Download - Ft Smith 2600

Ft Smith 2600

January Meeting

Subjects of Interest• Owning Western Union

• Swag for Sale

Owning Western Union

• Well sort of…

• Primarily a prank

• But, just like many flaws or faults, it can be used to gain a foothold in to a system


• The malicious exploitation of this flaw would be classified as social engineering

• Social engineering often includes lying or “truth manipulation”

• If you are not comfortable with this fact, you should not get into social engineering


• In order to put a face to a name, this is a western union kiosk.


• Requirements or tools:– Cell phone– Pen and paper (or fancy cell phone)– Maybe some phone cord and a female coupler– Maybe a regular phone (princess)– A little muscle– No fear– A ridiculously complex and convincing Western Union

(W.U.) mimicking system using asterisk or a real PBX to collect credit card numbers, DL numbers, SSN’s, etc.


• First, pick up the little phone and listen to the auto-dialer dial.

• If it doesn’t dial, or you have to manually dial it wont work.

• Locate the phone cord that comes out of the kiosk and trace it to the wall jack.


• You should see two things. – One thing a wall jack

– The other the auto dialer

• Note the access code and the procedures as to how to program the dialer


• Unplug the line from the kiosk to the auto dialer, then plug it directly into the wall jack.

The phone cord is usually right here

This is where the extra phone cord may be useful


• Next dial 1-800-444-4444 and take note of the phone number that it says you are calling from.

• If you cant do that, call W.U. (from that phone) and tell them that you are the manager of <store name> # <number> and you need the phone number for this line

• or call your cell phone and write down that number


• Ex:– Call W.U.– “hi W.U. how can I help you?”– “hi this is Betty Jansen of store # 1337 and I

need to confirm the number for this line. Could you verify for me? I have <10 digit phone number>. Is that correct? ”

– They give you number.– “is that all ma’am?”– “y0u Be4n h4><3D!!@12lol11!”


• Plug the phone back into the auto dialer

• Dial the number you got on your cell following the instructions on the auto dialer

• Program the phone to dial your asterisk box

• Hang up and use the phone to test out the setup

• Start collecting peoples docs


• A friendlier, slightly less illegal thing to do would be to program the phone to dial 1-800-373-3739 (1-800-freesex)

• Observe for a while and watch peoples reactions.

• Don’t forget to shout “y0u Be4n h4><3D!!@12lol11!”

The End… or is it?

Go out and try out some variants in a higher

Traffic location.

Swag for sale

• We can get t-shirts in all sizes and colors– The t-shirts can say whatever – The t-shirts all have Ft. Smith 2600 on them– Embroidered text available in most fonts

– First 3 people to sign up when I get the sheet together and drop it off get a shirt @ 4 dollars vs. the normal 8 dollars

Prices

• T-shirt S-XL $8

• Polo S-XL $12

• Hat $10

• Hood sweat S-XL $20

• 2XL + $1 3XL + $2