Phonetic attack commands crash bank phone lines

[Viktor 669]

A security researcher has demonstrated a series of attacks capable of disabling touch tone and voice activated phone systems or forcing them to disclose sensitive information.

In one test, a phone system run by an unnamed Indian bank had dumped customer PINs.

Attacks including blind SQL injection and buffer overflows could be served to almost any interactive voice response (IVR) phone system, according to Rahul Sasi, a security researcher with iSight Partners.

He said the attacks could take down critical phone systems, cutting off banking services or the ability of call centres to field customer inquiries.

“If someone can crash a banking app from anywhere in the world, that’s critical,” Sasi said.

“No banks or organisations are testing IVRs because they think the systems are secure, but in reality they are not. No firewall or CAPTCHAs monitor voice traffic.”

The attacks were limited to the characters available within dual-tone multi-frequency signalling (DTMF) systems, which could include numbers and letters, but not most special characters such as backslashes.

Видео:

http://vimeo.com/49583283

Источник