- VoiceOps - lists.voiceops.org

[VOIPSEC] Phone fraud doubles
by sil＠infiltrated.net Nov. 22, 2013

Nov. 22, 2013

On Thu, 21 Nov 2013, Vijay Balasubramaniyan wrote: > The report is split into 2 sections: > A) What we are seeing at call centers > B) What individual consumers are seeing. > > The 2.4 million comments are with respect to B) not A). So this is not with > respect to a call center. At FI call centers we are seeing 1 in 2500 calls > being an attempt to take over an account (ATO). So if you get 1 million > calls a month you are likely to see 400 attempts at ATO. Our last report > was purely consumer focussed and in this report we are showing what we > believe are both sides of the coin. Please let me know if this clarifies > your concerns and appreciate your feedback. Let me know if you have any > follow up questions. > > This is also a great way to finally send a mail on this group which I have > been following for all the information it provides. > So it is just as I expected. I will give you an example. We have all seen/read/experience 'ye phantom call' that Sandro Gauci clarified last week. I have a client with a couple of trunks, Audiocodes gateway thing-a-ma-bob. She calls us up telling us she is receiving hundreds of calls a day. With this data, how accurate would it be if I averaged her calls, multiplied the number ghost calls, then reported: "Man, I am seeing 10,000,000 fraud attempts per month!" The realities behind those numebrs aren't real. They're scaled sideways. I do this (scaling sideways) when I want new equipment all the time. Me: "Man, the amount of attacks has quadrupled. Take a look at my Splunk parsing. Call leg in, call leg out that's 2 calls! (when its really 1). We need the latest and gr8est in Juniperism Equipment otherwise we are doomed!" Manager: "Wow we are getting attacked aren't we!" Scans - I don't count as attacks Enumeration - I don't count that either I could an actual compromise as an attack. We have had those on PBXs we provided trunks for. This is because the clients don't learn no matter what we tell them. "Stop using 12345 as a password k thanx!" This is not a post to take away from your data, but the reality is, from my perspective, if you said 2.5 million, I'm willing to bet a years worth of lunch, the actual number is in the tens of thousands *IF* even that much. Even our upstreams (VZ, Level3, MiniLevel3 (GBLX), Tandem, etc.) have gotten a little smart on alerting for fraud. (Its after the fact, but its nice to know they saw it tenteen hours late). My colleagues and I stopped counting managed PBXs, trunks, etc because it reached too many to keep track of. We do however, run all through SBCs with using Transnexus which is great, but at the same time, we have learned the ropes and created our own Frankenstein alerting system. ATTACK wise (meaning compromise) these have dwindled into perhaps the teens, and even then, Transnexus allows us to further minimize the $ damage. Mind you, I could easily say: "Im getting scanned! (attack)" "I'm being brute forced! (attack)" and throw this number into the tens of millions easily. This doesn't even include clients softphones, Snoms, Polys, etc., that receive ghost calls. "I'm getting spammed, ghost calls." Heck I wouldn't even know where to place the figure. Tens of millions? So define ATO. Is this a scan, someone bruteforcing. What is an ATO. I define an attack as a compromise when it comes to VoIP. Lord knows there aren't enough days in the year to count scans, sipvicious, other nonsense. Not to forget about the honeypots I have lurking. 400 "attempts" is literally peanuts (.25%) sourcetype Count Last Update CDR-6 5,716,520 Thu Nov 21 16:06:42 2013 One SBC, one month. If I dug out how many failed brute force attempts, scans, etc., I could easily say.. Of the 5,716,520 calls that were put through, based on the amount of scans, brute forcers, etc., I have seen, there were 100,000,000 attacker. 1,000 people tried scanning 1,000 accounts! See the dilemma? No harm no foul. Reality? OF the 5,716,520 calls, we had 450 ATTEMPTED fraudulent attempts, of which 90 completed, of which most were blocked after N attempts (Transnexus). So bottom line? we had 90 fraudulent calls aka 0.001574% fraud. Even if I multiplied this 44x (to meet your 400 call criteria), I'd be in the 0.069% range for fraud at a little over a quarter billion calls. I won't even get into what the call center we have is saying. This is coming from engineering now. People in my call center will tell me the Internet is blown up simply because their browser isn't opened. They aren't trained to see real data. Anyhow ;) Let me stop picking on the list before someone steps on me! -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

2 1

Issues with ISPs blocking SIP 5060 - 5061
by dthompson＠esi-estech.com Nov. 21, 2013

Nov. 21, 2013

Has anyone been having problems lately with ISPs? actively blocking UDP 5060 ? 5061? I?m having problems with Road Runner in Hawaii apparently blocking those ports preventing me from communicating with the customers PBX. My customer has a ticket open with them but we aren?t confident that we?ll get anywhere with them. If we don?t is there an authority that we can speak with that can make them open those ports or face sanctions? David Thompson Network Services Support Technician (O) 858.357.8794 (F) 858-225-1882 (E) dthompson at esi-estech.com (W) www.esi-estech.com

14 19

Phone fraud doubles
by sil＠infiltrated.net Nov. 21, 2013

Nov. 21, 2013

Fluff, fluff, fluff, fluff, fluff... "Pindrop Security, a startup focused on combating phone-based fraud for banks and enterprise call centers, has released a new report outlining some of the risks phone fraud poses to financial institution call centers." http://www.securityweek.com/financial-phone-fraud-attempts-double-1h-2013-r… ------------ Outside of a nice little bit of marketing, I think most of us know, and see that phone fraud is up however, some of what is quoted just sounds off: "counted over 2.4 million consumer complaints of phone fraud attempts." First... How big of a call center would they have to count this many complaints. Second, we can go back to the "Ghost calls" thread (Hennigan) from 11/12 and others... Does a phantom call constitute a complaint. What about the 100,000 ghost calls sent my one attacker? I have been meaning to do some more analytics on some of the junk I have seen, but become overwhelmed. I am highly convinced that right now, there is 1) About a half dozen groups highly focused on this (VoIP heavy hitters), and 2) there is a forum shared by the attackers amongst one another sort of a "VoIP carders market" (if you will), where an attacker will post compromised servers to share in what I perceive is a "fraudulent calling card" center with a way to give kickbacks to carriers in questionable countries. I believe the end destination carrier in some cases is likely related (family wise) to some of the attackers. E.g.: Palestine has been ramping things up via VoIP attacks. What I notice is these attackers try to call numbers whose carrier is owned by another Palestinian elsewhere. And it is not isolated to Palestine, they happen to be the heavy hitters via my logs this quarter. I have seen: Romanian attacker --> route calls to company in UK which happens to be owned by (drum roll) another Romanian. Nevertheless, thought I'd ramp up some discourse on VoIP and the oft overlooked (or is it underlooked) topic of security. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

Cincinnati Outage?
by paul＠timmins.net Nov. 20, 2013

Nov. 20, 2013

Preliminary Earthquake Report Magnitude 3.5 Date-Time 20 Nov 2013 17:59:40?UTC 20 Nov 2013 12:59:40?near epicenter 20 Nov 2013 11:59:40?standard time in your timezone Location 39.439N 82.190W Depth 7 km Distances 4 km (2 mi) ESE of Nelsonville, Ohio 14 km (8 mi) NNW of Athens, Ohio 46 km (28 mi) SE of Lancaster, Ohio 56 km (34 mi) WNW of Vienna, West Virginia 90 km (55 mi) SE of Columbus, Ohio Location Uncertainty Horizontal: 0.0 km; Vertical 7.8 km Parameters Nph = 71; Dmin = 69.4 km; Rmss = 0.60 seconds; Gp = 22? Version = Event ID us b000l2y3 Sent from my Samsung Galaxy S?4 -------- Original message -------- From: "J. Oquendo" <sil at infiltrated.net> Date: 2013/11/20 13:17 (GMT-05:00) To: outages at outages.org Cc: voiceops at voiceops.org Subject: [VoiceOps] Cincinnati Outage? Anyone seeing (or rather NOT seeing) voice traffic from Cincinnati via Level3 or other? Squirrels confused between dark fiber and metamucil? Apologies for multi-list, in the event someone on VoiceOps knows something. Level3 says: "nope, our system is five nines!" (as usual). -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

1 0

Cincinnati Outage?
by sil＠infiltrated.net Nov. 20, 2013

Nov. 20, 2013

Anyone seeing (or rather NOT seeing) voice traffic from Cincinnati via Level3 or other? Squirrels confused between dark fiber and metamucil? Apologies for multi-list, in the event someone on VoiceOps knows something. Level3 says: "nope, our system is five nines!" (as usual). -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

2 1

DDOS on communications networks: I want your experiences
by ryandelgrosso＠gmail.com Nov. 18, 2013

Nov. 18, 2013

All, I am putting together a talk on DDOS attacks on VoIP networks to present next year and while I have a fair body of work to draw from in my own experience I am sure someone out there has seen stuff I haven't. So if you have dealt with a DDOS attack on your voice network and have a few minutes to share the notes of the case with me I would love to hear about it. Feel free to reply on or off list. Thanks in advance -Ryan Delgrosso

2 1

Ghost calls - Sipvicious?
by jay＠west.net Nov. 13, 2013

Nov. 13, 2013

We operate a hosted VoIP platform using Broadworks and over 90% Polycom phones. We have a number of customers at diverse locations recently reporting dead-air calls. These typically come from a source ANI of 100 or 7070 and have no audio. Most of the phones are behind Adtran TA900 series IADs with NAT and a SIP access list allowing only our own SBCs. The calls don't show up in our SBC logs, nor do they show in the MOS graphs on the Adtran voice quality monitoring. Any ideas or suggestions on what is causing this or how to stop it? -- -- Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

5 6

Adtran TA900 timing problems
by mylists＠battleop.com Nov. 5, 2013

Nov. 5, 2013

Has anyone ever seen this problem? I have a good number of TA900s and TA900Es on the other side of a 7206VXR with PA-MC-T3 cards. Once every few months SIP accounts in the TA900s that are attached to FXS ports have trouble passing audio. It sounds like the audio stream is On/Off about every 3 seconds. The only "fix" is to change the timing from the T1 to internal or reboot the router which effectively does the same thing. It never has an effect on PRI/T1 voice, Hosted PBX behind that router, or data traffic behind the router. We never see a problem with other Cisco routers connected to the same DS3(s) including voice on Cisco 2431-8FXS and 16FXS rotuers. When the problem happens it will happen to every TA900 or TA900E at the same time on the same DS3. It's always a single random DS3 in the same box. I've had countless tickets open with our DS3/T1 Provider over the years and they always say they see nothing. Adtran's only solution so far is to change the timing when it happens. One tech suggested we just run internal timing all the time but that seems to only work for 31 days. I've completely swapped out the 7200 and the PA-MC-T3 cards. I've had a JDSU test set on random DS3s for weeks at a time and never seen a problem. We set up the routers so that the T1 is the Primary and the Internal is secondary. I suspect that something happens to the primary clock and it fails to the internal clock. When the primary clock becomes available again the TA900 does not revert back to the T1 clock. So when we get to around 31 days the internal timing fails and then the problem with the audio happens. -Richey

5 9

Invitation to connect on LinkedIn
by nick.crocker＠gmail.com Nov. 5, 2013

Nov. 5, 2013

LinkedIn ------------ I'd like to add you to my professional network on LinkedIn. - Nick Nick Crocker Senior VoIP Infrastructure Engineer at One Source Networks Austin, Texas Area Confirm that you know Nick Crocker: https://www.linkedin.com/e/-1jciiy-hnmewphu-72/isd/17802609040/-xV1IjFA/?hs… -- You are receiving Invitation to Connect emails. Click to unsubscribe: http://www.linkedin.com/e/-1jciiy-hnmewphu-72/qsHV3tWxE1OhUzjlpOHtd2YOB0FiV… (c) 2012 LinkedIn Corporation. 2029 Stierlin Ct, Mountain View, CA 94043, USA.

1 0

looking for advice on international fraud that took place via an Edgemarc 200EW with FXO line installed
by myaklin＠g4.net Nov. 1, 2013

Nov. 1, 2013

Hi all, I had some toll fraud to Grenada last night which we stopped as soon as we became aware of it. Example numbers being dialed were: 1-473-405-0085 1-473-405-0084 1-473-405-0088 Normally I can track down how it happened to figure out who was at fault. But this time I am having a hard time. The customer has two types of service from us. Yealink phones connected to our Broadsoft system with an Edgemarc 200EW installed at the customer premise. They also have some POTS line with us for faxing. One of those POTS lines is connected to the Edgemarc 200EW via the built in FXO port for "Survivability". Meaning if the WAN ethernet port on the Edgemarc has a failure they can at least have one line to dial out on in case of an emergency. That is about the only time it would ever be used except for faxing. The toll fraud CPN just happens to be that POTS line connected to the Edgemarc. That POTS line is also connected to a very basic fax machine. In the Edgemarc for that FXO port two stage dialing is disabled in both directions. We had incoming calls on the FXO line being forward to a Yealink phone but that would never function properly due to the customer having a fax line picking up first. Just leftover config during the install where we made an assumption the customer might want it. The Yealink phones are behind the Edgemarc (NAT) and not reachable via the internet. The Edgemarc is using radius for user auth and has strong passwords set. I cannot find any config in Broadsoft where a user had call forwarding setup or whatever that would cause this. I cannot find any settings in the Edgemarc that would allow this to take place. As in a config mistake. The Edgemarc is running code Version 11.6.19. The Yealink phones are also up2date with the newest code from the vendor's website. I do not think this fraud was done on site via physical means. It is a school and I just cannot picture a student or faculty having a need to call Grenada. The Edgemarc does have port 5060 open to the world but it is just a ?proxy? I was under the impression that one cannot brute force an account on a proxy device that has no config as such like an asterisk box would. You would be basically brute forcing against Broadsoft in that case? Either way I am still digging into things but I thought by sending this email someone might have some advice to clue me into something I am missing when it comes to Edgemarc and FXO security. Thanks, matt at g4.net

7 14