Tutorial - Unrestricted Modem on the Internet

Unrestricted Modem on the Internet

Summary

This vulnerability allows a remote intruder to anonymously dial a phone associated with a live modem.

Impact

By exploiting this vulnerability, a remote intruder can make long distance calls, leaving the owner of the line with a potentially high phone bill, and attack random targets.

Background

In the past, dial-out modems were often placed on one of a UNIX host's TCP ports without any protection. This was done to facilitate their use. New special purpose hardware with built-in protection facilities and authentication methods like S/Key and digital tokens, however, has made this practice obsolete.

The Problem

With this vulnerability, a remote intruder can anonymously dial from a phone associated with a live modem. When an unauthorized user can access a modem to dial anywhere, they can attack random targets and leave the modem owner with a potentially high phone bill.

Resolution

To eliminate this vulnerability, prevent Internet access of the modem by placing it behind a firewall or putting password or other authentication methods, such as S/Key or digital tokens, on the modem.

Where can I read more about this?

Read a bit more information about this vulnerability by visiting this site.