Ep 1: The Phreaky World of PBX Hacking

It's just before dawn in a February morning in a quiet residential neighborhood in Karachi, the city in Pakistan. Pakistani's chief intelligence officer Mir Mizar Jabar is walking towards the home of a hacker who he's been tracking for over two years. Behind Jabar is a team of Pakistani police officers. Jabar arrives at the front door and knocks.

You're probably already aware the FBI has a top 10 most wanted criminals list. But what you may not know is the FBI also puts out a cybers most wanted list, which is a list of FBI's most wanted hackers. Jabar and his team are about to raid the house of one of FBI's cybers most wanted. Just then the door opens. Jabar and his team forcefully push the door open and raid the house.

This is Darknet Diaries. True stories from the dark side of the internet. I'm Jack Recider. They did the whole thing in a single weekend when nobody was in the office. That's Adam Finch, a victim to one of these types of attacks. We didn't even know about it until a month later when we got the bill. He's talking about his phone bill. The bill was $24,000 more than normal.

Why was it so high? The bill said we had called multiple pay per minute numbers. Like 1,900 sex and psychic chat lines? Exactly. We tried to refute the charges with the telephone company, telling them we didn't make these calls. What did they say? They basically said tough luck, pay up. We did go to the police, but they didn't seem to care and ultimately gave us no help.

Adam didn't want me to reveal what company he works for, because it's embarrassing for the company. Adam's company did pay the charges though, because there was no other option.

You may be wondering why somebody would break into an office and rack up an enormous phone bill for someone else. But here's the crux of the hack. The hackers were dialing pay per minute numbers that they owned. With this attack, they literally are turning other people's phones into ATMs. There are two main methods hackers use to do this. Method one.

The hacker will call a desk phone in a random office. But it's 7 p.m. And it's Friday. So nobody picks up. The call goes to voicemail. But some phones have the ability to check voicemail remotely. The hacker will first try the last four digits of the phone number. This is usually the default pin for a voicemail box.

Once they get into voicemail, they're looking for a specific configuration option. To activate Do Not To Serve, press 1. To change a permanent forwarding number, press 2. Bingo. Call forwarding. The hacker sets the call forwarding number to be the number of their paper minute line. Now the next time anyone dials a phone, it will place a new call to the paper minute line. Method 2.

This method is a little bit more involved. Many companies are adopting voice over IP or VoIP phones in their office. This is where the phone plugs into the regular office network and not the plain old telephone system. Most of the VoIP phones are dumb. They don't know what to do without the help of another system. And that other system is called a private branch exchange or PBX.

When someone picks up the handset of a phone, the phone freaks out and says to the PBX, help, someone just picked up the handset. What do I do? The PBX is very friendly and says calm down, just play a dial tone. And when the user pushes a number, the phone panics again and asks for help again. And the PBX says, don't worry, just play a digit tone. And this continues until the user pushes enough numbers and the PBX connects the call.

But the problem is, the PBX is sometimes too helpful. Nobody taught it who can and can't make calls. It wasn't properly secured. Anyone who knows the IP address of an insecure PBX can make phone calls that originate from that office.

With this method, hackers find the IP address of PBXs and try to make a call using that PBX. They configure their phone, pick up the handset, and check for dial tone. This takes patience by the hacker because they have to hunt and poke into the darkness of the Internet. But eventually they pick up the phone and hear a dial tone. To a PBX hacker, that is the sound of money.

Now the hacker begins making calls to the pay-per-minute numbers. And they use robo-dilers, dialing hundreds of times a day, or thousands of times on the weekend. Calls are made to Guinea, East Timor, Lithuania, and for every minute connected results in more money for the hacker. More and more calls are made, more and more minutes are racked up, and this continues until someone, somewhere, notices the calls and stops them.

I guess my first question is, why can't the victim go to the phone company to refund the charges?

Paul has been protecting companies from PBX hackers since 2012. He says the phone companies have a legal right to collect any fees their customers accrue. This is usually spelled out in the contract.

But most importantly, the PBX is not property of the telecom. It's owned by the victim. It was the victim's own negligence of security that resulted in this attack. Just like when an ISP gives a company an internet connection, they aren't liable if that company gets hacked. How much is PBX hacking costing people yearly?

The best evidence is from the Communications Fraud Control Association. They estimate that PVX hacking is costing the business community in excess of $10 billion per annum. That number, $10 billion, has doubled in the last four years. There's absolutely no doubt that the fraud is on the rise and it's primarily due to the vulnerabilities around voice.

These VoIP vulnerabilities are simply that companies aren't taking the steps to secure their PBX correctly. Often a business doesn't have anyone capable of configuring a PBX, so they outsource the job to a contractor. But they often go with the cheapest contractor to save money, which results in an insecure or hastily configured PBX.

It's not an easy task to properly secure a PBX. Since the PBX must be on the internet to receive incoming calls, you can't simply block all incoming access to it. To further complicate things, some offices have mobile workers who have their office desk phone at home. So now a PBX needs to be configured to allow calls initiated from the internet. It's a delicate balance between what's allowed and what's not allowed. What's the average bill for a victim?

What we're seeing is the company with an average of 100 users on the phone system, they get compromised on a Friday night. On Monday morning, their phone bill will be in the age of 60,000 euros. Are the police able to help victims of this crime? No, because the police aren't aware of it. They're used to other types of crimes. They know how to investigate, but when

If this incident occurs, they don't have the resources to even understand what the crime means and how they would go about investigating it. As Paul said, the police just aren't equipped to handle international crimes. Calls are almost always going to foreign countries, such as East Timor, Cuba, Latvia, even Zimbabwe. Many of these crimes don't get reported. Companies fear bad publicity if they say they've been hacked.

Sometimes victims contact the FBI, but the FBI is usually only interested in threats against the government or the country, or crimes that were over $1 million in damages. And most of this PBX hacking is in the tens of thousands. The FBI does appreciate when people report the crime, since it helps them collect data to build a case.

In 2012, the FBI did receive enough reports about PBX hacking that they began looking at the data. And somehow, they were able to track down who was making these phone calls. While looking at the data, patterns began emerging, which eventually led them to two men, Faran Ashad and Nura Azizadun.

Somehow, the FBI found out that the two men were on a flight to Kuala Lumpur in Malaysia. So the FBI contacted Interpol to arrest the two men. And within hours of the two hackers arriving in Kuala Lumpur, Interpol raided their hotel and arrested both of them. The FBI was thrilled and began sending extradition requests to Malaysia.

But after being held for 60 days, the Malaysian Attorney General let them both go free. According to the official report, the Malaysian Attorney General said, the arrest warrant obtained by Malaysian Home Ministry violated the technicalities involved in the requirements of the extradition act of 1992. Malaysia believed they had arrested these two men illegally.

Faron and Odin both immediately fled the country, got out of Malaysia and went back to Pakistan. The very next month, the FBI indicted both men, and they added them to the Cyber's Most Wanted list and offered a $50,000 bounty for any information leading to the rest of either one of them.

I'm looking at the indictment form now and it shows a list of victims that were targeted by these hackers. And I want to share with you the top three highest charges that I see on this list. A company in Carlstad, New Jersey is claiming that they lost $78,000. A company in Englewood, New Jersey is claiming they lost $83,000.

But the highest one on the list is the Township of Parsippany, Troy Hills in New Jersey. They're claiming these hackers racked up a phone bill of $395,000.

According to the indictment report, the FBI claims these men dialed for 13 million minutes from 4,800 different hacked phone numbers. And once the FBI had a warrant for their arrest, they notified Pakistan, which is where they thought these two men were living. In a Pakistan, the FIA began researching it. The FIA is the federal investigation agency similar to the CIA in the US.

And the chief security officer of the FIA is Mir Mizar Jabbar. And for years, the FIA had no leads towards catching these two individuals. Then the FIA got a tip. Somebody had claimed they knew the cell phone number of a din. The FIA then worked with the telephone company to track down the GPS coordinates of that cell phone. And that's when Jabbar raided the home of a din.

Not only did he catch a din, but Arshad was there in the house, too, and both men were arrested on February 14, 2015. It's ironic, don't you think? These two phone hackers were brought down because their phone number became known.

In total, the FBI claims they cost $50 million in damages. What did Uddin do with the money? He purchased about 50 plots of land around Karachi, his hometown of Pakistan, and was even investing about $400,000 in various local business ventures. And now two years later, both men continue to sit in a prison in Pakistan, still awaiting their trial and sentencing.

These two men were arrested for PBX hacking, but there are thousands of other PBX hackers that haven't been caught. And even though we don't know who they are or where they are, we do know one thing is for certain. PBX hacking will continue until security improves.

You've been listening to Darknet Diaries. For show notes and links, check out darknetdiaries.com. Music is provided by Ian Alex Mack, Srow, Hicom Kehiti, and Podington Bear. A1 B2C3D4A5F6G7H8.