- VoiceOps - lists.voiceops.org

[VOIPSEC] Tackling VoIP fraud, new idea
by sil＠infiltrated.net Feb. 21, 2014

Feb. 21, 2014

On Fri, 21 Feb 2014, Sergey Kolesnichenko wrote: > Why dont't you want to speak about tactics here openly? > Common sense. This is a public list, and there is no way for me to determine the intentions of anyone who is a subscriber to the list. It is a KNOWN fact, that criminals subscribe to security mailing lists such as Bugtraq, Full Disclosure and others. Not for the sake of lending a helping hand, but for other means. Much similar to malware authors who run their malware through VirusTotal to see if anything is going to detect it. On a private list, there is the accountability factor to equate. Someone subscribed using a corporate email address. Therefore SOME form of vetting took place. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

[VOIPSEC] Tackling VoIP fraud, new idea
by sil＠infiltrated.net Feb. 21, 2014

Feb. 21, 2014

On Fri, 21 Feb 2014, Sergey Kolesnichenko wrote: > One more mailing list? :-) I'm sure it is a bad idea. I'm working for a > company to protect it from VoIP related attacks, but you will never have > gurantess that I will not be using the data in a private list to attack > someone as a private individual :-) it is a security hole in a private list > about VoIP security... > I disagree with it being a bad idea. There is never any guarantees in life. The purpose for a private list, is it protects COMPANIES data. There is a trust mechanism in the sense that should/if/when someone wants to contest data, I can go back based on checksum to determine WHO submitted what. I HIGHLY doubt, someone would throw away their reputation, and or damage company reputation by submitting falsified data. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

2 1

[VOIPSEC] Tackling VoIP fraud, new idea
by sil＠infiltrated.net Feb. 21, 2014

Feb. 21, 2014

On Fri, 21 Feb 2014, D'Arcy J.M. Cain wrote: > > Second field, one can set up a triggering mechanism. > > (Pseudo code) > > > > if [ number == 2125551212 ] > > then > > do something (send_email || generate_phonecall > > done > > fi > > Not sure what you mean here. If the IP is already blocked then what > are we checking? Blocking an IP will ONLY block the attacker from doing malice from that host. If by chance someone made it onto one of your machines, you could set a trigger that says: Hey if you see an account trying to dial this KNOWN_TO_BE_BAD number that is listed, send me an e-mail, or lookup what OTHER IP is now trying to call that number and block them too. > Not sure about this. What if I want to weight the reports based on who > submitted them. There may be members that I completely trust and would > block based on their report. For others I may want to see multiple > reports before I block. I don't disagree however, I am taking my malware analysis and DFIR experience here. The reason (IMHO) we companies still get compromised six ways from Sunday is, many don't share data for various reasons: 1) they don't want the public/others to know "they've been had," 2) data submitted may be relevant to an ongoing law enforcement related investigation 3) good old fashioned chest thumping. Chest thumping. I have seen many companies take the approach that attacker data is some holy grail. "We were the first and only to see this!" All the while others could have been given a green light on an attack source. > What about non-free email? It seems to me that a tighter vetting > process is needed. I wouldn't accept any email that was not attached > to an actual VoIP provider. I realize that that takes more work though. There are VoIP providers, ITSPs, Carriers, but you're leaving out the small businesses, and smaller non carrier like shops who can also disclose attack sources. > I am not totally opposed to the idea. Not sure how useful it might > be. What sort of attacks are you thinking about? I already block IPs > based on failures to register and no one can dial without being > registered. It's all automatic. I am thinking the whole gamut of attacks. Registrations, actual calls, anything related to VoIP. Web based exploit of a PBX. Anything that is relevant to IP PBX telephony systems. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

Tackling VoIP fraud, new idea
by sil＠infiltrated.net Feb. 21, 2014

Feb. 21, 2014

Because none of us want to deal with fraud, and many of us have fought it, are fighting it, and eventually (like it or not) will come across it. I am proposing starting up a NON PUBLIC, TRUSTED mailing list. The purpose of the list would be to share information on attacks, numbers, dialed, and so forth. The reasoning for it not being public, would be obvious, avoid letting a threat actor know they have been flagged. The theory behind this list, would be to aggregate KNOWN fradulent destinations for the purposes of creating some form of blacklist, or triggering mechanism. For example, suppose I had a break in, where calls went to 2125551212. On the list I would send an email stating: x.x.x.x (IP) | 2125551212 | DATE | CHECKSUM First field is obvious, you'd want to block this address. Second field, one can set up a triggering mechanism. (Pseudo code) if [ number == 2125551212 ] then do something (send_email || generate_phonecall done fi The date, is for historical purposes, and the checksum would be a variable of which system saw what. For those who have seen my VABL list http://www.infiltrated.net/vabl.txt It would look EXACTLY like that. So for anyone who'd care to share, without disclosing WHO shared the information, there would be a mechanism to hide your identity (company info, etc..) The other reason for it being a NON public list, would be a matter of trust in the sense that, I would NOT allow any freemail (Gmail, Hotmail, etc) to be used, in order to minimize any false positives. The last thing I would want is for someone to maliciously submit data against a competitor. (make sense?) I am willing to start, and maintain such list, however, I'd need to know whether or not a) others are willing to share attack data (which will be sanitized) b) other businesses and peers would find the data useful. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

CNAM on toll free?
by gfreeman＠sungevity.com Feb. 14, 2014

Feb. 14, 2014

Hi, folks, Can toll-free numbers have CNAM registrations? We're hoping to have it say something other than "TOLL-FREE CALLER", but our vendor says that toll-free CNAMs can't change. thanks, Graham Freeman gfreeman at sungevity.com

3 2

"One Ring" Scam
by kris＠kriskinc.com Feb. 3, 2014

Feb. 3, 2014

http://westflorida.bbb.org/article/bbb-scam-alert-one-ring-cell-phone-scam-… Does anyone have any details on this traffic (country codes, CID, etc)? -- Kristian Kielhofner

4 3

Fake Conferences CSCI and WORLDCOMP of Hamid Arabnia
by hailybrown＠hushmail.com Jan. 30, 2014

Jan. 30, 2014

Fake Conferences CSCI and WORLDCOMP of Hamid Arabnia If you have any thought of attending the world?s biggest fake conference in computer science, WORLDCOMP http://www.world-academy-of-science.org you must visit any websites below https://sites.google.com/site/worlddump1 or https://sites.google.com/site/dumpconf https://sites.google.com/site/moneycomp1 https://sites.google.com/site/worlddump4 The organizer of this conference is Hamid Arabnia http://www.cs.uga.edu/~hra a professor from University of Georgia, Athens, US. The primary goal of this conference is to collect registration fee by accepting all submitted papers. Several fake papers were published in the conference proceedings. He already earned millions of dollars from the registration fee and is using part of the money for anti-Christmas greetings campaign. http://worldcomp-fake-bogus.blogspot.com has additional information on this campaign. He recently started another new conference CSCI due to his hunger for money http://www.americancse.org Hamid Arabnia failed to reveal the reviews and reviewers' information for all the papers he received, despite repeated requests and challenges. The reason for his failure is there were no reviews and reviewers and he just cheated the research community for more than a decade by announcing that each draft paper is reviewed by two experts. We challenge him to publish these details at the conference website. Where are these experts? Where are these reviews? Soon he comes up with a story that he lost all the reviews and reviewers? information because of computer crash or theft. DBLP stopped indexing these conferences since 2011 and displayed an explicit message; The DBLP Advisory Board decided to discontinue indexing of this conference series. Visit http://www.informatik.uni-trier.de/~ley/db/conf/biocomp/index.html as a sample. He was forced to remove his name, the university of Georgia name, and university of Georgia email address from the conference?s contact page because the University has banned him from doing that. Do not spoil your resume by publishing in this bogus conference. Wikipedia?s comments on Hamid Arabnia are at http://en.wikipedia.org/w/index.php?title=Talk:Hamid_Arabnia&oldid Additional information on this conference bogus conference is available by searching internet using the keywords worldcomp fake or Hamid Arabnia fake Apologies for posting to multiple mailing lists. Spreading the news is the only way to stop this conference from harming innocent researchers. Respectfully, Many researchers cheated by Hamid Arabnia?s fake conferences

1 0

recommendations for PRI/POTS/DATA CPE device with fiber handoff
by myaklin＠g4.net Jan. 28, 2014

Jan. 28, 2014

All, I was looking at Adtran's website at the TA90Xe boxes because I swore they made a model with a SFP port but I cannot seem to find one. I am waiting for my Adtran SE to call back so I thought I would email the list and see what everyone else is using in this situation. We run fiber directly to the customer premise. The customer wants a PRI, 6 POTS, and 10-20 Mb/s internet. I want QoS on the upstream to be solid, I would prefer a device which can terminate the fiber directly, and run all the services from the same device. If my memory was incorrect and the TA90Xe does not offer a SFP port should I just stick a media converter in front of it or does anyone else have some gear to recommend? Thanks for any tips, matt at g4.net

3 8

Phone Numbers with Calling Restrictions
by jra＠baylink.com Jan. 22, 2014

Jan. 22, 2014

[ because Voiceops properly does not set reply-to, and Zimbra 6 sucks, and I was tired; I inadvertantly routed this reply to NANOG out of habit. I see a couple of NANOGers replied back here on-list anyway; thanks, folks. :-) ] ----- Original Message ----- > From: "Tim Donahue" <tim.donahue at gmail.com> > We ported this to an underlying carrier (the guilty party shall remain > nameless), and according to their engineers they have no option to > disable the SSC. > > I actually have no idea if the call I am making is blocked at the local > switch for my POTS test line, the LD carrier, or inbound to our ULC (or any > other part of the path it might have crossed). This information was not > provided to me in the response from our ULC, but it would be interesting to > know for future reference where these blocks happen. Waitaminnit. The calls are being blocked... well, they'd have to be being blocked *before they get to your gaining carrier, I guess, right? That nearly *requires* the code to be in the LERG, so the originating CO can execute it. We have some people here who know the LERG back and fro; Paul? Anyone else? You ever heard of this? Can you originate a call to that number from a different carrier via PRI, and see which ISDN error you get back? Or have someone else call it that way? ISDN errors tend to have a bit more data in them. I'd do it, but I don't have any PRIs laying around anymore. Cheers, -- jra -- Jay R. Ashworth Baylink jra at baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

1 0

Phone Numbers with Calling Restrictions
by jay＠west.net Jan. 22, 2014

Jan. 22, 2014

On 1/22/14 12:23 PM, Jay Ashworth wrote: > Waitaminnit. > > The calls are being blocked... well, they'd have to be being blocked > *before they get to your gaining carrier, I guess, right? > > That nearly *requires* the code to be in the LERG, so the originating CO > can execute it. We have some people here who know the LERG back and fro; > Paul? Anyone else? You ever heard of this? > > Can you originate a call to that number from a different carrier via > PRI, and see which ISDN error you get back? Or have someone else call > it that way? > > ISDN errors tend to have a bit more data in them. > > I'd do it, but I don't have any PRIs laying around anymore. I do. What's the TN or at least the block? -- Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

3 2