Euroscene 1/Euroscene 1.iso/diskmags/resident/2_resident.dms/2_resident.adf/Data/021

Text File | 1993-04-02 | 16KB | 460 lines

¶2xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

¶3  THE BIGGEST PHONE FRAUD IN EUROPE

¶2xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

By Erik Løvendahl Sørensen

¶1In   an   idyllic   little  town  near
Silkeborg   in   Denmark   lives   "Mr
Banditt",  as  he  is  called  by  his
friends,   a   young   19   year   old
manwaiting to appear in court, accused
of  having abused the telephone system
and  telephone  credit cards, known as
"calling  cards", to a value in excess
of $ 10 million.

¶3ONE OF THE HACKING WORLD'S TOP FIGURES
¶2--------------------------------------
¶1Denmark   has  had  several  cases  of
telephone  abuse and hacking in recent
years.    Two  examples:   the  Danish
hackers  Jubjub Bird and Spockets have
been  discussed  a  great  deal in the
Danish  media;  and  then there is the
BBS  case  from  Copenhagen  where the
owner  of  one of Denmark's best known
Bulletin Boards "Valby Amiga BBS"waits
for  the high court's verdict.  Common
to  these  cases is that the police up
to now had only caught the small fry.

¶3         POLICE CLAMP DOWN
¶2--------------------------------------
¶1In  the  meantime,  on March 12th this
year  the police got one of the really
big fish "hooked".  A house search was
undertaken   after   a   long  lasting
surveillance  of the involved person's
telephone conversations and mail.

¶3            THE RESULT
¶2--------------------------------------
¶1The   police   investigation  has  now
finished,  after  several  hours' work
and  the  result  is  shocking.   They
believe  that  they  can prove that Mr
Banditt,  with  the rather more normal
first name "Kristian" has swindled the
American  phone  company  AT&T  out of
several hundred thousand dollars.  How
many  hundreds  of  thousands  will be
impossible  to  evaluate exactly.  The
swindle  has  also been perpetrated in
Denmark,  where  Mr Banditt has phoned
free   by   illegally  using  a  phone
belonging to Aalborg local council.

Mr  Banditt  has distributed more than
1500  stolen "calling cards" around in
Europe.   A  large number of the cards
were    sold    for    $100    monthly
subscription  to  a  number of regular
customers    around    Europe.     The
recipients have thus had the chance to
phone  without  paying  by using these
cards.   It  is  there-  fore possible
that  the  case  is  of  even  greater
extent,  and  that  the  real  numbers
relate to around 5000 "calling cards";
but   in  these  technical  cases  the
police  often  find it hard to map out
and  clear  up  all  the  sharp tricks
which the hackers use.

When   one  is  talking  about  stolen
calling  cards,  it  must be mentioned
that  it is not the actual cards which
are  stolen, but the pin codes and the
other  information which are necessary
to use the cards.

How  does  one  come to the sum of $10
million?   It  is  alleged  that every
single card can be used for an average
of  60  hours and the cards are mainly
used  for  phone  conversations to the
USA  which  cost nearly $2 per minute.
Yes,  all  in  all,  then one comes to
this  gigantic sum according to Danish
calculations.

¶3       THE ACTUAL METHOD USED
¶2--------------------------------------
¶1It  doesn't  require  great  talent to
cheat  the phone companies and, in the
long run, the subscribers.

In  this  case  one  of  the  simplest
standard   methods,   the  con  artist
method was used.  This method requires
the  telephone subscriber being phoned
by  someone  who introduces himself as
from   the   phone   company's  safety
depart-  ment.   One  is  asked  one's
name,  if  one  has  a  calling  card,
because  an  unusually  large  sum has
been  withdrawn  from  the card in the
last  48 hours.  The subscriber claims
that  he  hasn't  even used it in that
period.    The   con   man   asks  the
subscriber to find the calling card so
that he has it in his hand.  They chat
to and fro, and a little later the con
man   offers   to   run   through  the
customer's  whole  account  and send a
new  card  within  the  next  3 weeks.
(The customer is very happy with this,
because  his  own  phone calls will be
cancelled at the same time).

There  is  no  reason  to  follow  the
conversation  any further.  In hacking
circles instructions circulate (we hav
e   an  example  here  in  editorial).
These  instructions describe in detail
how  one  tracks  down  the victim and
then  "pump"  him  for  his  pin-code.
(The  first number is the subscriber's
phone   number,  which  the  trickster
already   has).    Unfortunately  many
people let themselves be cheated, when
the con man uses the right questioning
technique.

This calling card number which is been
swindled  out  of  the poor subscriber
can  now be used by the swindler for a
month  before either the subscriber or
the  phone  company  suspects anything
and stop the abuse by closing down the
account.

¶3  EVEN A PROFESSIONAL CAN GET CAUGHT
¶2--------------------------------------
¶1One  can  guess  how  Mr  Banditt  was
found.  The notification to the police
in   March  was  carried  out  by  the
Telegraph Inspector Peder Poulsen from
"Telecom Denmark", so one could reckon
that  it  was a tip from the USA which
led  to  the case.  Freddy Hansen from
Telecom  Denmark reports that they are
regularly  contacted, both at home and
abroad,    and   also   from   private
customers  about  the abuse of foreign
phone  calls.  Unfortunately in only a
few  cases  has there been any success
in  tracing  the abuse and getting the
swindle stopped.

Mr  Banditt  believes  himself that he
was  caught  because, in his over-con-
fidence  he  broke one of the hackers'
unwritten  rules  by illegally using a
Danish   PBX  phone  at  the  "Aalborg
Elderly  Handicapped  Research Centre"
for a considerable length of time.  (A
PBX  phone  is  one where calls can be
passed  on  from  outside  to  another
number  and  where  the  phone  caller
themselves  does  not actually pay for
the call.) These phones are often used
by  sales  people  and the like.  Then
the bill maybe finally arrives and the
subscriber   naturally   contacts  the
phone  company  because  the  bill  is
suddenly  so  enor-  mous.   The phone
company  sniffs around a little on the
subscriber's  lines  and  suddenly the
trap shuts.

¶3           THE PUNISHMENT
¶2--------------------------------------
¶1"The  court case is not finalised, but
will  probably be in September - Octo-
ber   1992,"(This  article  is  pretty
old...   -Ed) informed chief constable
Paul  Kühl in Denmark, "but it will be
interesting   to   hear  the  sentence
because   nothing  tangible  has  been
stolen  (if that was the case, the law
would have been considerably stricter)
and   therefore   one  must  expect  a
suspended sentence because the man has
no previous convictions."

Telephone   fraud   in   the   USA  is
estimated   costs   about  $5  billion
annually  so  we are not just worrying
about  small  change.  Small groups of
immigrants  gather  on street corners,
in  subways  and in coffee bars around
with a dealer who, for around $10, can
"get  you a 2 hours phone call home to
Italy  or Poland".  The United Nations
alone   is   defrauded  of  around  $1
milliard  annual-ly, NASA and IBM come
in  at  second  place because they are
defrauded   of  around  $1/2  milliard
annually.   The American phone company
is  thus  being  systematically milked
and  with  an  efficiency  and  extent
which  can  only  be  surpassed by the
American  whisky  hooch gangsters from
the  days  of  prohibi- tion in 1920's
America.   The  phone  company  AT&T's
profit  is  droped 84 % this year, you
maybe now know a little about why?

Many young students in the USA find it
totally  natural to "cheat" free phone
calls  on the phone network.  They did
not  consider  it  a crime because, as
they  say  "the phone network is there
anyway,  we  just make sure that it is
used  more efficiently." This attitude
has  also spread to Europe where maybe
every  other  computer-interested high
school student has either them- selves
accessed  illegally  into a free phone
line or knows someone else who does.

¶3ARE CREDIT CARDS BEING USED ILLEGALLY?
¶2--------------------------------------
¶1There  are  also an innumerable number
of  account  cards  in  the  USA;  one
almost  measures  an American's status
and  success  on the basis of how many
account  cards  he  has.   The  really
tough  guys can often present a row of
cards a yard and a half long or more.

The  same  methods  as  described with
"calling  cards"  are also used by the
swindlers   on  ordinary  bank  credit
cards  like,  for example, Visa cards.
It  is, however, much more seldom, but
the  amount  of talk about these cards
in  hacking  circles  indicates that a
certain  amount  of  abuse  and  fraud
happens  also  where  these  cards are
concerned.   The police are only aware
of, by and large, rumours.  One cannot
depend  on information from the police
being of great reliability with regard
to  this  type  of fraud since it is a
well known fact that they see only the
top of the iceberg.

Information  about  hacking  or  fraud
concerning  Visa cards is preferably a
rumour  one  only  hears  about  third
hand.   In  a single episode, a couple
of   months  ago,  I  met  a  computer
specialist  who held the same mistrust
of  these  stories as I do.  Whil e he
was working for an American network, a
hacker   suddenly   logged   into  the
network.   They  talked  a  bit  about
hacking and various forms of fraud.

The  hacker discussed, while they were
talking, how easy it was to use credit
cards   illegally,  eg.   Visa  cards.
When  the  hacker's story was rejected
as  being  just  so  much hot air, the
hacker   got  rather  pissed  off  and
finally  said:   "Now  you  can see on
your  own  card, I'm going to take one
dollar  off your card's account on the
15th   of   the  month."  It  actually
happened!

¶3      WHO PAYS FOR THE MISUSE?
¶2--------------------------------------
¶1Up  to now it has been the practice of
the   US   telephone   companies  that
customers,  who  have  been victims of
misuse  avoid  paying  the bill.  This
has  recently  changed because several
young  student  computer  freaks  have
abused  the  system  and  have  "lent"
their  calling  card  numbers to their
computer  pals  in  Europe.   This was
because   the   phone  company  always
dropped  demand  for  payment  when it
came  to  the  crunch, so there was no
risk  in  letting someone else use the
card.

Now  this gap has been plugged so that
the  phone  company  AT&T  only  drops
demands   for   payment  in  a  single
instance.    If   the   abuse  happens
several   times   on   a  subscriber's
calling  cards,  then there's no fairy
godmother  to help out.  The money has
to be handed over - cash on the table.

In   Europe  the  telephone  companies
practice  a significantly tougher line
because they have no general rules.  A
number  of cases where the subscribers
have been confronted with a phone bill
in  the  region  of  10-50 times their
normal  size have been talked about in
the daily papers.

¶3  ARE THE PHONE COMPANIES FAILING ?
¶2--------------------------------------
¶1In  recent  years there have been many
cases  mentioned  in  the  press about
people  who  have had incomprehensibly
large  phone bills.  In most cases the
people's  complaints  are  refused and
there have been examples of pensioners
who  had  to  pay  a quarterly bill of
around $2,500, or have their phone cut
off.  Is there something in it?  Maybe
there  is  something in all this talk?
Is the technology at fault, or what?

It  has  become  a "national sport" of
the immigrants and refugees to be able
to  cheat  a  phone call home to Italy
without  paying, or wherever they come
from.   There  are  several methods to
cheat  yourself a free call, maybe 6-7
different methods.  Common for most of
the  methods  is  that it ends up with
someone  else footing the bill for the
"party".

There has been heated debate about the
phone  companies' new service numbers,
the  so  called  "sex  lines"  or  900
numbers.   It  is  a  fact  today that
there  has  been  comprehensive  abuse
here,  and  it is hard to imagine that
an  80  year old lady should have used
$2000  to $3000 to get canned sex over
the phone.

The  last  category of telephone abuse
is  what  is  known  as  "data abuse",
where  young computer freaks "get hold
of"  free phone lines so they can hack
into    large    private   or   public
data-networks.  In the most cases they
only  do  it  to  prove  that they can
crack  the  passwords and bypass other
security  devices.  Only exceptionally
is   it   to  steal  or  destroy  data
information.

¶3  YOUR OWN RESPONSIBILITY IN DENMARK
¶2--------------------------------------
¶1According  to  Christian Voetmann from
the  legal  department  in  the Danish
phone   company   KTAS,   the  company
recognizes  the  problem  of telephone
abuse,   but   deny   that   they  can
generally  let  people off their phone
bills.  Only in very rare cases, where
it  can  be  proved that the equipment
has  been  faulty or "got at" will one
be  let  off  a phone bill.  Christian
Voetmann   says   that  people  should
especially  be  aware  that  the phone
company's  responsibility stops at the
extremity   of   the  monopoly,  ie  a
person's    house.     Thus   if   the
customer's  equipment  is  a  cordless
phone,   switchboard  or  any  similar
indoors   equipment,   these  are  not
within  KTAS's area of responsibility.
The  responsibility  is solely that of
the user.

There  have  been  several examples in
Denmark of the abuse of what are known
as PBX systems, where the hackers have
abused the phone lines.  But Christian
Voetmann   maintains:    "People  have
bought  their  equipment outside KTAS,
so   we   absolve   ourselves  of  any
responsibility for abuse."

This  position can lead to interesting
perspectives.    There   have  been  a
couple   of   examples   of  break-ins
recently,     where     the     police
investigation   has  proved  that  the
burglar  had  apparently  broken in to
use  the  phone  free.   In such cases
both   the  phone  companies  and  the
insurance  companies  have  refused to
pay   the   people's   bills  and  the
customer  alone  has  to bear the pain
and delve into his own pocket.

¶3  INCITEMENT FROM THE PHONE COMPANY?
¶2--------------------------------------
¶1The  methods  of  abuse, fraud and the
like  change and alter at the speed of
light  following  opportunities  which
arise    when    new   technology   is
introduced.   Cunning  people  exploit
the  loopholes  in the new technology.
One  tries  to  block  opportunity for
abuse  and the like.  People who don't
like  paying  tax  and prefer to think
creatively  can be stopped by blocking
the  loopholes  in  the taxation laws,
but  new  loopholes open all the time.
Yes,  in  the  same  way  that  it has
become  a  national  sport to cheat on
their  taxes,  if  people can get away
with  it;  many  young people feel the
same  way  about the new technology in
the  data  world.   It  has  become  a
challenge,  and  it  has  to be bloody
well  beaten.   One cannot deny either
that the young computer-mad people are
incited  to  it when they read or hear
on  the  TV  that this or that is 100%
secure and cannot be abused.

It   is   clear   that  if  one  wants
customers  for  every  type of account
card,   then  one  should  tell  these
customers  that their money is secured
by  the best means against abuse.  But
this can so easily be exaggerated that
it  approaches  incitement  to  abuse.
Certain  phone  companies  in the USA,
but  also  truthfully  in Europe, have
experienced      that     transmitting
"official"    speeches   about   their
security  has led many hackers and the
like  to  prove  the opposite, because
they   know   that   what   was  being
officially   said  in  the  media  was
actually  a  lie.  The moral:  "If you
can  lie,  then  we can cheat, and the
two  are  unfortunately  not  very far
apart".