Security of Dial-up modems

[secret_ag]

Hi All,

Would need your expert advise on the subject mentioned, assuming there are 2 location using a dial-up modem to exchange data using a telephone lines. It is a point to point connection, what is the risks of this setup, can an attacker gain access to a network if the telephone number of one location is known by dialing to that number and steal data from that organization? Please advise and thank you in advance.

Best Regards,

Eugene.

[Steve-Wilme]

Modems can be set to auto answer after a set number of rings, so knowing the number of a modem does create some risk, as they're be something connected to the modem too that you could try to access.  A lot of IT kit still contain modems; e.g. many MFDs, mainframes although they're normally configured to only dial home to the OEM to report faults.

[AlecTrevelyan]

Here's a pretty good resource to help you understand the risks associated with modems and the mitigations:

https://www.us-cert.gov/sites/default/files/recommended_practices/RP_SecuringModems_S508C.pdf

[rslade]

> secret_ag (Viewer) posted a new topic in Tech Talk on 08-01-2019 11:32 PM in the

> It is a point to point connection, what is the risks of this setup, can an
> attacker gain access to a network if the telephone number of one location is
> known by dialing to that number and steal data from that organization?

Ummmm, yeah ...

OK, first off, don't trust the modem. Don't give it any special status or privileges.
Force it to log in like anybody else.

If carrier drops, log off the port. Kill the session.

Maybe use a non-standard modem. 201C might be nice. (If you can find one ...)

We could probably give better advice if we had more details ...

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Creativity can solve almost any problem. The creative act, the
defeat of habit by originality, overcomes everything. - George Lois
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB