“War dialing” is the practice of automated sequential dialing of a block of numbers – it’s like portscanning for phones. Possibly the most classic example of this was from the movie War Games where Matthew Broderick’s character uses his computer (and an acoustic modem) to dial into the NORAD defense computer and play video games against “Joshua.”

I was on a call with a major vendor last week discussing some fairly sensitive roadmap stuff and realized that about 70% of all the dial-in conf calls we do with large companies don’t have any authentication to ensure we’re actually allowed to be there. They rely upon “security through obscurity” – basically it’s like reserving a conference room in a public place but not placing a lock on the door to control who can get in. I’m not advocating this shadiness but I can’t help but think about ways to exploit insecure systems. There’s unfortunately a significant opportunity for someone to take advantage of these open conference call lines. Here’s how:

1. Create a list of the dial-in blocks for the top companies that use these open lines with no authentication.
2. Write an app using something like Twilio that walks the # block on the hour (when most conf calls begin).
3. When it finds one in progress, start capturing the audio. Obviously it shouldn’t announce a name when prompted or, if required, play back something non-descript like “Bob from corporate.” How many times have you been on a big call and thought nothing when new people ding’d in without announcing themselves?
4. Index the resultant audio captures, add meta-data on where & when they were captured and sell the uber-sensitive ones on the black market in an IRC room.

Certainly some conf lines require that you enter the meeting number & passcode. But for the ones that don’t, be aware you’re leaving the door open literally for anyone to sit quietly in the corner on your conf calls and capitalize on the absence of security.