Information Security News: Business says hacker took a gigantic toll

[InfoSec News <alerts () infosecnews org>]

http://www.cmonitor.com/apps/pbcs.dll/article?AID=/20071222/NEWS01/712220352

By Ethan Wilensky-Lanford
Monitor staff
Concord Monitor 
December 22. 2007

Somebody called Saudi Arabia for 808 minutes from a Franklin business's 
phone line on New Year's Eve in 2005. Michael Bednaz, who owns the 
company, Hexa Interactive Communications LLC, said that it was not 
anybody from his office. AT&T has sued him for not paying a $14,653.62 
bill, which includes $8,695.60 from that one call.

Eight hundred and eight minutes is over 13 hours. The call was one of 
about a half dozen made overseas and billed to his business.

"It's called phone fraud," said Bednaz, who does not even use AT&T for 
his long-distance service. "I'm 100 percent sure that it wasn't any 
internal personnel."

His lawyer, Eric Sommers, explained that AT&T has a tariff defining a 
"casual user," when somebody dials a remote billing code, like 10 10 
288.

"Hexa never ordered the casual calling services," Sommers said. "They 
happened when Hexa was closed for business. They happened at 11 o'clock 
in the evening, 1 o'clock in the morning, to places where Hexa does not 
do business."

It's unclear who made the calls. Hexa has a password-protected voicemail 
system, like most businesses in the area.

"The system is not opened to the general public," Sommers said. "A 
sophisticated user who understands telephone systems could nonetheless 
hack into that system and access outside phone lines, which is 
apparently what happened."

Bednaz filed a report for theft of services with the Franklin police in 
February 2006, after receiving the unusual bill. He said he contacted 
the FBI field office in Boston, as well, in the hopes of help resolving 
the issue. He has not had any luck with AT&T, which he called "the 800 
pound gorilla."

The company was unmoved, and filed its civil suit against Hexa on Dec.
11. 


__________________________________________________________________      
Visit InfoSec News
http://www.infosecnews.org/