[comp.dcom.telecom] AT&T's Call Manager: Security Problem?

"Sander J. Rabinowitz" <0003829147@mcimail.com> (05/09/91)

On May 5th, I wrote the Moderator to ask him to clarify AT&T's Call
Manager for me.  Here's what he wrote:
 
> [Moderator's Note: When I used it here (0 + NPA + 7D - pause for tone
> - enter 15xx), the call was processed, and the billing came to my line
> the following month with notations on the bill entitled 'account code
> xx', where 'xx' was the two digits I had entered after the '15' when
> making the call.  It appears nothing further is required to use this
> service.   PAT]
 
First of all, I think it's good that AT&T is doing this, and I plan to
use the service myself.  Having said that, however ... isn't there a
security problem that arises whenever 15xx can be substituted for a
valid calling card number?  I would hope AT&T has a way of blocking
this particular service for people who so request it ... indeed, it
would seem blocking would become mandatory in certain situations (ie.,
public telephones, COCOTS).
 
 
Sander J. Rabinowitz   | sjr@mcimail.com -or-  | +1 615 661 4645
Brentwood, Tennessee   | sander@attmail.com    |
                       | The usual disclaimers apply.


[Moderator's Note: I beleive it is blocked from payphones, but I don't
know about COCOTS. It would be interesting to find out how it responds
to 10288 plus calling from a COCOT.   PAT]

johnl@iecc.cambridge.ma.us (John R. Levine) (05/13/91)

Being an inquisitive sort of guy, I investigated call manager codes
from pay phones the moment I heard about them.  Around here (Cambridge
Mass, New England Tel territory) a 15XX code entered on a payphone on
an AT&T call gets a quick recording that the service I have requested
is not available and it hangs up.

On NET calls, as soon as I dial 15 it cuts in with a recording reminding 
me to dial 11 for collect, 12 for third party, the card number for a
calling card call, or 0 for an operator.

Via MCI or Sprint, they don't know from call manager, but they do know
that it isn't a valid card number, since no Bellcore-format calling
card number or PIN starts with a 1.  (Note that 0 + number via MCI or
Sprint only accepts a local telco card number, not an MCI or FON card
number, unless you fall through to the operator and let her enter it
manually at extra cost.  Don't ask me why.)

The COCOTs around here are always broken, I don't know what they are
supposed to do with call manager codes.


Regards,

John Levine, johnl@iecc.cambridge.ma.us, {spdcc|ima|world}!iecc!johnl

bicker@hoqax.att.com (Brian Charles Kohn) (05/14/91)

In comp.dcom.telecom, 0003829147@Mcimail.com (Sander J. Rabinowitz)
wrote on 9 May 91 02:42:00 GMT:

> I would hope AT&T has a way of blocking
> this particular service for people who so request it ... indeed, it
> would seem blocking would become mandatory in certain situations (ie.,
> public telephones, COCOTS).

Uh, if I'm not mistaken, this service only works from your home phone.
That is the security mechanism.

It's not a calling-card service per se ... it's just a record-keeping
tool.


Brian Charles Kohn          AT&T Bell Laboratories Quality Process Center
Quality Management System   E-MAIL: att!hoqax!bicker  (bicker@hoqax.ATT.COM)
Consultant                  PHONE: (908) 949-5850        FAX: (908) 949-7724
                             

foz@ihlpf.att.com (William F Thompson) (05/14/91)

 From article <telecom11.351.1@eecs.nwu.edu>, by 0003829147@mcimail.
com (Sander J. Rabinowitz):

> First of all, I think it's good that AT&T is doing this, and I plan to
> use the service myself.  Having said that, however ... isn't there a
> security problem that arises whenever 15xx can be substituted for a
> valid calling card number?  I would hope AT&T has a way of blocking
> this particular service for people who so request it ... indeed, it
> would seem blocking would become mandatory in certain situations (ie.,
> public telephones, COCOTS).

> [Moderator's Note: I beleive it is blocked from payphones, but I don't
> know about COCOTS. It would be interesting to find out how it responds
> to 10288 plus calling from a COCOT.   PAT]

Well, since I worked on the feature, I'll respond.  A customer can
only use the 15XXXX code from a non-coin, non-hotel sent-paid phone,
such as a residence or a business.  It shouldn't work from a COCOT
since those trunks are marked as coin.  By the way, you can enter up
to four digits after the 15 (and the 15 is changeable).  Just thought
you'd like to know.


Bill Thompson   att!ihlpf!foz