Intellectual Property Law

A Canadian computer security firm got worse than a lump of coal in its stocking this year -- it got a $50,000 phone bill after someone hi-jacked its phone system and made hundreds of calls to Bulgaria over two weeks.

HUB Computer Solutions discovered the problem when owner Alan Davison noticed a strange code -- "feature 36" -- appearing on the phone display in his office. After calling his phone company, Manitoba Telecom Services, to investigate, he discovered that someone had made $52,360 worth of calls to Bulgaria through his system between November 21 and December 9. The bill listing the calls was 50 pages long.

The company's international bill was normally a couple hundred dollars a month. One recent bill for out-of-country calls was only $14.

MTS has resisted dropping the charges, saying that HUB owned its own phone equipment and therefore the phone company was not responsible for securing it. But HUB owner Alan Davison said the company should have had a fraud alert system in place to notify him when the calls deviated from his company's normal call pattern. He said he might have to lay off an employee to pay the bill if the phone company isn't willing to compromise.

The hacker got in by simply dialing into the phone system, hitting voicemail, and figuring out a four-digit password to get into the system. The hacker then used an outbound call transfer feature to make the calls remotely.

The ploy can be used by thieves or even terrorists to thwart law-enforcement tracking. It can also be used by rogue entrepreneurs who sell the international calling access to friends or strangers at a reduced rate.

Holiday periods, when offices are empty of workers, are prime times for such phone hacks. Companies are advised to block overseas calling and set up their phone systems to prohibit the outbound call-transfer feature.

Photo: fabrisalvetti via flickr