[ISN] How to DDOS a federal wiretap

http://www.computerworld.com/s/article/9140717/How_to_DDOS_a_federal_wiretap?taxonomyId=17

By Robert McMillan
November 11, 2009 
IDG News Service 

Researchers at the University of Pennsylvania say they've discovered a 
way to circumvent the networking technology used by law enforcement to 
tap phone lines in the U.S.

The flaws they've found "represent a serious threat to the accuracy and 
completeness of wiretap records used for both criminal investigation and 
as evidence in trial," the researchers say in their paper, set to be 
presented Thursday at a computer security conference in Chicago.

Following up on earlier work on evading analog wiretap devices called 
loop extenders, the Penn researchers took a deep look at the newer 
technical standards used to enable wiretapping on telecommunication 
switches. They found that while these newer devices probably don't 
suffer from many of the bugs they'd found in the loop extender world, 
they do introduce new flaws. In fact, wiretaps could probably be 
rendered useless if the connection between the switches and law 
enforcement are overwhelmed with useless data, something known as a 
denial of service (DOS) attack.

Four years ago, the University of Pennsylvania team made headlines after 
hacking an analog loop extender device they'd bought on eBay. This time, 
the team wanted to look at newer devices, but they couldn't get a hold 
of a switch. So instead they took a close look at the telecommunication 
industry standard -- ANSI Standard J-STD-025 -- that defines how 
switches should transmit wiretapped information to authorities. This 
standard was developed in the 1990s to spell out how telecommunications 
companies could comply with the 1994 Communications Assistance for Law 
Enforcement Act (CALEA).

[...]


________________________________________ 
Did a friend send you this? From now on, be the 
first to find out! Subscribe to InfoSec News 
http://www.infosecnews.org