|
Hackers steal data through phone networks
(Agencies)
Updated: 2005-01-24 16:47 Computer hackers have taken to stealing data the
easy way -- by eavesdropping on phone and e-mail conversations to find the keys
to seemingly impregnable networks, security experts say.
The danger of attacks with insider information was illustrated earlier this
month with the arrest of a California man accused of breaking into mobile phone
network T-Mobile USA Inc.'s database and reading e-mails and files of the U.S.
Secret Service, and by the exploits of a hacker who breached a hospital's
database and changed mammogram results.
The nature of threats to network security has changed as sophisticated
hackers learned to tap into sensitive information flowing through
telecommunications' servers, especially those that provide wireless and Internet
access.
"Telecom providers are probably one of the main targets for malicious
attackers because they control communications for everybody," said Ralph
Echemendia, head of Intense School, which trains executives in network security
risks.
CANDY FROM A BABY
Hackers may con their way into a phone network by posing as phone company
tech employees to get passwords into the network. Then they could essentially
tap phones or search for personal data like text files or even camera phone
photos.
"(Hackers) will sit there and listen in, waiting to get valuable
information," Echemendia said. "Once they have a foothold on one system they go
through the same process to find other hosts."
Security experts at Intrusic Inc. captured 4,466 passwords and 103 master
passwords allowing global access to corporate databases while monitoring one
Internet service provider for a 24-hour period, Intrusic President Jonathan
Bingham said.
"It's like stealing candy from a baby," Bingham said. "The malicious attacker
will assume the identity of a person whose password they have stolen through
this passive sniffing and they end up entering this organization as a legitimate
user."
Once inside, it takes the hacker seconds to set up back doors that allow
access to the database at any time to do more spying, data theft or worse.
BEST PRACTICES
Most hackers, however, are after information -- passwords, social security
numbers and birth dates -- that they can sell or use to penetrate bank and
credit card accounts, Forrester Research Inc analyst Laura Koetzle said.
"Telecoms and cable companies are pretty high on the list simply because of
their huge customer bases," Koetzle said. "If they can crack T-Mobile's database
they can get user names and passwords for (millions of) subscribers at all
once."
In a statement, T-Mobile, a Deutsche Telekom AG unit, said it "quickly put in
safeguards to prevent further access and began an investigation" after a hacker
broke into its internal computer systems in 2003 and accessed data on 400
customers.
As more companies shift business functions to the Internet and allow workers
to access secure systems from off-site, it becomes tougher to guard against
insider attacks and easier for hackers to breach the system, said Stan Quintana,
director of managed security services at AT&T Corp .
"All these types of environments are requiring a higher level of security ...
of data in transit," he said.
The key to cutting down on damage from inevitable insider attacks is to
constantly monitor data flow and train employees to guard passwords and access
to computers, he said.
He added that among the "best practices" AT&T advocates is that its
customers periodically hack into their own networks.
| |
 |
|
|
|
|
Today's
Top News |
|
|
|
Top World
News |
|
|
|
|
|
|
|
|
|
