📸

numbers on the keypad until stumbling on a code. The process is time-consuming, but hackers are a patient bunch.

The losses to a company whose PBX is compromised can be staggering. Some hackers are known to run what are called 'call sell' operations: sidewalk or street-corner enterprises offering passers-by cheap long-distance calls (both national and international) on a cellular or pay phone. The calls, of course, are routed through some company's PBX. In a recent case, a 'call sell' operator ran up $1.4 million in charges against one PBX owner over a four-day holiday period. (The rewards to 'call sell' merchants can be equally enormous: at $10 a call some operators working whole banks of pay phones are estimated by US law enforcement agencies to have made as much as $10,000 a day.)

Just as PBXs have become the blue boxes for a new generation of phreakers, voice mail computers have taken over from hacker bulletin boards. The problem with the boards was that they became too well known: most were being regularly monitored by law enforcement agencies. Among other things, the police recorded the numbers of access device codes trafficked on boards. As the codes are useful only as long as they are live - the time, usually, between their first fraudulent use and the victim's first bill - the police monitoring served to invalidate them that much faster. Worse, from the point of view of hackers, the police then took steps to catch the individuals who had posted the codes.

The solution was to use VM. Voice mail computers operate like highly sophisticated answering machines and are often attached to a company's toll-free 1-800 number. For users, VM systems are much more flexible than answering machines: they can receive and store messages from callers, or route them from one box to another box on the system, or even send one single message to a pre-selected number of boxes. The functions are controlled by the appropriate numerical commands on a telephone keypad. Users can access their boxes and pick up their messages while they're away from the office by calling their 1-800 number, punching in the digits for their box, then pressing the keys for their private password. The system is just a simple computer, accessible by telephone and controllable by the phone keys.

📸