Sting". Many social engineering tricks rely on pressure and tricking the target when they're not really paying attention (conning register boys out of a five by doing an 'i need change' shell game) or using pressure tactics into forcing a bad decision.

Sometimes these warnings play right into the con men's hands! Pickpockets *love* signs that say "beware of the pickpocket", because everybody pats thier wallet to make sure it's still there. "Thanks for letting me know exactly where your wallet is, target.", thinks the pickpocket. A block away the target isn't thinking about pickpockets anymore - two blocks away and his wallet's gone.

Like, without this memo, maybe even with it, if you hacked the switchboard to the phone center and made it so 10 hackers could all call the same desk clerk at the same time, it would be easy to pull something on him. (If you know when the phones are undermanned or can dial directly to an extension, you don't even need to hack the switch.)

Have the other 9 callers put pressure on him with mundane but slightly time consuming requests. Almost everybody who works a phone these days has a lot of pressure on them to resolve each call quickly. When he's got half of the 9 on hold and is trying to get what they want, have the 10th call and play "I'm a manager and I need to know (trivial piece of information that's actually valuable to a hacker) now!" Time's ticking on the held calls. If he leaves them on hold it will show up on a report to his manager. If he doesn't help this guy he'll have another manager angry at him for different reasons.

And the 10th calling 'manager' isn't going to refuse any requests for information. No, of course not. He's just going to say, "I've got that info in my wallet - no not there, maybe in my briefcase, I'm looking.", thus stalling untill target phone rep folds like cardboard box. He breaks policy in an attempt to make everybody happy. But, hey, at least the hackers are happy. *grin*

Thinking about what's going on "Why are there 10 calls to my desk???" is near-proof against con men. They have a thousand tricks to keep you from having time to think.

Security Hotline

[Anonymous Coward]

I also work for AT&T, but I have not seen this memo (I'm in NJ. Maybe it only went to NY people? Maybe only to sales people? Maybe I'm not good enough?).

But I did some hunting and found this in a recent newsletter. Seems outide people are _supposed_ to call that number (which looks like it is out of my building based on the exchange of the phone #)....

SECURING CRITICAL INFORMATION: AT&T is classified as a critical infrastructure company, servicing the communications needs of the government, including its armed forces around the world. Because of this relationship, and current world events, employees may receive inquiries concerning AT&T's network infrastructure security. While most requests are legitimate, some may not be. It's critical to the security of our country, as well as to our business, that these questions be answered factually, and information provided only to legitimate requestors. For these reasons, employees who receive inquiries from a local, state or federal government agency, anyone claiming to represent the media, or any concerned citizen, should refer those agencies or individuals to the AT&T Corporate Security 24x7 hotline at 1-800-822-9009 (within U.S.) or 908-658-0380 (outside U.S.). Corporate Security will ensure inquiries are verified and appropriate responses provided.

Re:Security Hotline

[wnknisely]

There's a note on squabble.org (in the morning's chatty post) from a person who seems to indicate this whole thing is a troll. (I don't want to link because I like squabble and they're bandwidth poor right now.)

Is there any evidence other than the text in the message that this was received by a legit AT&T employee?

att #

[Basil Ganglia]

I wonder if there has ever been an instance of an 800 number being slashdotted?

Who's engineering Whom ?

[Martin Spamer]

How can we be sure this is really what it appears and that it is not slashdot that his been socially engineered ?

Evidence that this is fake

[saforrest]

Read this very similar AT&T warning about a 1998 DEF CON conference:

http://www.defcon.org/TEXT/6/att-dc-6-alert.txt [defcon.org]

Unless AT&T has not changed its warnings in three years (unlikely) and such warnings have been leaked multiple times (more unlikely) this would seem to be a fake.

P.S. to the Memo

[Royster]

Resume your normal, insecure procedures on Monday morning. There's no point in going overboard with this security hoopla.

Only apply security during announced conferences?

[dpbsmith]

I love it... follow these security procedures _on the specific date and time when a hacker's conference has an announced a scheduled social engineering demonstration_.

Don't worry about REAL security. Just worry about embarrassing PR. As long as the hacker breakins don't occur at a time and place when the press is likely to find out about them, everything is OK...

If they had NOT sent out the email, they would have had a good opportunity to find out whether the improved procedures they instituted following embarrassments at previous HOPE conventions were effective. (They DID institute improved procedures following those previous conventions, didn't they?)

AT&T shouldn't care about this memo getting ou

[iabervon]

This information shouldn't be considered secret; after all it's not terribly hard to find out what AT&T will ask if you call up pretending to be an employee or customer: just call up, pretending to be an employee or customer and see what they ask you. If they've designed their procedures sensibly, you still shouldn't be able to spoof them.

Of course, the really great hack would be to call up Kevin Mitnick pretending to be an officer of the court, and get the information from him.

I read the title as

[Triv]

"AtAT concerned about H2G2". I was trying to figure out why Douglas Adams' website would be moving in on "As the Apple Turns' turf." I mean, he WAS a mac advocate (ok, evangelist) but damn.

Triv

AT&T Security

[kmellis]

This reminds me that back in the day, AT&T Security was supposedly a bunch of bmf's.

In about 1980, when I was in high school, I discovered an unused phone extension line in my bedroom closet and started experimenting with it. I quickly figured out the basics and built a little homemade phone. Later, I got the idea of using a thirty-foot spool of wire and a couple of alligator clips to quickly tap into someone's line outside of their house to steal long distance phone calls from the safety of my car. This is really trivial stuff, I know, but I thought I was clever.

But not clever enough. I called my cousin long-distance by connecting to what turned out to be the phone line of a little old lady who'd never made a long-distance phone call in her life. Her church was helping her pay her bills and noticed the phone call immediately. They called AT&T, and AT&T merely checked to see who else in my small New Mexico town had ever called that California number. Then they called my mom.

Once AT&T security found out that I hadn't actually done anything sophisticated or interesting, they just made my parents pay for the call and dropped the matter.

None of this, of course, shows that AT&T security was especially astute. But a few years later I was working as a radio disc-jockey, and I told this story to the station's chief broadcast engineer. He told me that he had worked for AT&T and that AT&T Security were among the best private security experts in the world. In his words: "Don't fuck with AT&T Security". That made an impression on me.

Later on, when I first read about the phone phreaking era, I felt lucky that a) I wasn't ingenious enough to get myself in any real trouble, and b) I didn't know anyone who was.

Re:How is all of this relevent to the origional po

[lucid rinehead]

i think it is an example of an earthling technique known as 'humour'

Re:Editors, please....

[Truti]

No No No No!
Hackers and crackers are not the same persons.... If you are a cracker and come to H2K2 then you will be blamed so hard as you can't just say you own name....

BTW: If some of them do i'm sure that they will report it.. If you not report security ugs on systems you are just a simpel Blackhat and no body respect them.....

Truti

Re:Editors, please....

[Oculus Habent]

Dammit - gotta wake up before posting.

Re:SS#???

[Vengie]

This is the problem -- effectively, virtually every US entity and their mothers use SSN's as a unique identifier. For many students (myself included) it is our college id#. SSN's are used as our account number at various stores/puchase accounts, and more importantly, by most employers as a means of employee identification and by companies as a customer record.

SSN#'s are meant to be for social security....its pathetic that we have this de-facto government id number that is _so_ insecure.

(name addy and ssn ==> credi cards...loans...many a story exists of people with bad credit/delays/problems due to identity theft/minor credit hacking due to a stolen ssn)

It's a pain but you CAN keep SS#s to yourself.

[Ungrounded Lightning]

Maybe in the states it works differently, but in Canada you don't *have* to give out your SIN (our version) unless its to the government... not that companies don't ask anyway.

Actually, the US does have such a law. It's just completely ignored.

Every so often someone suggests enforcing the rule, but that would require so many changes that it won't happen.

Actually, you CAN keep it to yourself in most cases. And I have for a couple decades. (I've been concerned about identity theft since long before the term was coined.)

The battle has been lost with respect to withholding it from the state governments when you go for a driver's license - congress authorized them to collect it. (They actually MANDATED it - allegedly to help track dads who skipped out on child support. So why are they collecting womens' numbers, hmm?)

Some entities are entitled to your SS number - generally those that may pay you taxable money: employers and banks. (NOT insurance companies, at least until there's a taxable payout, and most payouts are not taxable.) The rest can ask and you can refuse. They're usually stuck serving you anyhow - especially if they're already contracted to do so, as with certain employee benefits.

I'm not sure if lenders are entitled or if it's just "Well, I have to serve you anyhow. But I get to do so on my personal estimate of your credit risk, based on rules I use that are common to all applicants. I think someone who withholds their SS# from a lender has a skeleton in his financial closet and is a high risk." Either way if you want a loan you'll need to give 'em the number.

The big problem has always been hospitals and medical insurance companies. Hospitals normally assign a hospital number separately and will let you leave your SS# field blank or fill it with "withheld". They have a separate field for the insurance ID, because lots of people are on their spouses' or parents' insurance. Insurance companies generally let you use a replacement I.D. Some will assign it themselves. Some will ask you to generate one - and be responsible if it collides with someone else' number.

If you must generate one: there are several rules for numbers the US will never assign. One I remember is "any of the three fields is all zero". I think any field all-9 is also unused. Two insurance companies that assign numbers are apparently using counters, one starting at 000-00-0001, the other at 100-00-0001 (probably to avoid collisions with each other). If that's where they started they've each assigned more than a thousand before they got to me. Regardless: I have yet to encounter any billing or hospital registration software that rejects "illegal" SS# patterns.

Lately it has gotten a LOT easier to withhold the numbers. Apparently enough people have been doing so that it's no longer a "lone nut" thing. (This is possibly because identity theft has been in the news for a couple years, possibly because people like me have dealt with enough companies to bring their I.T. departments kicking and screaming into the world of privacy.) Companies have gotten the message - clear down to the clerk level - and are no longer fighting the withholding of SS#s and other personal info.

Computer Professionals for Social Responsibility has a project on keeping SS#s private and can give you some tips if you run into a company that's being obstinate.

Meanwhile, get your passport and use THAT for I.D. B-)

Re:Has anyone actually called that number?

[GutBomb]

umm... call it maybe? it's a toll free number.

Re:Has anyone actually called that number?

[Kredal]

Nah, the 50 FBI agents that were tapping this number were all busy grabbing the pirate out of his parents' house.

It's safe to call the number now. (:

Re:I have mixed feelings...

[topham]

Actually, I thought this was hilarious. Because it IMPLIES AT&T thinks it is acceptable to not follow the procedures the rest of the year.

Re:I have mixed feelings...

[alienmole]

But AT&T is a company with a lot of proprietary information that could be easily broken if someone starts playing around with it, especially if they really don't understand what they're doing.

If that's the case - and I would hope it isn't! - I'd rather a pimply teen from Queens did the breaking first, giving the target company a heads-up as to their poor security, rather than a terrorist bent on crippling the US phone network or Internet. Think of H2K2 and its attendees as a free security test for AT&T and other companies.

Is it really okay to expose this?

Yes, absolutely. Much more sensitive information gets published in mainstream media all the time. In fact, it's in posting things like this that Slashdot is at its best, since it provides insight into things that are normally hidden, and which perhaps could stand a bit of scrutiny (or if they can't, should be able to!)

At worst it's letting the world know that, on this particular weekend, the back door to the Best Buy on Such-and-such St. has a broken lock.

That's silly. If AT&T's procedures can be compromised so easily based on the information in that email, they better get new procedures, and they'd better hire security people who know what they're doing.

And if this did result in a real-world break-in -- if someone did use this information to steal from the Best Buy -- the person who posted this information would be arested and charged.

That may well be true, and is an example of the kind of thinking that many officials indulge in. Crack down on the hackers who expose problems, and maybe no-one will notice some of the more serious holes in our infrastructure security. In fact, one of the talks at H2K2 covers this topic:

Abuse of Authority

Over the years, there have been many stories in the hacker world of law enforcement personnel who have abused their authority. Two of the more dramatic cases in recent memory both come out of Philadelphia. Many of us are already familiar with the horror story of Bernie S. who toured five dangerous prisons for over a year - not because of what he was charged with - but because the United States Secret Service was upset about his collection of information about them. Then there is the case of ShapeShifter, 2600 layout artist, who was arrested at the Republican National Convention in 2000 (shortly after leading a panel on the RNC at H2K) and held on half a million dollars bail as if he were a terrorist mastermind - all because he had been targeted for speaking out in public. Hear the games the authorities play and how public education really can make a difference in putting an end to such abuse.

Hosted by Bernie S. and ShapeShifter

The fact that the poster of the AT&T email might be arrested and charged is all the more reason to post it. If you allow valid and responsible actions to be circumscribed by petty intimidation, you've already lost your freedom. Of course, you might question the "valid" and "responsible" in my previous sentence, but the point is that it's possible to disagree on these things, and it's not the job of law enforcement to take a position unless an actual identifiable crime has occurred.

Catch Up

[jeff67]

Read the jargon file [tuxedo.org] !

Re:we are the über...

[Kredal]

I do not like the HOPE or MOPE, I do not like the POPE with ROPE.
I do not like Green eggs and Spam, I do not like it, Sam I Am.

(yes, I'm tired too)