Sandstorm's Sandtrap 1.6 Wardialer Detector

If you already use Sandstorm's PhoneSweep or another telephone scanning program for your telephone audits, Sandtrap is a good use of your wardialing computer when it's not actively wardialing. We recommended that you select phone numbers to monitor with Sandtrap either from a random selection of extensions (not consecutive numbers) or a sample extension in each sensitive range (department, building, etc.).

When Sandtrap is called, it:

• Logs the Caller ID (if available).
• If Answer mode is set, it:
  • Answers the call
  • Sends a user configurable banner/login prompt.
  If the caller responds, Sandtrap sends a user-configurable password prompt.
  If the caller responds to the password prompt, Sandtrap sends a user-configurable "success" or "failure" message.
• Finally, it logs the information collected (and sends notification if configured to do so).

In Trap mode, caller is kept online in a simulated enviornment. All text received from the caller is logged to hard disk, and displayed on the user interface.

Sandtrap can also notify you immediately upon being called or connected to, via an email message to an address you specify (pager, list, etc.) or via HTTP POST to a web URI you specify. Conditions that can be configured to generate notification messages include:

• Incoming Caller ID (enabled by default)
• Login attempt (enabled by default)
• Modem disabled due to COM port errors (enabled by default)
• Sandtrap application shutdown

Information about system status is displayed by the application's Graphical User Interface, and optionally on the Windows System Tray. You can tell at a glance the status of a modem (on by default, can be turned off): disabled, enabled, listening enabled, ringing enabled, call in progress.

Sandtrap is distributed with a simple low-overhead web server, which allows users to create their own cgi-bin programs to process HTTP notification messages without the security and shared resource issues that might arise from adding this function to an existing server. The distribution contains an example CGI script (psalert.cgi) to work from.

Add Sandtrap to your security toolkit and better understand the risks you face.

You can benefit by deploying Sandtrap if:

• Your organization has an active telephone auditing policy
• You know you've been attacked in the past
• Your organization is in a sensitive industry
• You have reason to believe you're a target
  • Due to aggressive competitors
  • Because of your valuable information assets
  • As a result of a critical role in your country's economy
• You want to complement your PhoneSweep system and know when to run additional scans

New Features in Sandtrap 1.6

• Additional alert logging capability - receive alerts to breakin attempts via syslog 
• Pre-configured operating system login emulations to tempt would-be attackers 
• Configurable number of rings to wait before Sandtrap "answers" the call 

Ordering Codes: