Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Pen-Test
[Top] [All Lists]

Re: listening to people/offices when on-hold on the phone

Subject: Re: listening to people/offices when on-hold on the phone
Date: Fri, 22 Jun 2007 11:12:43 -0700
Many years ago, when call-waiting was still a relative novelty, I
found that I could occasionally hear the conversation on the other
connection.  It was very, very faint, and I had to really hold the
phone to my ear to be able to make out anything clearly, but sometimes
people spoke loudly enough to allow me to make things out clearly.  I
overheard a few interesting things here and there, including some more
candid things about people I knew than I expected to ever know.

Now, with hold systems that are frequently indistinguishable from
mute, it's not that difficult to set this up, and I do keep this in
mind when I'm told that I'm put on hold, especially by someone withing
my own enterprise.  Politically (in)sensitive comments can come back
and bite one rather severely

From a legal standpoint, I wonder what the effects of this are. If
you tell someone that they're being put on hold, is there a
presumption that you're blocking all voice traffic over that circuit?
If there's nothing that's been said about monitoring, does pressing
the mute button instead of hold constitute monitoring of the line?
You are one of the active parties on the call, and so long as you're
not recording the conversation, you're probably not falling afoul of
wiretap laws, but these can sometimes be ambiguous.

Interesting question there, Robin.


Jarrod

On 6/22/07, Robin Wood <dninja@gmail.com> wrote:
Hi
Imagine the situation, you get a message to call someone, your call
gets answered by an automated system which says there may be a few
minutes wait and gives you the bad hold music. You hit the hands free
button on the phone and get on with work while you wait for it to be
answered.

Unless you mute the call, the person/system on the other end of the
call could be listening in while pretending to be on hold and
potentially hear all that is going on around you.

It is a random attack vector but it could allow an attacker to pick up
all sorts of information. I thought about it while sitting on hold for
over 30 mins trying to get through to my mobile phone support line
last night. If they had been listening they would know what I had for
dinner.

Anyone tried listening in like this? Anyone got any comments?

Robin

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------




--
Jarrod Frates
GAWN

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------

<Prev in Thread] Current Thread [Next in Thread>