Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/30/2007
09:00 AM
50%
50%

The Prank That Could Kill You

'Swatting' is becoming increasingly popular - with potentially dangerous consequences

I was recently pulled onto a TV news spot to talk about "swatting," a new type of prank that I hadn't heard of until recently. I’m sure our kids are becoming aware of this – but since it could result in someone getting hurt or killed and possibly landing a child who pulls this prank in prison for five to 20 years, it's probably something we should discuss with them. I’m not aware of this discussion getting underway at any company, school, or shopping mall yet, but I figure it's only a matter of time.

What is swatting?

Swatting is the practice of penetrating the Caller ID service – which is evidently not particularly secure – and then calling in a request for a SWAT response to a remote location, while making the call appear as if it's coming from that location. In short, someone calls in a terrorist attack, an armed robbery, kidnapping, hostage situation, or other false report that would require a high-level armed response by law enforcement.

Law enforcement responds to what it believes is a real call, and the victim suddenly faces armed police officers with no sense of humor and on hair triggers, thinking they are walking into a potential firefight. This is not a bright idea. Death may ensue.

Think of the homeowner awakened by what he thinks is a break-in, and then grabbing the family gun. This would be even more dangerous at a school or company, where the arriving officers could, for example, mistake a fleeing student for the non-existent attacker, or an armed plain-clothed security guard for a terrorist.

The pranksters

Calling this a prank, given its danger, is understating the risk involved, to say the least. The folks behind this hoax could be kids or adults anywhere. There have been reports of rings of people doing this to folks they don’t like. In some cases, it almost feels like a sort of protection racket, like a "message" to a victim who had refused to provide sexual favors, for instance. I wonder how many young women have been threatened this way and not reported it.

This seems to be a natural fit for disgruntled employees or people who feel they have been mistreated by a company or official, and it's likely this brand of hoax will escalate. Reports of swatting (which was nonexistent at the beginning of this year) now seem to be coming about once a month.

The penalties

The penalties are severe, as they should be. Calling in an armed response puts people's lives at risk, which makes this a felony with multiple-year penalties. If a death results from this prank, life imprisonment is a very real possibility, depending on the circumstances.

This kind of hoax – much like the prank a few weeks ago that resulted in the suicide of a young woman who thought she’d been dumped by a fake boyfriend – can ruin lives. It is very serious.

What should you do?

First, make your kids aware of it, and, of course, impose penalties should something happen. This is serious – it's not something kids should experiment with. And beware that new, young employees often don't always think through consequences, either, so you may want to include a discussion on swatting in your new employee briefing. I can’t tell you the number of times I’ve seen a young employee fired for doing something that seemed an obvious no-no to everyone except for him.

If your security team isn’t aware of swatting, it should be. And have a plan of action in place in case it happens to you. Make sure folks know whom to call, which could help prevent an unnecessary armed-response at your facility. When an employee showing signs of violence is fired, be prepared for swatting as you would for any other potential fallout from that situation. It may be a good time to check and make sure you have a process to help mitigate problems with a violent terminated employee, such as the necessary site safety.

In the end, awareness about swatting can help. Your employees should be made part of site security solutions, too, because their own safety and that of the organization could have more to do with how they cope with such a situation then how management or on-site security responds.

— Rob Enderle is President and Founder of Enderle Group . Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5230
PUBLISHED: 2019-11-13
P20 Pro, P20, Mate RS smartphones with versions earlier than Charlotte-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than Emily-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than NEO-AL00D NEO-AL00 9.1.0.321(C786E320R1P1T8) have an improper validation vulnerability. The system does not perform...
CVE-2019-5231
PUBLISHED: 2019-11-13
P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186(C00E180R2P1) have an improper authorization vulnerability. The software incorrectly performs an authorization check when a user attempts to perform certain action. Successful exploit could allow the attacker to update a crafted package.
CVE-2019-5233
PUBLISHED: 2019-11-13
Huawei smartphones with versions earlier than Taurus-AL00B 10.0.0.41(SP2C00E41R3P2) have an improper authentication vulnerability. Successful exploitation may cause the attacker to access specific components.
CVE-2019-5246
PUBLISHED: 2019-11-13
Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), 9.1.0.153(C00E150R1P21), 9.1.0.155(C00E150R1P21), 9.1.0.162(C00E160R2P1) have an insufficient verification vulnerability. The system does not verify certain par...
CVE-2010-4177
PUBLISHED: 2019-11-12
mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text form via the list of running processes.