How Hackers Could Mess With 911 Systems

[x635 4,066]

But Dameff and Tully discovered that the 911 system has several vulnerabilities that make it susceptible to failure. Dameff is an emergency room physician and Tully is a pediatric doctor. But theyre also white hat hackers who decided to team up with Peter Hefley, an IT security manager for Sunera, to identify problems within the 911 system. The trio recently presented their findings at the Def Con hacker conference in Las Vegas.

Full article: http://www.wired.com/2014/08/how-hackers-could-mess-with-911/

[AFS1970 504]

Interesting article.

When VoIP first came out there were big problems in getting correct addresses and even to this day many of them when correct are formatted wrong and cause problems for our automatic dumps from one system to another. When Optimum first started their cable phone service in CT all calls went to Norwalk because that was the PSAP for Cablevision. When this was pointed out to them you would have thought we were speaking some unknown alien language. It took a while for them to decide this was a problem that needed fixing.

Some of the problems with 9-1-1 in general could be fixed by public education. Other could be solved with some more regulation (shudder) This article speaks of a nationwide 9-1-1 system, which is not true at all. Each phone company that provides the local service has their own system although they work along similar processes. Even the steps in the article happen quickly, with the data attached and the routing done before the caller hears the first ring.

When we get a cellular 9-1-1 call, we get phone number and location, often just the tower location. Some providers will fine tune location, but even when we get an off tower location it is usually around a 300 meter radius from where we see it on the map. The phone company's map is so out of sate, it has streets that have not existed since right after WW2 and schools that were torn down or moved many decades ago. So sometimes even a valid coordinate puts it in the middle of a non-existant address. The worst part is we do not get a name. It seems to me that since all cell companies have this on file, so they know who to bill, they could easily provide us with a subscriber name, just like the land line companies do.

As for public education we need to stop telling people about the national 9-1-1 system. More and more people think there is one big dispatch center that sends out all calls nationwide. I took a call the other night from someone who got a call from home and called Stamford for an ambulance for an address in the Bronx. We have no way to transfer calls to NYC and are limited to finding public numbers only if the dispatcher happens to have a personal lap top set up at their desk. I usually have my lap top with me but it is not always turned on. That caller was told to have the person who called him call 9-1-1 from the Bronx, so he hung up and called right back and got me again.

The hacking / Swatting issue is important but is even a problem locally. A few years ago we were getting a series of false fire calls on a cell phone all over town. This was before we got anything other than tower location. We were able to flag the number as a probably false alarm, but still had to respond to the address given to investigate. Even on legitimate calls it is not always the closest tower that relays the call. Tracking these phones is quite a chore. Each phone company has their own protocol for releasing data and not all phone companies are 24/7. With the spoofed phones this will require the phone company to actually look at the routing information and I am not even sure if that is available in real time.

The other night there was a swatting incident in Norwalk and they called looking for information of someone that might have encountered Stamford PD but we had no matching information to help them out.