War dialing is the practice of systematically calling large blocks of phone numbers to find modems, voicemail systems, or other reachable services. In cybersecurity, it helps identify exposed dial-up access points, legacy remote access, and misconfigured telephony assets that may create unauthorized entry paths into corporate networks and identity-controlled systems.
How War Dialing Works
War dialing is essentially a discovery technique: a scanner or human operator places many calls in sequence, records which numbers answer, and classifies the responses. The method is aimed at finding reachable services that may still accept inbound calls, especially where legacy remote access has not been fully retired.
The security value of the technique is that it turns an unknown telephone range into an inventory problem. Once a reachable modem, voicemail platform, fax gateway, or similar service is identified, defenders can determine whether that path is business-justified, monitored, and aligned to current access policy.
Why War Dialing Still Matters
Even though dial-up is far less common than it once was, the attack surface has not disappeared. A single reachable legacy modem can bypass modern perimeter controls, create an unmanaged entry route, or expose a system that was never meant to be reachable from outside the organisation.
War dialing matters because it often uncovers forgotten infrastructure rather than intentionally deployed remote access. That makes it especially relevant in environments with long asset lifecycles, outsourced telephony, plant equipment, or remote management links that were added before current identity and network controls existed.
What It Reveals About Exposure
War dialing can expose weak points in the boundary between telephony and enterprise systems. If a number reaches a modem attached to a server, router, console port, or maintenance interface, the real issue is not the call itself but the possibility of unauthorised access through an overlooked channel.
It can also reveal security drift. A number may lead to a voicemail box, a dial-in console, or a remote support function that is still active even after the owning team believes it has been decommissioned. That gap between assumed and actual exposure is what makes the technique useful to both testers and attackers.
How Defenders Use the Result
The most useful outcome of war dialing is not the list of answered numbers, it is the follow-up review. Teams use the findings to confirm ownership, validate whether the service is still needed, and determine whether the reachable endpoint should be removed, isolated, or tightly controlled.
When a reachable line is legitimate, defenders should treat it like any other externally reachable access path: document it, constrain it, and monitor it. NIST SP 800-53 Rev 5 Security and Privacy Controls is a useful reference for the access control, authentication, audit, and configuration controls that should govern exposed entry points.
Risk and Threat Considerations
War dialing is risky because it is designed to uncover forgotten or weakly governed access paths, and those paths can provide a way around stronger network controls. A reachable modem or dial-in service may expose legacy authentication, weak logging, or an unmanaged trust boundary that defenders no longer actively watch.
Failure mechanism: An adversary finds a live number, connects to an exposed service, and uses the reachable channel as a foothold into systems that were assumed to be inaccessible from outside the network.
Impact: Successful use of a forgotten dial-up path can lead to unauthorised access, persistence on legacy equipment, lateral movement, or exposure of systems that sit behind stronger modern controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-17 — Remote Access | War dialing finds remote entry paths that need controlled external access. |
| IA-2 — Identification and Authentication (Organizational Users) | Reachable services discovered by war dialing must still authenticate legitimate users. | |
| AU-2 — Event Logging | Legacy reachable services need logs so answer activity can be reviewed. | |
| Recommendation — Restrict and monitor any dial-in or remote access channel you still operate. Require strong authentication before any discovered access path is usable. Enable logging on exposed access paths and review connection events for misuse. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | War dialing exposes unmanaged network and telephony entry points. |
| Recommendation — Inventory and govern exposed telephony and remote access infrastructure. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical Devices and Systems Inventory | Finding reachable modems depends on knowing what assets and links exist. |
| Recommendation — Inventory telephony-linked assets and verify which ones remain reachable. | ||
Practitioner Guidance
Why practitioners should care: War dialing is not just a historical curiosity, it is a reminder that exposure management must include non-IP entry paths. Legacy telephony, remote maintenance lines, and modem-based support circuits can persist long after teams think they have been retired.
What to watch for: Treat any answered number that reaches an operational service as a real asset owner and access decision, not a curiosity. If the service is still required, verify that it is explicitly authorised, monitored, and removed from default trust assumptions.
Practitioner takeaway: The safest response to war dialing findings is to convert undocumented reachability into a governed asset, or remove the path entirely.
Related resources from NHI Mgmt Group
- What happens when states stop treating cyber conflict as a shadow war and start targeting public assets openly?
- How should organisations respond when cyber insurance policies rely on outdated war exclusions after a major cyberattack?
- Why do broad act of war exclusions create risk for companies seeking cyber insurance after a cross border attack?
- Why are insurers tightening cyber coverage for attacks they link to nation states or acts of war?