Hacked Business Owner Stuck With $52k Phone Bill 300
ubercam writes "A Canadian business man is on the hook for a $52,000 phone bill after someone hacked into his voice mail system and found a way to dial out. The hacker racked up the charges with calls to Bulgaria. The business owner noticed an odd message coming up on his call display (Feature 36), and alerted his provider, Manitoba Telecom Services. They referred him to their fraud department, who discovered the breach. MTS said that they would reverse the charges if the hacked equipment was theirs, but in this case it was customer owned. The ironic part is that the victim's company, HUB Computer Solutions, is in the business of computer and network security. They even offer to sell, configure and secure Cisco VoIP systems. Looks as though they even couldn't manage to secure their own system, which doesn't bode well for their customers." This certainly isn't the first time someone has exploited the phone system and stuck another with the bill. Maybe it's time for the phone company to get their fraud detection and prevention services at least on par with the credit card companies'.
WTF? (Score:5, Insightful)
"Oh hi, I got my PBX hacked (possibly because of my 4 character PIN "security") and lost 50 grand on calls to Bulgarian criminals, how about paying me to set up your computers?"
Re:WTF? (Score:5, Funny)
Seriously there guys, why would Mr. HUB Computer Solutions let something as embarrassing as that hit the press?
Perhaps he's now offering super-low-discount services and this is just an elaborate advertising campaign?
Re:WTF? (Score:5, Funny)
1. Get hacked
2. Tell the press
3. ?????
4. Profit!
Re: (Score:3, Funny)
** Caution: Low-flying Wooshes **
This is an alert of the emergency joke-casting system. Sarcasm detectors in your area have detected low-flying wooshes. This alert is in effect for the entirety of this thread.
Repeat.
This is an alert of the emergency joke-casting system. Sarcasm detectors in your area have detected low-flying wooshes. This alert is in effect for the entirety of this thread.
Re:WTF? (Score:5, Interesting)
Some context from a native of Winnipeg:
MTS is our AT&T, it's the big bad phone company. I believe it's the second largest company in our province, behind the power company. HUB is a tiny business that I had never heard of. This is very much a David vs. Goliath thing, the HUB guy wants MTS to go easy on the bill because they have money. MTS has dropped all responsibility because it's not their equipment that was hacked, but this guy has come back with "you should have notified me earlier of abnormal usage on my phone lines".
The HUB guy will have to lay off one of his staff unless MTS goes easy on this bill. His only method of leverage on MTS is to speak to the newspaper. That's the reason he's risking public embarrassment.
Re:WTF? (Score:5, Insightful)
this guy has come back with "you should have notified me earlier of abnormal usage on my phone lines".
The customer equipment that got compromised was a goddamn PBX. He should have been watching it himself for signs of abnormal usage.
Re:WTF? (Score:4, Informative)
this guy has come back with "you should have notified me earlier of abnormal usage on my phone lines".
The customer equipment that got compromised was a goddamn PBX. He should have been watching it himself for signs of abnormal usage.
I agree fully with that statement. I worked for a small company (400 people) and our telecom folks watched the usage patterns like a hawk, and stopped several hack attempts cold. The only one I know of that they didn't stop was one where a calling card number was shoulder surfed; and they kept getting either no answer or VM at the phone company's fraud desk. The phone company ate that bill.
Re: (Score:2)
I'm certain that he followed every tip in P.C. Magazine. Quality apparently means different things to different people.
Re:WTF? (Score:5, Interesting)
I think your jumping to conclusions - the article doesn't give enough information to say whether it should be embarrassing or not. Clearly if he setup the system himself using Asterisk or something, and setting up PBX systems is a service he sells, it's pretty embarrassing. The article doesn't say that, though.
He could have bought the PBX system from a third party, and had them set it up. But the article doesn't say he did that, either. In that case he should probably sue that company for not securing their product.
All the article says is that he wasn't renting the equipment from the phone company.
Re: (Score:3, Insightful)
He's reporting a $50,000 fraud. Exactly how does one go about keeping that out of the news?
Re: (Score:3, Insightful)
Yeah, because many small businesses have $50k in liquid assets just waiting to pay to a utility.
I'm not saying that he isn't responsible, but your reasoning is a bit off.
Re:WTF? (Score:5, Informative)
ScuttleMonkey doesn't even read TFS (Score:4, Informative)
Maybe it's time for the phone company to get their fraud detection and prevention services at least on par with what the credit card companies have done.
Dude, it wasn't the phone company's equipment - hence the "outrageous" charge to the consumer.
Re:ScuttleMonkey doesn't even read TFS (Score:4, Interesting)
ScuttleMonkey probably just hasn't figured out that, as far as the telcos are concerned, everything on the INSIDE of the drop is the customer's problem, everything on the OUTSIDE of the drop is the phone company's problem, unless the customer has specifically hired the phone company to handle the customer premises equipment. And more and more phone companies aren't doing that anymore.
Re:ScuttleMonkey doesn't even read TFS (Score:4, Interesting)
Credit card companies do things like monitoring your usage habits, and calling you when you deviate wildly from them in order to make sure everything is legit and froody.
This is a useful and profitable thing for them to be doing, since when things turn out not to be legit and froody, the credco is sometimes on the hook themselves for a lot of money.
It is not as useful or profitable for a telco to do the same, because they charge money for a "service" that it costs them next to nothing to render. If the customer accidentally runs up a huge bill, then the dilemma is different: if they don't get to collect on that bill, they haven't lost out on anything but a bit of network traffic.
Re:ScuttleMonkey doesn't even read TFS (Score:4, Insightful)
Re:ScuttleMonkey doesn't even read TFS (Score:4, Interesting)
if they don't get to collect on that bill, they haven't lost out on anything but a bit of network traffic.
This is a myth - when the phone company does not originate and terminate the call themselves, they get charged by the companies they pass the call on to to have it terminated. In many situations, the large phone companies agree to call it quits as they carry roughly the same amount of each others calls, but in international call markets, these agreements are much rarer.
So yes, potentially (in reality, quite likely in this case) there is a real cost to the phone company if they do not collect on the bill.
Re: (Score:3, Interesting)
That is true, but the transit fees carriers pay to each other for this kind of traffic are often smaller than the amount billed to the end-users by an order of magnitude or more.
1.33 Canadian Dollars per minute (Score:3, Interesting)
It is rare for these agreements to even approach 3 cents a minute nowadays, phone cards [ecallchina.com] are proof of that because they usually average about 1-2 cents profit per minute because the competition is brutal. The phone companies are charging sometimes 50 times the amount [mts.mb.ca] they pay. So did you get that, MTS is charging 1.33 Canadian and you can get phone cards for around 4 cents a minute US. So around 40,000 minutes of calls which would cost around 1500 bucks US they are trying to get him to pay around 45,000 U
Re: (Score:3, Interesting)
It gets better,
consider the fact that nowadays, modern cellphone companies allow you to email to a phone number.
If you don't have an unlimited call plan, receiving messages in this way costs the receiver for
every message received. Combine this with a gentle DDOS attack that doesn't break the server routing
to the phone in question and?
Why does it cost money to put blocking on these services?
Re: (Score:3, Insightful)
The real issue there is that receiving a message, with no way to block it, costs the recipient money.
In what sort of world does that make sense?
Bulgaria? (Score:3, Interesting)
Re:Bulgaria? (Score:5, Informative)
Often times, the thief sells calls at clusters of payphones in low income urban areas. The calls are made to wherever the immigrants in the area came from. These rings have phone systems like this that they hijacked, stolen prepaid phone card lists, stolen credit card lists that they can use to place calls, and so on. This is where a lot of phishing leads to. If they think anyone is on to them, they can just walk away. The authorities rarely get involved because they're too difficult to catch and the dollar amounts aren't large enough. It's a great scam because it's easy and they don't have to risk taking delivery of anything. The minutes turn into cash.
Re: (Score:3, Insightful)
The authorities rarely get involved because they're too difficult to catch and the dollar amounts aren't large enough.
$50K not high enough? Huh.
But anyway, given that it can't have cost the Canadian telecom anywhere *near* $50K, and it was clearly fraud, shouldn't they prorate this guys bill to *cost* or a little more? Demanding the full $50K is unfair.
Any lawyers out there? (Score:3, Interesting)
It seems to me a lot of lawsuits come down to "what are the damages"?
If someone steals a physical item, how is its value determined - retail or wholesale? The "actual damages" are a lot lower than the retail price of lots of things, but especially phone service.
Re:Bulgaria? (Score:4, Interesting)
$50k is a lot to you or me, but sadly it's not enough to interest the authorities. I've been there. We knew the street corners in various cities where these guys operated, times of day, we could even detect when they were active. Occasionally the FBI would take our info but we never heard that anything ever came of it.
I can understand it. Nothing tangible was stolen. The business is in one location, the crime can be geographically far away. Why does NYC care about some small company in some town they've never heard of? Even if they caught the guys, it's going to be a difficult case to prove. You'd have to catch them with their lists or catch them selling to an informant. Even then, could you tie them to other thefts on different days? I don't know.
Are they going to be able to recover anything? Probably not. I'd bet these guys are working for someone else. The best you can do is lock them up, and the someone else will simply hire someone else.
Finally, the losers in these cases are somewhat to blame. The company in this story didn't secure their phone system. They didn't monitor it either. It's one thing to ask why the telco wasn't watching for fraud, but why wasn't this company either? Why didn't their switch throw up a red flag?
In cases I've dealt with, we sold prepaid minutes online. It was too easy. Enter a credit card and we give you a PIN. Hello fraud opportunity. Doesn't surprise me at all that they didn't want to help find people taking advantage of our poorly thought out business plan. We did get rather good at detecting these situations real time though, both at time of sale and at time of use. They were clever, it was almost like reading the "Cukoo's Egg". They'd find a way around almost every roadblock we put up, eventually.
Why would they do that? (Score:5, Informative)
This certainly isn't the first time someone has exploited the phone system and stuck another with the bill. Maybe it's time for the phone company to get their fraud detection and prevention services at least on par with what the credit card companies have done.
As long as the customers are responsible for the charges, they have no business reason to invest in fraud protection.
Bruce Schenier refers to this as an externality, and had written about it a number of times in the context of credit card security and computer security.
http://www.schneier.com/blog/archives/2007/01/information_sec_1.html
http://www.schneier.com/blog/archives/2006/03/credit_card_com.html
http://www.schneier.com/blog/archives/2005/10/preventing_iden.html
Not astonishingly suprising... (Score:5, Interesting)
After all, what kind of car does your mechanic drive? Do you know when your mechanic last did an oil change on their own car?
Hint - the mechanic's car is usually fixed last, if ever.
In similar light I knew a cardiologist a few years back who died of heart failure.
It isn't easy to find time to maintain for yourself the same kind of equipment that you are paid to keep up for others.
Re:Not astonishingly suprising... (Score:4, Insightful)
Or the old quote.
The Carpenters house is always the one that is in least repair.
Re:Not astonishingly suprising... (Score:5, Interesting)
Or the old quote. The Carpenters house is always the one that is in least repair.
Good point, their site runs Sharepoint and the Site Settings prompt is open to the world.
http://www.hub.ca/default.aspx [www.hub.ca]
Re: (Score:2)
Re:Not astonishingly suprising... (Score:5, Funny)
Great work! Not only is he stuck with a 50k phone bill, but now his internet bill will skyrocket as well thanks to the slashdotting of his site.
Are you his competitor by any chance?
Re: (Score:3, Funny)
Or the old quote. The Carpenters house is always the one that is in least repair.
Or the town barber is always the one with the worst haircut..
Re:Not astonishingly suprising... (Score:5, Funny)
This does not really have the same meaning as the others because giving yourself a haircut is more difficult than giving another person a haircut.
So is open heart surgery...
Re:Not astonishingly suprising... (Score:5, Funny)
Re: (Score:3, Insightful)
After all, what kind of car does your mechanic drive? Do you know when your mechanic last did an oil change on their own car?
Hint - the mechanic's car is usually fixed last, if ever.
Care to try and back that statement up?
I happen to work in the automotive repair industry. Good automotive techs know better than most that it's far cheaper to maintain their vehicle than it is to repair damage later.
Re: (Score:2, Funny)
[citation needed]
Re: (Score:2)
Would people please stop posting this on its own, for no apparent reason? Why would anyone need to give a citation for an anecdote about their own car?
Re: (Score:2)
If you are going to as for black up on a claim and then proceed to make a counter claim, you had better provide back up for your counter claim.
On that note, I have known several Mechanics that purchase $500 cars and jsut do the min. work to keep it running. The cars are always in a constant need for repair, but they only get the bare min. that is needed so they can get to work ev
Re: (Score:2)
Re:Not astonishingly suprising... (Score:5, Funny)
[citation needed]
Will this [wikipedia.org] do?
Re: (Score:2)
Re:Not astonishingly suprising... (Score:4, Interesting)
I can't stress this enough; whoever was responsible for setting up this system seems to have ignored every best practice guide for deploying CallManager. I'd actually like to see their setup, just for curiosities sake. I'd also have to recommend against using their consulting services
But as for the other stuff you said, I sort of agree. My network at home is an absolute cabling / design mess.
Re: (Score:2)
In similar light I knew a cardiologist a few years back who died of heart failure.
Aren't most deaths ultimately attributable to "heart failure"?
Re: (Score:2)
Re: (Score:2)
Forget time, it's money. I work at a Fortune ~120 company, and we never build anything for ourselves. Even in the name of cost-saving, no outlay happens unless we are confident it will be sold somehow. In a leveraged environment, the first client to need something pays for it, the others get it free (for one-time charges, space and bandwidth are ongoing though).
The client delivery arm of the co. is now requesting to use the web app we made for $car_company, even though they wouldn't fund or blaze the tra
Re: (Score:3, Interesting)
That's kind of sad, in my opinion. I work in the computer industry and my own computers and network are, at the very least, up-to-date and maintained well. (I don't claim to be a security expert...but there are some basic things that you can do.)
Same with any doctor I visit (he better look like he's in good health, at least), my mechanic I use (he's fanatical about how he takes care of his car), etc.
People who just have a "job" won't want to continue doing their job after they are finished for the day. P
Re: (Score:3, Insightful)
Either you don't know any mechanics personally, or the mechanics you deal with are shitty ones. Ive seen engines so spotless that you can eat off them, with brand new bolts everywhere.
That may be true when they start out - beautifully prepared and maintained, usually quite highly tuned, always immaculate; by the time they get to their mid-forties and are running their own business, working long hours to make ends meet, their own cars get just enough attention to keep running.
My brother's first car was a beaut - Austin A35 with an MG Midget engine and a Marina back axle - hundreds of hours of work just for the joy of it. That was followed by a stream of Escort Mexicos and RS200s. As the
1-900... (Score:4, Funny)
Re:1-900... (Score:4, Funny)
Only one way to find out!
Re:1-900... (Score:5, Interesting)
Let me assure you, none of us had ever seen so many gorgeous women in one place.
Re:1-900... (Score:5, Funny)
Or..... (Score:5, Funny)
That's not because Bulgaria rocks - it's because you're from Utah.
The phone company? (Score:2, Insightful)
Re:The phone company? (Score:5, Interesting)
Why should the phone company be responsible for their customer's incompetence?
If they installed it... maybe... but they didn't.
Why are credit card companies responsible for their customers' incompetence? If I leave my credit card on a bench at the mall, and call to report it lost within a reasonable amount of time, I'm not liable for most of the charges. That's a legal limitation, too... not just customer service. The credit card company didn't leave my card lying around, or make it easier to lose in some way, but they still have to eat the charges.
Several years ago, our electric bill jumped suddenly. Our deadbeat tweaker roommate decided to run the AC 24/7 "Like they do in Hawaii." The (municipal) power department computers automatically detected the change in usage, flagged it, stopped our bill from being issued, and sent it to CS to contact us and find out if there was a physical problem. (Then something got dropped so they didn't contact us, and didn't send a bill... four months later they came knocking on our door, all apologies.)
So, yeah, I think it's reasonable for a utility company to auto-flag aberrant usage. Though true, the guy *should* have configured his phone system correctly too...
Re: (Score:3, Informative)
Why should the phone company be responsible for their customer's incompetence?
If they installed it... maybe... but they didn't.
Why are credit card companies responsible for their customers' incompetence? If I leave my credit card on a bench at the mall, and call to report it lost within a reasonable amount of time, I'm not liable for most of the charges. That's a legal limitation, too... not just customer service. The credit card company didn't leave my card lying around, or make it easier to lose in some way, but they still have to eat the charges.
Several years ago, our electric bill jumped suddenly. Our deadbeat tweaker roommate decided to run the AC 24/7 "Like they do in Hawaii." The (municipal) power department computers automatically detected the change in usage, flagged it, stopped our bill from being issued, and sent it to CS to contact us and find out if there was a physical problem. (Then something got dropped so they didn't contact us, and didn't send a bill... four months later they came knocking on our door, all apologies.)
So, yeah, I think it's reasonable for a utility company to auto-flag aberrant usage. Though true, the guy *should* have configured his phone system correctly too...
Pfff. Florida Power & Light happily and without any warning sent me a $500 bill the month after a neighbor in the triplex I lived in had been stealing power from an outside outlet via extension cord. My usual bill was about $125/mo.
Lucky for me my landlord was nice enough to eat the difference since it was his tenant. The guy was kicked out shortly after paying rent the following month. Needless to say, FPL didn't give a shit, like they typically never do.
Re: (Score:3, Interesting)
Good luck with MTS. Seriously. (Score:5, Interesting)
I had a phone cable dug up recently because MTS didn't mark it on a cable locate. The responses ranged from "sorry, you're out of luck" to "where else are you going to go for phone service?" I feel bad for the guy, but unless he takes it to court he isn't getting any help from MTS.
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
There's one easy solution to this. Call and threaten to cancel your service. Bell, Telus, Rogers all the same. Whomever you speak to first in 'Customer Service' will try to talk you out of it. Be persistent without actually canceling, unless you REALLY want to. In no time, you'll be transferred to another department. These are their customer saving or retention team people. They're there to save you from selling your soul to the competition. With these guys, you can get better and cheaper plans, better and
bewildering... (Score:4, Insightful)
Re:bewildering... (Score:5, Interesting)
Some Math (Score:4, Insightful)
Let's assume these calls cost $3.00 for a minute.
$56,000 / 3.00 = 18667 Minutes.
18667 / 60 (min/hr) = 311 Hrs.
So that means nobody noticed as this guy called for almost 2 full weeks of talk-time??
($3.00 is an assumption as I have no idea what actual international rates are)
Still, if this is even in the ball-park, that's a hell of a lot of talk time going unnoticed. You'd think the system would flag if you suddenly doubled your usage over a period of time.
Re: (Score:2)
Let's assume these calls cost $3.00 for a minute.
Back in the day when I was on Dial-up I had a virus on my Windows laptop that was online for only two minutes and charged $30 to my phone bill. You'd be surprised.
Re: (Score:2)
I had this same attack happen on our company's PBX about five years ago. The CLEC providing us Internet and voice (Integra Telecom, worst phone company ever) forgot to put a password on the admin account of the voice mail box. One day MCI fraud calls us about the $10,000 bill we had racked up over the weekend. Because we had multiple voice channels (seven at the time) the attackers could place three outbound calls at the same time, which easily came to over 6,000 minutes in just two days.
Re:Some Math (Score:4, Insightful)
Well, there's three reasons I can see.
This company probably didn't have an international calling plan of any sort, so they were stuck paying whatever obscene rate the local phone company charges for international calls, a la carte.
Also, the phreakers probably had multiple lines in action at any given time, so it wouldn't have taken too terribly long to rack up a large number of minutes.
Lastly, HUB probably didn't notice that anything was going on, until they got the paper bill in the postal mail. With a monthly billing cycle, plus an extra two or three weeks to receive the bill after the end of the cycle (and then a few weeks past that for the accounts payable clerk to bring it to the attention of the owner), I can imagine that this slipped by unnoticed for a long time.
Ha ha (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
His phone system was configured to allow outbound call transfer and had no restrictions on international calls. If you actually use the call transfer function, it isn't especially easy to prevent someone in voicemail to do the call transfer. Likewise, if you make international calls, you either need to create an account code system to permit it, or another PIN code.
For a small business that needs outbound call transfer and international calling, you are spending a lot of extra effort to protect things.
I kn
Re: (Score:2)
Re:Ha ha (Score:4, Insightful)
In most civilized countries, possession of stolen property is a criminal offense, as is selling said property. Service is also seen as the same.
How is it not fraudulent behaviour to collect on services that amounted from theft?
Re: (Score:2)
I basically agree with you here. But there are some costs to the phone companies associated with making those calls as well, and it's not fair to stick the company with them when it was the user's equipment getting hacked.
I don't know much about the major costs for telcos; I assume they have to pay other companies for access to their networks. If there are significant per-minute costs for calls to Bulgaria, the user in this case should at least pay those plus a small overhead. However, if most of the cos
Re: (Score:3, Insightful)
In most civilized countries, possession of stolen property is a criminal offense, as is selling said property. Service is also seen as the same.
How is it not fraudulent behaviour to collect on services that amounted from theft?
Because it should not be the service providers responsibility to police their customers (come on guys, doesnt that sound awfully familiar?), especially when their customers can provide their own equipment and the service provider cannot legally force equipment limitations.
In short, the telephone company in this instance did *exactly* what they were contracted to do - why the hell should they suffer (and they will suffer, they are out of pocket on the international termination charges) through no fault of th
Re: (Score:2)
Have Teleco Block Outgoing International Calls? (Score:5, Insightful)
If the phone company does not offer such a protection, they are in a manner condoning such abuse are they not?
I was also under the impression that YOU had to be the one that actually 'in good faith' placed the calls for it to legally billed to you. I am not sure about US/Canadian telecom laws?
If a stranger hacks my WIFI encryption in my neighborhood and downloads child prOn, warez, illegal MP3, etc.. through my router/IP that DOES NOT mean that I did it and I AM NOT responsible for those communications/transfers as I have made reasonable accommodations to prevent that (plus I shutter to think that any of my neighbors are into any of that).
I would simply be responsible for getting a better protected router or some other commonplace and reasonable standard process of WiFi protection.
Similarly, this firm likely had made reasonable efforts to NOT have their phone system hacked, and therefore did not make the calls and thus should not be made responsible for them. The phone company should protect their customers 'in good faith'.
Re:Have Teleco Block Outgoing International Calls? (Score:5, Insightful)
If a stranger hacks my WIFI encryption in my neighborhood and downloads child prOn, warez, illegal MP3, etc.. through my router/IP that DOES NOT mean that I did it and I AM NOT responsible for those communications/transfers as I have made reasonable accommodations to prevent that (plus I shutter to think that any of my neighbors are into any of that).
There's a difference between criminal liability and financial. You wouldn't be convicted of downloading child porn (or shouldn't be at least), but if your internet access was pay as you go, you may still be required to pay for the bandwidth used.
Re: (Score:3, Informative)
The problem is, that 52K phone bill is not all going to this guy's phone company's coffers. They're going to pass on some amount of that to their upstream provider who will pass some amount on to someone else and on and on. It's not like the phone company can waive that 52K charge and nobody's hurt. The phone company still has to pay someone else for that call.
Sorry, but I can't side with the guy in this case. He setup his own equipment instead of using the phone company's and that implies, in the absen
Re: (Score:3, Funny)
The phone company should protect their customers 'in good faith'.
I know what all those phrases mean. I just never imagined I'd see them all together in one sentence like that.
Re: (Score:3, Informative)
If you're in the US and you provide the last link then YOU ARE RESPONSIBLE. Welcome to the wonderful world of CALEA [digestiblelaw.com]. By providing wifi you're at fault, plain and simple. It's one of the legal hassles of anyone providing wifi.
Having helped similar problems like this I can give a few case studies. The best I can say you WILL be responsible until they figure out it wasn't you. But you may very well have months of sleepless nights.
I had RIAA send a notice about one of my client IPs putting a pre-release CD up
Why ask MTS for compensation? (Score:4, Insightful)
If the phone company wants to charge... (Score:4, Interesting)
The phone bill is exactly stolen services....and for the phone company to sell that should be illegal.
Re: (Score:2)
Pretend for a moment this was not cybercrime, but was physical. If someone physically broke into HUB computer's offices, and made $52,000 of phone calls from someone's desk, would the phone company be responsible?
No. The phone company did nothing wrong. It isn't their responsibility to screen your phone calls and determine which ones are fraudulent. This wasn't a case of the phone company's system being compromised. It was neglectful security by HUB.
Re: (Score:2)
It doesn't take a brain surgeon to recognize a distinctly unusual shift in calling patterns. If the company had NEVER called Bulgaria (which is likely because, let's be honest, who among us has ever called Bulgaria?...) and then it suddenly wracks up $52 THOUSAND in calls to Bulgaria, someone at the company should say "hey, that seems odd. Let me make a call to our valued
Re: (Score:2)
Re: (Score:2)
You are right, the phone company could have done this. But just because the phone company did not implement measures to protect someone from their own stupidity does not make it the phone companies fault.
However, if the phone company offered such a service, perhaps for a monthly fee, then I could see blaming the phone company for the failure of that service.
Re: (Score:2)
But in practice the phone companies (there will be one in Bulgaria too) have profited enormously from this crime, way beyond their cost for the calls in question.
It might seem reasonable to me that they should ask that their costs to be covered for the stolen minutes, not the retail price.
It's not as if the phone company did much or anything to offer a service whereby they could determine the calls were bone fide.
Re: (Score:2)
But the phone company continued to sell to HUB a stolen service, thereby financially benefiting from the theft.
Re: (Score:2)
It has been said before (Score:2)
But why is there no credit limits on what phone companies provide, they all seem to happily keep upping someones bill without ever wondering if that person can pay it.
Someday we are going to hear about a someone getting billed 30 million for watching a movie on their iphone while on safari.
After the first few grand they should cut you off and tell you about it. And if you want a bigger credit limit you request it.
Yay for 4-digit pins (Score:5, Funny)
Davison has a four-digit password on the voice mail. That doesn't stop professional hackers, said Brett Rhodes, an expert in the field who runs SME Teleresources Inc. in Winnipeg.
I once saw a web site with a list of all 4-digit pins on it. I mean like, every single one!!!! There must be... hundreds.. no... thousands of possiblities! Keeping or distributing such a list should be illegal.
Re: (Score:2, Funny)
Re:Yay for 4-digit pins (Score:5, Funny)
Incorrect PIN number. You have 9998 tries remaining.
Re: (Score:2)
+1 Funny!
Thanks!
I needed a laugh.
What's with the law? (Score:2)
Someone steals from the phone company using someone else's phone, and it's the someone else who needs to pay?
Say there's a water main and a pipe running off it to someone's house. Unscrupulous fiend taps into it. If he taps into the part closest to the street, it's a clear case of that person stealing from the water company and they're stuck with the problem. If he makes his hole six inches to the left, the water company gets to send a bill? How is that sane?
Re: (Score:3, Insightful)
Re: (Score:2)
I am in the same business (Score:3, Informative)
...and there is no, I mean, NO excuse for what this guy allowed to happen, from the perspective of a telephony engineer.
Point #1: how weak is your security that an external entity can log in and gain access?
Point #2: why in the world does his voice mail system have a class of service that allows outdialing? Typically a telephony engineer restricts the class of service on the ports connecting to the phone system so that they can only pass calls to the phone system itself, not to the outside world.
This guy is unbelievably lazy, and the fact that he wants someone else to pay for his mistakes is insane. He fails at life.
When can we start executing hackers? (Score:3, Interesting)
Everyone here seems to have this blame the victim for getting hacked, but, why should we have to do this security stuff at all? Why can't we just execute the criminals. Everything is all about put up shields, pay tons of money for security, and its as if the criminals have more of a right to our systems than we do. Enough already. This guy shouldn't have to pay any money at all, regardless of whether he had the shields up, or not. People ought to be able to have a relative sense of security about themselves, and if we have to behead 50,000 convicted hackers and identity thieves and hang their bloated corpses off of bridges as an example to others, then, lets get on with it.
Death to hackers, that's the best security policy that any country could have.
hmmmm (Score:3, Insightful)
Just Great..... (Score:4, Funny)
Now some politician is going to start making us enter CAPTCHAs every time we want to make a call..... To protect us.....