Date: Sun, 23 Aug 1992 14:14:04 GMT
From: Wolf.Paul@rcvie.co.at (Wolf Paul)
Newsgroups: comp.dcom.telecom
Subject: Conversation Attack: Software Blue Box in Germany
Reply-To: Wolf.Paul@rcvie.co.at (Wolf N. Paul)
Organization: Alcatel Austria - Elin Research Center, Vienna
X-Submissions-To: telecom@eecs.nwu.edu
X-Administrivia-To: telecom-request@eecs.nwu.edu
X-Telecom-Digest: Volume 12, Issue 658, Message 1 of 6

The following is from the Austrian newsweekly "profil", No. 34, Aug.
17, 1992. 

"Conversation Attack" -- German computer hackers permit cheap
telephoning around the globe.

The demonstration setup was extremely simple. A PC, a monitor with an
earphone socket, a modem, and -- most importantly -- a disk with
special software. The man in front of the keyboard dialled the digits
0130, the prefix for Germany's "freephone" numbers. A few digits later
the connection to Canada was established, the diskette began to spin
and sent some fake signals across the Atlantic. A few moments later
another dial tone could be heard, and the computer freak at the
keyboard leisurly keyed in the number of a girl friend in Tokyo with
whom he'd wanted to talk for some time.

The faces of the men who are looking over the computer freak's
shoulders show increasing dismay. Experts, particularly telco experts,
don't like to be confronted with the ease with which they can be
defeated. And that's exactly what this writer for the German magazine
"Capital" did in July.

The man took his time with his call to Tokyo. The call didn't cost him
more than a call to his mother at the other end of town. The bill
would be paid by someone else. The diabolically genial program
developed by German hackers caused the meters to rotate at the
Canadian firm whose "freephone" number was dialed at the beginning of
the demonstration.

Experts from "Telekom", the German telco, had assured the public that
security precautions against this kind of unwelcome "conversation
attack" had been been perfected. But this demonstration by "Capital"
 -- which had been previously announced -- mercilessly revealed the
weaknesses of the telco's defenses against hackers.

Here' how it works: In addition to the deluge of conversations which
pours through the ether, there are signals which are sent on certain
frequencies. These signals indicate to the phone systems who is
connected to whom, and most importantly, who pays for what. As soon as
the hackers have found out which frequencies are used for these
signals, it becomes child's play to fool the receiving system with
counterfeit signals and make it pay for the call.

The telco has started the counter-attack. Telekom spokesman Juergen
Kindervater: "We are in the process of installing technical blockers
in the network which will make access more difficult".

The hackers are not discouraged by this. The have started to offer
their software package "Blue Box" (cost inclusive one year's warranty:
DM 25,000 or $12,000) to a wider public -- as yet under the counter.
If the telco should change its system, that wouldn't be a problem, the
hackers assure potential customers. The program could always be
adjusted to allow for new measures. "Kimble", the alias of the hacker
who wrote most of the program, is convinced that this system is
"perfectly legal in Germany" and plans to start a company to publicly
market his program.

Telekom spokesman Kindervater compares the situation to a
tortoise-and-hare race. As soon as telco technicians close one
loophole, the hackers have found a new one. Kindervater: "We won't
have a chance until we can separate the voice and signal channels."
This is supposed to happen by next spring when Telekom introduces the
new digital "Signaling System Seven". A Hamburg hacker comments
gleefully: "A digital network will increase our possibilities even
more. We'll be able to get into anything, even the main telco
computers."

The damages caused by these "telecom-parasites" are still
comparatively small (according to Kindervater), maybe in the tens of
millions of Marks. But the future perspectives are disquieting. German
and Austrian telco officials are afraid of the specter of Eastern
European companies who might want to increase their communications
budget by purchasing this software from the German hackers. That could
raise damages into the billions.

The software functions equally well in Austria. One simply uses the
Austrian "freephone" prefix, 0660. While Austrian telco spokesman
Stadbauer claims that this has not yet happened in Austria, and that
measures are in place to prevent it, "Kimble" claims that several of
his customers are using Blue Box in Austria.

Telco technician Adalbert Dirnboeck admits that the Austrian security
network is not yet perfectly tight: "The analogue portion of the
network still has some loopholes, but the digital portion is safe."
Very reassuring, especially since two-thirds of Austria's 0660 numbers
are still handled by the analogue portion of the network.

In any case, "Kimble" is not fazed by the prospects of a digital
network. "Blue Box will still work -- we are demonstrating that even
now in Hamburg, which is already digital."


Wolf N. Paul, Computer Center    wnp@rcvie.co.at
Alcatel-Elin Research Center     +43-1-391621-122 (w)
Ruthnergasse 1-7                 +43-1-391452 (fax)
ELIN RESEARCH   A-1210 Vienna-Austria/Europe  +43-1-2246913 (h)