Mark Collier's VoIP/UC Security Blog

Great Toll Fraud Article

Here is a link to a good article in a national publication, the New York Times, on the growing issue of toll fraud. Toll fraud has been around for many years, but continues to get worse for a number of reasons. Attackers set up premium (think 1-900) numbers and are incented to drive traffic to these numbers. They look for ways to generate the traffic and leave a victim with the bill. Small businesses are an attractive target. They often deploy new VoIP systems, but do not spend the time to secure them, and address issues such as default open ports and passwords. The attackers scan for these systems and when found, use them to launch 100's, 1000's, or 10,000's of calls to their premium numbers. Or they hire attackers to do this for them and share the revenue.

The issue doesn't have a lot to do with VoIP, it can occur with legacy TDM PBXs and trunking, but is often associated with VoIP, because it is often the new low-end VoIP systems that are being attacked. Also, the attackers often use low-cost VoIP and SIP services to generate inbound calls to the compromised PBXs, which "hairpin" out to the premium numbers.

http://www.nytimes.com/2014/10/20/technology/dial-and-redial-phone-hackers-stealing-billions-.html

Since these calls cost the service provider money to deliver, they can't usually credit the victim.

There are a number of solutions to this issue, including the SecureLogix (www.securelogix.com) voice security/firewall application. Using a cloud-based delivery option makes this solution very attractive for small businesses, who don't have the expertise or budget to deploy and manage a premises based solution.

Firm Avoids a Toll Fraud Charge

Back in 2011, a firm was hit with toll fraud and racked up a $35,000 bill. The firm refused to pay and fought the issue in court. The court found in favor of the firm and ruled that the service provider did not provide adequate security.

This is the first time I recall seeing such a ruling in the press. Enterprises and service providers deal with responsibility for toll fraud all the time, with the many different results (service provider takes responsibility for the first issue, both parties cover portions of the cost, and the enterprise covers the cost). 

Here is a link to the article:

http://www.hinckleytimes.net/news/local-news/firm-avoids-35000-phone-bill-7292326

Good Video on VoIP Security and Telephony Denial of Service

Here is a link to a good video on VoIP and SIP security.

http://www.securitytube.net/video/10151

Patrick McNeil covers how to hack SIP servers, at service providers and enterprises, to make money. The presentation is useful because it covers why someone might bother to hack these servers, namely:

• Toll fraud or International Revenue Sharing Fraud (IRSF) - basically using someone elses PBX to generate calls to premium numbers set up by the hacker or where the hacker has an agreement with the owner to generate traffic.
• Telephony Denial of Service (TDoS) - using someones PBX to target a business or individual. The attacker makes money through extortion.
• Robocalling/SPAM - using someone's PBX to make many SPAM or vishing calls to individuals (this was briefly mentioned).

At the end of the presentation, there is a brief TDoS demo.

Note that another way to make money is call pumping, where the calls are to 1-800 numbers and the attacker gets a share of the revenue, but this arrangement is more difficult to set up.

 

CFCA Releases Their 2013 Global Fraud Report

The Communications Fraud Control Association (CFCA) release their 2013 global fraud report. They state that there is $4.3 billion of global fraud, up 15% from 2011. It is a great report and resource. You can get the report from (you do have to register):

http://www.cfca.org/fraudlosssurvey/index.htm

I included the executive summary below:

Site With Various Toll Fraud Alerts

Here is a site with some decent toll fraud (and other fraud) alerts. Pretty much the same information that I have posted, but still a decent resource:

http://www.subex.com/fraud-alerts.php

Small Business Hit with $600,000 of Dial Through Fraud

A small business, a Remax realtor, was hit with $600,000 of Dial Through Fraud (DTF). I included an article below:

http://www.missourinet.com/2013/05/16/remax-office-owner-hit-by-phone-fraud-600000-bill/

The article does not give any details about the attack, but I bet the attacker exploited the victim's PBX and then generated a ton of inbound calls, which hair pinned out to premium numbers. I discussed this attack method in an April 12th post. Again, DTF/Toll Fraud is still a big issue - attackers set up premium numbers and then generate traffic to the numbers, through this hairpin attack. All enterprises are targets, but again, small businesses are especially attractive, because they don't have the expertise to secure their systems. They are also the least likely to notice the attack, until they get their phone bill...

I wish the victim well. The article says they are fighting the service provider, but that will be difficult. The calls do cost the service provider money - it is the enterprises job to secure their system.

Also, Ofcom, similar to the FCC in the United States, issued a warning that these types of attacks are on the rise:

http://www.mobilenewscwp.co.uk/2013/05/13/ofcom-warns-firms-about-rising-levels-of-dial-through-fraud/

Dial Through Fraud (DTF)/Toll Fraud Attack Using Robocalls

Here is a video describing a Dial Through Fraud (DTF) attack. DTF is a form of toll fraud, there the attacker dials into a compromised PBX, gains dial tone, and then dials a new destination, usually an international number. They "hairpin" though the PBX. The destination is often a premium number and the attacker is using the compromised PBX as a way of generating traffic and revenue.

http://www.bbc.co.uk/programmes/p017fb0c

This attack is interesting because it shows how inbound call or robocall generation can be used for DTF and toll fraud. First someone compromises an IP PBX so that an external user can dial in, get dial tone, and dial to an international premium number. Once this access is gained, the attacker can use it at any time for DTF themselves or sell it to an attacker who wants to generate the actual fraud.

Most people think of DTF as being the case there the access to the compromised PBX is sold to many individuals who use it to make international calls, say to talk to relatives in their native countries. This still occurs, but by far the more common attack is to automatically generate inbound calls to the compromised PBX, which hairpin into outbound international calls to the premium numbers, thereby generating a lot of traffic and revenue. This really isn't much different than automated call pumping or Telephony Denial of Service (TDoS) attacks. The attacker sets up an automated call generation operation, probably using Asterisk, a call generator, and SIP trunks. They build an audio file that pauses, enters a code to get dial tone, enters the desired international destination number, and then just keep the call up for some period of time. They run the attack and call a number for the compromised PBX that will give them dial tone. They probably spoof their calling number. The calls are kept up as long as practical, but keeping the calls shorter and/or variable length can make the attack a little less likely to be detected. The calls will usually be generated overnight and/or on the weekend to avoid attention.

If you watch the video, this is what happened. The attacker generated the calls at night and the victim had a ton of calls, all to Somalia start up at the exact same time. The calls continued for about 5 hours, at which time the victim noticed the attack. They happened to be an organization that takes calls at night, so they noticed the attack.

As with any DTF or toll fraud attack, paying for the fraud is the responsibility of the enterprise.

VoIP/UC Security Article In Connect Converge

I did a question and answer article for the folks at Connect Converge, on the topic of VoIP/UC security, check it out at:

http://www.connect-converge.com/Spring_2013/#?page=34

2013 SecureLogix State of Voice Security Report

SecureLogix just released our 2013 Voice and Unified Communications State of Security Report. Rod Wallace and myself authored the report. The report covers the most significant voice and UC threats. the report describes the threats and why they have recently and continue to become more severe. The report is also unique in that it presents real-world data collected from several hundreds assessments and managed service engagements, using our technology, on enterprise voice and UC networks. We present trending data and santized attack examples for each threat.

Here is a link to the report. Please give it a read and let me know what you think:

http://www.securelogix.com/sos/

 

Article About Toll Fraud And Its Impact on Small Businesses

Here is yet another article about toll fraud. This one makes a particularly scary point - that being that toll fraud can seriously affect, even put SME's out of business is a very short amount of time. Toll fraud can affect any enterprise, but smaller enterprises are often the target - they have enough trunk capacity to generate a lot of calls, often do not secure their systems and leave them in a default configuration, and can be limited in their ability to monitor traffic.

Here is the link:

http://companies.mybroadband.co.za/blog/2013/03/14/toll-fraud-can-put-smes-out-of-business-in-minutes/