“Phreaking” is the telephone system’s version of computer hacking, and in today’s world of IP telephony, there is little difference.
Many VoIP and traditional phone systems include the ability to make outbound phone calls from your voicemail, so you can ‘toll-hop’ (i.e. avoid long distance charges on your own phone bill). It’s also a convenient way to call business contacts so they see your business number as your caller-id instead of your home or cell phone.
Using weak passwords on your voicemail is all too common, and I constantly urge my clients to choose passwords that are NOT common (1234, 0000, 1111, etc.).
Even if you have a ‘unique’ password, there’s still only 10000 options with a 4-digit code, and given that users rarely, if ever, change their voicemail password, the chances of someone gaining access to your voicemail are higher than nil.
Here’s some quick rules-of-thumb:
- Do not use consecutive digits (e.g. 1234)
- Do not use repeating digits (e.g. 1111)
- Use a password LONGER than 4 digits – each extra digit increases the number of possibilities 10x (5 digits = 100,000 options)
- Don’t tell anyone your password.
- Change it (have you ever changed it?).
- If your phone system supports it, turn off the ability to make outbound calls from your voicemail, and force users who have the function to use longer passwords.
- If you manage phone systems for other businesses, take the time to educate your clients about these ‘rules’ and turn off the toll-hop features unless they want it enabled (and then tell them about these rules again).
As we’ve seen in the UK news recently, voicemail hacking is real, and it can happen here too.
I have a client (whose Norstar phone system we do not manage) who was a recent victim of a ‘phreaker’, and the phone company called them up one day and said they owed something over $50,000 for calls to Tunisia.
They turned off the toll-hop feature and changed their passwords.
Tags: Untagged