SoylentNews is people
SoylentNews
The BBC reports that several Target stores in the US have had their public address systems hacked, resulting in explicit pornographic audio being broadcast across the stores, in some cases for more than 15 minutes at a time.
An email obtained by the BBC, sent by company bosses to Target store managers across the US on Friday afternoon, outlines a weakness in the store's PA system being used to carry out the prank.I've removed a key detail for obvious reasons.
"Non-Target team members are attempting to access the intercom system by calling stores and requesting to be connected to line [xxxx]," it reads. "If connected, callers have control of the intercom until they hang up. We are actively working to limit intercom access to the Guest Services phone only. In the meantime, inform all operators to not connect any calls to line [xxxx]."
So in other words, if you ring up Target and ask to be put through to a certain extension, you're suddenly live on the PA system for as long as you like. Hardly the hack of the century, granted, but a reminder that there are people out there that will find even the most obscure vulnerabilities and exploit them.
I don't condone breaching computer systems but I guess that's one way to draw attention to vulnerabilities. Too bad they didn't pick something more kid-friendly. Like broadcasting that for the next 60 minutes there would be an 80% discount on everything in the store.
(Score: 4, Interesting) by Snotnose on Monday October 19 2015, @01:15PM
In the early 80s, when 300 baud was bleeding edge, someone gave me a phone number and said "call this". Turns out it was the Montgomery Ward distribution system. No login, by connecting you were automatically logged in. You chose your item, gave a delivery address, and presumably voila, you got the item delivered.
I filled out everything for a TV, but chickened out when I got to the final confirm so I don't know if it really worked or not.
For you young ens, Monkey Ward was a large department store much like Sears.
I came. I saw. I forgot why I came.
(Score: 1, Informative) by Anonymous Coward on Monday October 19 2015, @01:45PM
If you did this from your house...yeah. It is a good thing that you chickened out.
(Score: 0) by Anonymous Coward on Monday October 19 2015, @02:17PM
I replaced the tape for the phone systems "on hold" music with twisted sister.
(Score: 0) by Anonymous Coward on Monday October 19 2015, @03:48PM
What's Sears? ;)
(Score: 2) by Hyperturtle on Monday October 19 2015, @04:43PM
Remember service merchandise?
People used to do that and then go and pick up their "order". The people had no real means of checkingg really, until proof of ID was required. People with cajones to do this often had no issues getting the fake ID to display at pick up (and not check out, since it was really a here is your large heavy box of electronics, sir, have a nice day).
Or so it was written on early 80s BBSes!
(Score: 0) by Anonymous Coward on Monday October 19 2015, @10:16PM
yes, it really did work that way ( from someone who used to buy from them often back then, was always cool waiting for your package to come screaming down the roller belt from the 2nd floor )
(Score: 2) by Hyperturtle on Monday October 19 2015, @11:35PM
YES! The roller system provided that suspense and anticipation that we can't really get without staring out a window knowing the delivery guy will arrive soon... But being in the store was more palpable, because unless you wandered around looking at more stuff to buy, all you could do was wait and watch the rollers for something that might be yours to roll into view.
(Score: 2) by ledow on Monday October 19 2015, @01:33PM
That's not a hack.
That's just social engineering. Without the co-operation of the guy on the phone with a (should be) suspicious action, nothing can happen.
That said, it's stupid, and why their phones aren't already in this mode I can't fathom. When would you EVER need to dial into a store and talk directly to the public address? It seems that this should have been limited to internal calls only from the start. And even then, do they have a staff phone visible anywhere in the store where kids could pick up it and dial this extension? Same problem.
What's worse is that this is an indication that NOBODY has thought of this kind of thing. Likely their voicemail PINs are all the same, etc. too and that's more dangerous.
(Score: 2) by dyingtolive on Monday October 19 2015, @03:10PM
I recall social engineering counting when Mitnick did it.
Don't blame me, I voted for moose wang!
(Score: 2, Interesting) by Ethanol-fueled on Monday October 19 2015, @07:24PM
People still get away with it.
Suppose you want to pen-test your theme park or whatever. Have the pen-tester show up with a spouse and kids and, whoops, he forgot to print his tickets but he has them stored on a thumb-drive. One of the staff sticks the thumb drive into their terminal, opens a compromised pdf or whatever, and they're owned.
Because somebody going to a theme park with a spouse and kids couldn't possibly be a crook, right?
They'd be more likely than you to fall for something like that, because they're not very I.T. savvy and probably just trying to move customers so they can sneak off to give the guy in the Goofy suit a handjob behind the enchanted castle during their next lunch break.
(Score: 0) by Anonymous Coward on Tuesday October 20 2015, @03:35AM
And what's the impact of most of these hacks really? Who cares if you pwn a theme park anyway? They get embarrassed but months or even weeks later hardly anyone cares or remembers.
You regularly see reports that millions of credit card numbers get stolen. The card holders get their cards cancelled, life goes on. How many USD millions of costs are passed to the consumers? Insignificant compared to how much the Investment Bankers have cost us.
Thus if you talk about social engineering hacks most of these wannabe hackers are amateurs compared to the bankers who have really exploited our systems in genuinely harmful and significant ways.
(Score: 2) by Hyperturtle on Monday October 19 2015, @04:41PM
I agree with you, it's not a computer security hack, but I disagree in that I still think social engineering is a hack. Convincing someone to do something can be a lot harder than running a script... but then again, I hear that some people can be replaced by scripts, so its a wash.
You bring up an excellent point of the poor security; though, and these have been issues for years and really have become worse. The people in charge of those systems are not looking at it from a security perspective and only vaguely have, if only to prevent pranks like this...
I think they should have played old blue-light special in aisle 20 sorts of announcements, but I think everyone recognizes porn as a sort of universal cultural disruptive technology.
(Score: 0) by Anonymous Coward on Monday October 19 2015, @05:11PM
These are not the droids you're looking for.
(Score: 2) by Hyperturtle on Monday October 19 2015, @07:53PM
I have to wonder when all of those laid off IT people start running NMAP.
(Score: 5, Funny) by Alfred on Monday October 19 2015, @01:36PM
(Score: 0) by Anonymous Coward on Monday October 19 2015, @01:51PM
It would be hilarious if you'd blast Walmart commericals or even better...
"You are not your job, you're not how much money you have in the bank. You are not the car you drive. You're not the contents of your wallet. You are not your fucking khakis. You are all singing, all dancing crap of the world.” on a loop ofcourse.
(Score: 3, Funny) by SomeGuy on Monday October 19 2015, @02:07PM
Why not play some music from the delightful Rick Astley? :)
I actually head "Never Gonna Give You Up" playing at Publix once... hmmmm. Wonder if they have something similar going on there?
This seems to be yet another case of hooking things up in ways that they just shouldn't. I wonder what they think their business reasons were for this? Next thing you know, it will turn out you can control their fire suppression system from your smart phone.
(Score: 3, Informative) by deathlyslow on Monday October 19 2015, @02:49PM
I wonder what they think their business reasons were for this?
Speaking as someone who used to install digital/key systems and still install and maintain IP/SIP installs. You have to have a button LABELED Intercom, programmed as a a speed dial, or else no one would know how to get to it. Employees stopped being knowledgeable about their environment 15-20 years ago when automation started taking over and it negated the need for intelligence in the workforce. These guys, employees, aren't being stupid they are just ignorant of how the system works in the background, and are trying to do what the client/customer asked.
(Score: 3, Informative) by Daiv on Monday October 19 2015, @08:45PM
As someone intimately familiar with the specific phone systems mentioned in the article and 8 years experience of daily use, these are just Avaya phone systems and the speed dials and menus are only set with numbers. Each store has a switchboard extension at the fitting room or operators desk (depending on the volume [judged by sales/year]) which has more extension numbers. Every store will have a reference list taped up above the phone, under the phone/on the desk or in a binder next to the phone. These people (team members/operators) transfer to the same extensions dozens of times a day and generally don't need to use them after a week of doing the job.
However, turnover sucks at retail and there's almost always someone new starting. These people, despite training, sometimes just listen and do what's asked by the caller, thinking they're making their lives easier by just following orders rather than following their training and screening calls. Overhead used to be #52 on all phones, but that was changed sometime around 2009ish when this same pranks happened in some Texas stores. Then the overhead capability was limited to the operator, Guest Service or a couple other phone extensions. Looks like someone found the new extension.
These aren't hacks, but they can be damn funny. Although a good Leader on Duty only has to go to the control room and pull one cable to make it stop. Of course those leaders are generally hired directly out of college, with no retail or leadership experience who ride on the coat tails of their teams and are generally worthless with few exceptions. Gregg Steinhafel might be gone, but his stain will take a while to wash out of that company...
(Score: 2) by VLM on Monday October 19 2015, @03:57PM
I wonder what they think their business reasons were for this?
They were probably businessmen not telecom engineers and just wanted to save money.
It seems like a lifetime ago but I did a lot of telecom stuff, and think about it, how would you implement voice paging on a key system like a 1A2 from the 50s (the one with the giant 25 pair connector) or a slightly smarter PBX from the 70s?
Well, you're conceptually on track with dialing 9 or hitting a key for an outside line. What if, instead of connecting that "outside trunk line" to an actual Ma Bell trunk line, a simple E+M trunk had its output pairs connected to the input of a PA amplifier and a bunch of speakers? Sure there's an isolation transformer and a balun and probably an amp or attenuator depending on input, but its really pretty crude and simple. So connect to that outgoing "phone trunk" and you're actually talking over a PA speaker instead. Simple!
So the 80s roll around and people are building key systems in software, so a Z80 does the same thing a 1A2 always did, but "new" and its gotta work about the same or everyone in the field will be mystified.
Really nothing has changed since then. Lets run voip over cat-5 but conceptually give a key system UI for the users, well OK whatever. So here is is 60 years later and 1A2 end users kinda know what to do with a 2015 business phone, more or less.
You can write insane complicated custom dial plans (think like access-lists) but all that does is employ people for endless hours and make it possible for them to screw stuff up.
In the old days using key systems part of the little adapter box usually involved some counter party signalling simulation such that the PBX pretends to call a trunk but the trunk pretends to hang up after 3 minutes or so on the assumption that any PA page over three minutes is a dead phone or something "bad" happened. Its interesting that that feature never got virtualized.
Its hard to implement really smart software routing over something that's life+safety critical and frankly already pretty damn complicated. If you rip everything ELSE out other than not being able to transfer a call to the PA then life is pretty easy, but life never really remains that easy, not if you want to keep doing everything else.
(Score: 2) by Bot on Monday October 19 2015, @04:14PM
I'm more in line with TFS, I'd go like "Dear customers, today is... Chicken meat national day! sponsored by The Poultry Producers Association of USA! Show your support by replying "gluck gluck" to the cashier and receive and insta 10% discount! You'll be also eligible to the super jackpot, a brand new, shiny white Volkswagen Golf GTI with emission laws compliant fuel injection system, 45kW, and smartphone compatible infotainment system! Remember, "gluck gluck" to the cashier and win!"
Account abandoned.
(Score: 3, Funny) by arulatas on Monday October 19 2015, @04:48PM
I would have played S-Mart clips from Army of Darkness.
https://www.youtube.com/watch?v=W6yBL7wxr2I [youtube.com]
----- 10 turns around
(Score: 1, Insightful) by Anonymous Coward on Monday October 19 2015, @01:45PM
...explicit pornographic audio being broadcast across the stores
That's pretty moronic. Not a clever hack at all, reeking of beavis & butthead levels of infantilism. I should be surprised; I expect as much from the younger generation.
(Score: 2, Touché) by nitehawk214 on Monday October 19 2015, @01:48PM
Subtley is lost on people these days.
"Don't you ever miss the days when you used to be nostalgic?" -Loiosh
(Score: 0) by Anonymous Coward on Monday October 19 2015, @01:49PM
Yeah, the FBI has pretty much concluded that the attacker or attackers are most likely males between the ages of 12-39 residing outside of the Middle East.
(Score: 2) by VLM on Monday October 19 2015, @04:14PM
That's pretty moronic.
That's pretty harsh, AC.
First thing to pop in my mind was I got three monitors on my desk, for the LOLs I gotta start some pr0n on one monitor while shopping Amazon on the other. It wouldn't be hard to do, and it would be a new experience. Its worth a try.
On the other hand I do agree with AC that people who are really old, like my parents, used to buy stuff like Carlin and Cosby standup routines on vinyl LP records and listen to them on record players. Unless they found funny pr0n, I'm thinking some vintage 40 year old George Carlin would have been way funnier than simple pr0n. Carlin expounding on the seven swear words or whatever that routine specifically was would have been pretty funny at a Target store.
Its interesting that in the "old days" just J. Random Normie civilian probably had a mass market comedy record, AFAIK recordings of standup routines died out in the 60s/70s I've never heard of modern standup comedy on cds, for example. I tried amazon (without pr0n accompaniment) and can't find any, all I can find is CD soundtracks of crappy 2010s era comedy movie releases. So I can find the soundtrack for "the runaway bride" but I can't find a 2010s standup comedy routine on cd.
(Score: 2) by joshuajon on Monday October 19 2015, @06:29PM
Are you joking? There's an entire section on Amazon called Stand-up Comedy [amazon.com]. It only has a couple of thousand albums though, so I can see how you'd miss it.
(Score: 2) by FatPhil on Monday October 19 2015, @09:01PM
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 2) by FatPhil on Monday October 19 2015, @08:58PM
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 3, Insightful) by nitehawk214 on Monday October 19 2015, @01:49PM
After the big credit card hack, I thought Target did not understand security. Now, it seems that Target simply doesn't care.
"Don't you ever miss the days when you used to be nostalgic?" -Loiosh
(Score: 0) by Anonymous Coward on Monday October 19 2015, @02:25PM
Target has their own in house security lab[http://www.mprnews.org/story/2011/10/21/target-forensics-lab],and holding cells.
Despite all of this, they are still so bad at it. Amazing.
(Score: 0) by Anonymous Coward on Monday October 19 2015, @03:40PM
Do you know how hard it is to get a job in security there? They'll hire 18 year old high school dropouts. I know of two of them at my local target, and one told me some horror stories about what goes on in security. Get a scanner and tune in to their 2-way radios for a laugh.
(Score: 1, Offtopic) by Anal Pumpernickel on Monday October 19 2015, @04:08PM
Do you know how hard it is to get a job in security there? They'll hire 18 year old high school dropouts.
Not everyone wants to be a product of our abysmal public school system. Is that so bad? Or are you under the delusion that having a piece of paper showing you graduated from some high school actually demonstrates anything important?
(Score: 0) by Anonymous Coward on Monday October 19 2015, @05:11PM
To be fair, many of those high school dropouts have no interest in learning whatsoever, and would have dropped out of the best of schools. It is a reputation that has been legitimately earned in a number of cases.
Now I am not saying there aren't those just trying to get away from the miserable life that a public high schooler can lead, I think that is not what happens in the majority of cases.
(Score: 1, Offtopic) by Anal Pumpernickel on Monday October 19 2015, @05:44PM
Fair enough. But I know some people who 'dropped out' of public schools to pursue an alternative way to get an education. Homeschooling and self-education (in the case of people who were older). Still, I would say that graduating from high school really doesn't put you that far above people who dropped out because they have no desire to learn. A lot of people who do not care about learning nonetheless graduate from high school because of the lack of meaningful standards.
(Score: 0) by Anonymous Coward on Tuesday October 20 2015, @04:24AM
(Score: 1, Offtopic) by Anal Pumpernickel on Tuesday October 20 2015, @04:17PM
Which precious snowflakes? People who graduate from abysmal schools, or people who want no part in that waste of time? With all the absurd zero tolerance standards, puritan rules, and authoritarian policies at schools, I would say it's the students of these places who are treated as special snowflakes who need to be protected from everything.
(Score: 3, Interesting) by WillR on Monday October 19 2015, @01:50PM
(Score: 2) by miljo on Monday October 19 2015, @02:39PM
Yeah, I remember sitting in a phone bridge around the late 90s early 00s where we spent an entire evening trying to get on the PA of various stores. Old stuff yet still funny.
One should strive to achieve, not sit in bitter regret.
(Score: 2) by VLM on Monday October 19 2015, @04:06PM
Back then "we" did this to walmarts more so than targets.
I never did much phreaking, I worked in the industry so I already had all the free phone calls and whatever I wanted. But I always kept an eye on our professional opposition, more or less. Also they were sometimes very funny.
I got rid of most of my 2600 collection in a move a long time ago, but I had all that in the old days.
I used to distribute "Phrack" issues to the local boards in the BBS years. Hey, I needed my upload quota to download my warez!
Something that always amused me was I sometimes found it harder to do stuff legally as an employee because of Dilbert-level screwups than the kids did because they didn't care if it doesn't work, they'll just try again elsewhere, whereas I was being paid to get THIS one thing working and can't just give up.
(Score: 1, Troll) by Alfred on Monday October 19 2015, @07:25PM
(Score: 3, Interesting) by Daiv on Monday October 19 2015, @08:51PM
Call your closest Meijer and ask for extension 79. Or #79 if you happen to be wandering around a Meijer and find a phone on the back of a pole. That should still work...
(Score: 0) by Anonymous Coward on Monday October 19 2015, @04:04PM
Indeed. I remember doing similar before I was four and a half feet tall. Last I heard they still have those phones everywhere in the store that you just have to punch the extension into and there you go.
(Score: 4, Touché) by wonkey_monkey on Monday October 19 2015, @01:59PM
Telephone-tampering tricksters' TannoyTM takeover targets Target.
systemd is Roko's Basilisk
(Score: 2) by Runaway1956 on Monday October 19 2015, @02:22PM
What does that even mean? Does it mean "not employees"? How could they know that it's not employees? Are they team members of another competing store? Again, how would they know that, is there an inter-store rivalry? How can they possibly know whether the caller is a team member? It may have taken an entire team of boys to figure out how to make this work.
Why can't they just asy, "We've been duped." Meaningless verbiage just pisses me off.
Abortion is the number one killed of children in the United States.
(Score: 1) by Flyingmoose on Monday October 19 2015, @02:44PM
Instead of porno, they could have played "HeadOn. Apply directly to the forehead." over and over for 15 minutes. Horrifying!!!
(Score: 2) by bob_super on Monday October 19 2015, @03:07PM
A medley of Soviet Patriotic Songs would have resulted into hilarious media coverage, especially if done in Red States...
(Score: 2) by Thexalon on Monday October 19 2015, @04:09PM
Or how about this: "Attention shoppers! If you are hearing this message, then I regret to inform you that you were not among those Raptured away just a couple of minutes ago. I sympathize - I'm in the same boat."
The only thing that stops a bad guy with a compiler is a good guy with a compiler.
(Score: 2) by VLM on Monday October 19 2015, @04:45PM
"Utility clerk to aisle 1 for cleanup" five minutes "utility clerk to aisle 2 for cleanup" five minutes "utility clerk to aisle 3 for cleanup". I think you see where this is going.
After the store closed (well... mostly) at the food store during my high school days we'd make "comical" pages while waiting for coworkers to finish up "Price check meat department three pounds dog meat for cashier 7" and stuff like that. "Price check dairy department one quart human breast milk cashier 4", etc. While the store was open, if there was an unusually cute cashier working that night you'd hear PA announcements for "Price check 48 pack condoms for cashier 5" or whatever, and we'd make bets on how dark red she would turn, even funnier if everyone, including the "happy" couple, knew the guy doing price checks that night had a crush on her or was actually dating her. Of course the girls got us back by requesting price checks for tampons. Oh another good one is if someone got busted selling underage alcohol, in the old days before they practically made that a death penalty infraction, you know there would be a dozen price checks for beer or wine coolers or whatever for that cashier the next night just to give them some BS. Someone showing up to work with a hangover resulted in a morning of phantom price checks for aspirin or 24 packs of Milwaukees Best or whatever.
We also hazed new shelf stockers by sending phantom price checks for them to find weird foods like canned squid in ink and ethnic produce items that most people don't even recognize as plants.... and of course we'd send them on wild goose chases. "Price check health and beauty eight blade shaving cartridge quantity 3 cashier 3". Then if the customer and cashier were in on the joke we'd have them team up to yell at the poor guy.
A group of miscreants of my acquaintance went to no small effort to F with sports fan's minds at walmart by making fake pages "Attention packers fans, the Bears just scored a touchdown" and then try not to pee themselves laughing at people swearing and insisting that's not what they heard on their walkman radio or whatever, follow up pages to "correct" us, etc. See the funny part wasn't rubbing it in, but just totally making stuff up. "Current score is Packers 3, Lions 27"
(Score: 2) by mendax on Monday October 19 2015, @07:59PM
Quite ironic. I have an LP, since dubbed and now in my MP3 library, from about 1960 of the Red Army Chorus. I can think of a couple tunes from that album that would drive anyone in a Red State crazy after a few minutes. But I think playing Tracy Chapman's "Talkin' About a Revolution" [youtube.com] over and over again would be more effective.
It's really quite a simple choice: Life, Death, or Los Angeles.
(Score: 0) by Anonymous Coward on Monday October 19 2015, @03:10PM
A simple google search brings up various store phone extensions for intercoms. Now that it's hit the news, I expect to hear someone use the vagi-clean clip from Me, Myself, and Irene https://youtu.be/q8-1vRIXn38 [youtu.be]
(Score: 2) by chewbacon on Monday October 19 2015, @03:30PM
A friend and I did something like this at Walmart when we were kids. We were just too shocked that it worked and afraid of being caught to do anything "cool" with it. We called say electronics and asked if Joe (made up name) as working and was told a Joe wasn't working or otherwise didn't work there, but we did this engage the employee and get their name (Bob, for example). So we would hang up, call back and talk to the operator and say "Hey, it's bob in toys, I can't use the intercom, could you transfer me?" It worked.
(Score: 0) by Anonymous Coward on Monday October 19 2015, @06:15PM
Microsoft UK's public address extension used to be 2345.
(Score: 2) by HiThere on Monday October 19 2015, @07:55PM
Most kids would be bored by porn...until they got to be at least pre-teens. They they'd be interested.
OTOH, it's not parent friendly.
I am, of course, making assumptions about the audio that was considered porn. For some reason the summary wasn't very explicit.
Javascript is what you use to allow unknown third parties to run software you have no idea about on your computer.