I dont know exactly how Mitnik did it, but I dont believe he used V/IP. The most widely accept answer for how he did it was he called into his PBX and out over a PRI (its kind of like a Local T1). When you have a PRI your PBX can define its ANI (Automatic Number Identification). Normally on a call your phone provider defines your ANI. But with a PRI you could define your own, for uses like being able to have multiple phone extentions all goiing over the same PRI but haveing a different number coming up on caller ID for each.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/9061/27470#27470