In retaliation for an unpaid debt of $150, I wrote a VB6 program that abused one of those fax-by-email gateways to punish a “friend’s” mobile phone. The fax gateway only charged for completed faxes so since his mobile service was unable to receive a fax, there was no financial consequence to me.

The gateway set no limit on failed fax transmissions to a given number, so I hammered his phone line, my app effortlessly queued up thousands of faxes, and the gateway retried each one three times, calling him multiple times a minute, 24/7, for more than a week.

His phone was useless, ringing constantly, assaulting him with the fax modem carrier when he answered. He had like a 10 second window to dial a number and push send before the next fax came in, incoming calls reset any digits he had dialed.

What I hadn’t anticipated was that when he turned off his phone it went to voice mail, which hung up without storing a VM, but still charged him for a whole minute! In some cases he got billed three times in a single minute!

It was absolutely fucking priceless, he called me, literally in tears after 3 days, begged me to make it stop, but still wouldn’t pay me! When I found out, from his parents, who paid his mobile bill, that I had run up a $1000 overage bill, I made it stop as quickly as I could, but there were still a few hundred calls in the queue that were impossible to delete, and they had to endure.

I told his parents what to say to their phone carrier to get out of the bill, I explained the mechanics of the attack, it was a clear case of abuse. They apologized for having raised a douche of a son. (Given the circumstances I didn’t ask them to make the debt good on behalf of their miscreant son.)

I also notified the fax gateway provider of the vulnerability, and I published the source code for my attack tool 3 months later, when they neglected to correct it. I wanted to make sure the attack vector was no longer available even to myself. (The temptation to use it again would’ve been too much.)

Amazingly he did finally pay me back 18 months later, brought a bottle of interesting booze as a peace offering, and we shared a laugh (though I’m pretty sure he did cringe a bit.)

You mess with the bull, you get the horns!