Tuesday, January 17, 2006

How do they do that? Techniques of phone record vendors

Wired News is running an article by Kim Zetter on the sale of phone records. The article is notable because it discusses at least one of the tactics used by these "services" to get phone records:

Wired News: Devious Tactic Snags Phone Data

According to the suit, online cell-phone record vendors placed hundreds of thousands of calls to Verizon customer service requesting customer account information while posing as Verizon employees from the company's "special needs group," a nonexistent department. The caller would claim to be making the request on behalf of a voice-impaired customer who was unable to request the records himself. If the service representative asked to speak with the customer directly, the caller would impersonate a voice-impaired customer, using a mechanical device to distort his voice and make it impossible for the service representative to understand him -- a variant of a widely used social-engineering technique known as the "mumble attack."

Rob Douglas, a private investigator turned privacy activist, says federal authorities have known about the sale of private phone records since at least 1998 but have done little to address the problem. In the absence of federal action, phone companies have been resorting to civil lawsuits to prevent sellers from obtaining and selling records.

Technorati tags: :: ::

1 comment:

David Canton said...

Also see Techdirt's spin on this at: http://techdirt.com/articles/20060117/0154207_F.shtml

While these dislosures should not happen, they point out how difficult it can be to discern legitimate requests from illegitmate ones.