[VOIPSEC] Tackling VoIP fraud, new idea

[J. Oquendo]

Because none of us want to deal with fraud, and many of us
have fought it, are fighting it, and eventually (like it or
not) will come across it. I am proposing starting up a NON
PUBLIC, TRUSTED mailing list. The purpose of the list would
be to share information on attacks, numbers, dialed, and so
forth. The reasoning for it not being public, would be
obvious, avoid letting a threat actor know they have been
flagged.

The theory behind this list, would be to aggregate KNOWN
fradulent destinations for the purposes of creating some
form of blacklist, or triggering mechanism. For example,
suppose I had a break in, where calls went to 2125551212.
On the list I would send an email stating:

x.x.x.x (IP) | 2125551212 | DATE | CHECKSUM

First field is obvious, you'd want to block this address.
Second field, one can set up a triggering mechanism.
(Pseudo code)

if [ number == 2125551212 ]
then
do something (send_email || generate_phonecall
done
fi

The date, is for historical purposes, and the checksum
would be a variable of which system saw what. For those
who have seen my VABL list http://www.infiltrated.net/vabl.txt
It would look EXACTLY like that. So for anyone who'd
care to share, without disclosing WHO shared the
information, there would be a mechanism to hide your
identity (company info, etc..)

The other reason for it being a NON public list, would be a
matter of trust in the sense that, I would NOT allow any
freemail (Gmail, Hotmail, etc) to be used, in order to
minimize any false positives. The last thing I would want
is for someone to maliciously submit data against a
competitor. (make sense?)

I am willing to start, and maintain such list, however, I'd
need to know whether or not a) others are willing to share
attack data (which will be sanitized) b) other businesses
and peers would find the data useful.
--
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM

"Where ignorance is our master, there is no possibility of
real peace" - Dalai Lama

42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

[Jon Farmer]

Hi

I would be interested in seeing such an initiative.

I would also be interesting in helping out where I can.

Regards

Jon


On 21 February 2014 15:25, J. Oquendo <***@infiltrated.net> wrote:

> Because none of us want to deal with fraud, and many of us
> have fought it, are fighting it, and eventually (like it or
> not) will come across it. I am proposing starting up a NON
> PUBLIC, TRUSTED mailing list. The purpose of the list would
> be to share information on attacks, numbers, dialed, and so
> forth. The reasoning for it not being public, would be
> obvious, avoid letting a threat actor know they have been
> flagged.
>
> The theory behind this list, would be to aggregate KNOWN
> fradulent destinations for the purposes of creating some
> form of blacklist, or triggering mechanism. For example,
> suppose I had a break in, where calls went to 2125551212.
> On the list I would send an email stating:
>
> x.x.x.x (IP) | 2125551212 | DATE | CHECKSUM
>
> First field is obvious, you'd want to block this address.
> Second field, one can set up a triggering mechanism.
> (Pseudo code)
>
> if [ number == 2125551212 ]
> then
> do something (send_email || generate_phonecall
> done
> fi
>
> The date, is for historical purposes, and the checksum
> would be a variable of which system saw what. For those
> who have seen my VABL list http://www.infiltrated.net/vabl.txt
> It would look EXACTLY like that. So for anyone who'd
> care to share, without disclosing WHO shared the
> information, there would be a mechanism to hide your
> identity (company info, etc..)
>
> The other reason for it being a NON public list, would be a
> matter of trust in the sense that, I would NOT allow any
> freemail (Gmail, Hotmail, etc) to be used, in order to
> minimize any false positives. The last thing I would want
> is for someone to maliciously submit data against a
> competitor. (make sense?)
>
> I am willing to start, and maintain such list, however, I'd
> need to know whether or not a) others are willing to share
> attack data (which will be sanitized) b) other businesses
> and peers would find the data useful.
> --
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
> J. Oquendo
> SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM
>
> "Where ignorance is our master, there is no possibility of
> real peace" - Dalai Lama
>
> 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
>



--
Jon Farmer
Tel: [phone]
google.com/+JonFarmer

[D'Arcy J.M. Cain]

On Fri, 21 Feb 2014 09:25:13 -0600
"J. Oquendo" <***@infiltrated.net> wrote:
> Because none of us want to deal with fraud, and many of us
> have fought it, are fighting it, and eventually (like it or
> not) will come across it. I am proposing starting up a NON
> PUBLIC, TRUSTED mailing list. The purpose of the list would
> be to share information on attacks, numbers, dialed, and so
> forth. The reasoning for it not being public, would be
> obvious, avoid letting a threat actor know they have been
> flagged.

Sounds like a reasonable idea. I'm not sure how structured it needs to
be though.

> The theory behind this list, would be to aggregate KNOWN
> fradulent destinations for the purposes of creating some
> form of blacklist, or triggering mechanism. For example,
> suppose I had a break in, where calls went to 2125551212.
> On the list I would send an email stating:
>
> x.x.x.x (IP) | 2125551212 | DATE | CHECKSUM
>
> First field is obvious, you'd want to block this address.

Right.

> Second field, one can set up a triggering mechanism.
> (Pseudo code)
>
> if [ number == 2125551212 ]
> then
> do something (send_email || generate_phonecall
> done
> fi

Not sure what you mean here. If the IP is already blocked then what
are we checking?

>
> The date, is for historical purposes, and the checksum
> would be a variable of which system saw what. For those
> who have seen my VABL list http://www.infiltrated.net/vabl.txt
> It would look EXACTLY like that. So for anyone who'd
> care to share, without disclosing WHO shared the
> information, there would be a mechanism to hide your
> identity (company info, etc..)

Not sure about this. What if I want to weight the reports based on who
submitted them. There may be members that I completely trust and would
block based on their report. For others I may want to see multiple
reports before I block.

> The other reason for it being a NON public list, would be a
> matter of trust in the sense that, I would NOT allow any
> freemail (Gmail, Hotmail, etc) to be used, in order to

What about non-free email? It seems to me that a tighter vetting
process is needed. I wouldn't accept any email that was not attached
to an actual VoIP provider. I realize that that takes more work though.

> I am willing to start, and maintain such list, however, I'd
> need to know whether or not a) others are willing to share
> attack data (which will be sanitized) b) other businesses
> and peers would find the data useful.

I am not totally opposed to the idea. Not sure how useful it might
be. What sort of attacks are you thinking about? I already block IPs
based on failures to register and no one can dial without being
registered. It's all automatic.

--
D'Arcy J.M. Cain
System Administrator, Vex.Net
http://www.Vex.Net/ IM:***@Vex.Net
VoIP: sip:***@Vex.Net

[J. Oquendo]

On Fri, 21 Feb 2014, D'Arcy J.M. Cain wrote:

> > Second field, one can set up a triggering mechanism.
> > (Pseudo code)
> >
> > if [ number == 2125551212 ]
> > then
> > do something (send_email || generate_phonecall
> > done
> > fi
>
> Not sure what you mean here. If the IP is already blocked then what
> are we checking?

Blocking an IP will ONLY block the attacker from doing malice
from that host. If by chance someone made it onto one of your
machines, you could set a trigger that says: Hey if you see
an account trying to dial this KNOWN_TO_BE_BAD number that is
listed, send me an e-mail, or lookup what OTHER IP is now
trying to call that number and block them too.

> Not sure about this. What if I want to weight the reports based on who
> submitted them. There may be members that I completely trust and would
> block based on their report. For others I may want to see multiple
> reports before I block.

I don't disagree however, I am taking my malware analysis and
DFIR experience here. The reason (IMHO) we companies still get
compromised six ways from Sunday is, many don't share data for
various reasons: 1) they don't want the public/others to know
"they've been had," 2) data submitted may be relevant to an
ongoing law enforcement related investigation 3) good old
fashioned chest thumping.

Chest thumping. I have seen many companies take the approach
that attacker data is some holy grail. "We were the first and
only to see this!" All the while others could have been given
a green light on an attack source.

> What about non-free email? It seems to me that a tighter vetting
> process is needed. I wouldn't accept any email that was not attached
> to an actual VoIP provider. I realize that that takes more work though.

There are VoIP providers, ITSPs, Carriers, but you're leaving
out the small businesses, and smaller non carrier like shops
who can also disclose attack sources.

> I am not totally opposed to the idea. Not sure how useful it might
> be. What sort of attacks are you thinking about? I already block IPs
> based on failures to register and no one can dial without being
> registered. It's all automatic.

I am thinking the whole gamut of attacks. Registrations,
actual calls, anything related to VoIP. Web based exploit
of a PBX. Anything that is relevant to IP PBX telephony
systems.

--
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM

"Where ignorance is our master, there is no possibility of
real peace" - Dalai Lama

42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

[Sergey Kolesnichenko]

One more mailing list? :-) I'm sure it is a bad idea. I'm working for a
company to protect it from VoIP related attacks, but you will never have
gurantess that I will not be using the data in a private list to attack
someone as a private individual :-) it is a security hole in a private list
about VoIP security...


2014-02-21 18:02 GMT+02:00 J. Oquendo <***@infiltrated.net>:

> On Fri, 21 Feb 2014, D'Arcy J.M. Cain wrote:
>
> > > Second field, one can set up a triggering mechanism.
> > > (Pseudo code)
> > >
> > > if [ number == 2125551212 ]
> > > then
> > > do something (send_email || generate_phonecall
> > > done
> > > fi
> >
> > Not sure what you mean here. If the IP is already blocked then what
> > are we checking?
>
> Blocking an IP will ONLY block the attacker from doing malice
> from that host. If by chance someone made it onto one of your
> machines, you could set a trigger that says: Hey if you see
> an account trying to dial this KNOWN_TO_BE_BAD number that is
> listed, send me an e-mail, or lookup what OTHER IP is now
> trying to call that number and block them too.
>
> > Not sure about this. What if I want to weight the reports based on who
> > submitted them. There may be members that I completely trust and would
> > block based on their report. For others I may want to see multiple
> > reports before I block.
>
> I don't disagree however, I am taking my malware analysis and
> DFIR experience here. The reason (IMHO) we companies still get
> compromised six ways from Sunday is, many don't share data for
> various reasons: 1) they don't want the public/others to know
> "they've been had," 2) data submitted may be relevant to an
> ongoing law enforcement related investigation 3) good old
> fashioned chest thumping.
>
> Chest thumping. I have seen many companies take the approach
> that attacker data is some holy grail. "We were the first and
> only to see this!" All the while others could have been given
> a green light on an attack source.
>
> > What about non-free email? It seems to me that a tighter vetting
> > process is needed. I wouldn't accept any email that was not attached
> > to an actual VoIP provider. I realize that that takes more work though.
>
> There are VoIP providers, ITSPs, Carriers, but you're leaving
> out the small businesses, and smaller non carrier like shops
> who can also disclose attack sources.
>
> > I am not totally opposed to the idea. Not sure how useful it might
> > be. What sort of attacks are you thinking about? I already block IPs
> > based on failures to register and no one can dial without being
> > registered. It's all automatic.
>
> I am thinking the whole gamut of attacks. Registrations,
> actual calls, anything related to VoIP. Web based exploit
> of a PBX. Anything that is relevant to IP PBX telephony
> systems.
>
> --
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
> J. Oquendo
> SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM
>
> "Where ignorance is our master, there is no possibility of
> real peace" - Dalai Lama
>
> 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
>

[J. Oquendo]

On Fri, 21 Feb 2014, Sergey Kolesnichenko wrote:

> One more mailing list? :-) I'm sure it is a bad idea. I'm working for a
> company to protect it from VoIP related attacks, but you will never have
> gurantess that I will not be using the data in a private list to attack
> someone as a private individual :-) it is a security hole in a private list
> about VoIP security...
>

I disagree with it being a bad idea. There is never any
guarantees in life. The purpose for a private list, is it
protects COMPANIES data. There is a trust mechanism in the
sense that should/if/when someone wants to contest data,
I can go back based on checksum to determine WHO submitted
what. I HIGHLY doubt, someone would throw away their
reputation, and or damage company reputation by submitting
falsified data.


--
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM

"Where ignorance is our master, there is no possibility of
real peace" - Dalai Lama

42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

[Sergey Kolesnichenko]

They will not submit falsified data, they will use the data to bypass
filters.


2014-02-21 18:18 GMT+02:00 J. Oquendo <***@infiltrated.net>:

> On Fri, 21 Feb 2014, Sergey Kolesnichenko wrote:
>
> > One more mailing list? :-) I'm sure it is a bad idea. I'm working for a
> > company to protect it from VoIP related attacks, but you will never have
> > gurantess that I will not be using the data in a private list to attack
> > someone as a private individual :-) it is a security hole in a private
> list
> > about VoIP security...
> >
>
> I disagree with it being a bad idea. There is never any
> guarantees in life. The purpose for a private list, is it
> protects COMPANIES data. There is a trust mechanism in the
> sense that should/if/when someone wants to contest data,
> I can go back based on checksum to determine WHO submitted
> what. I HIGHLY doubt, someone would throw away their
> reputation, and or damage company reputation by submitting
> falsified data.
>
>
> --
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
> J. Oquendo
> SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM
>
> "Where ignorance is our master, there is no possibility of
> real peace" - Dalai Lama
>
> 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
>

[Sergey Kolesnichenko]

Why dont't you want to speak about tactics here openly?


2014-02-21 19:51 GMT+02:00 Peter Beckman <***@angryox.com>:

> Email sucks for this. I don't want to read an email about something hours
> or days after the issue is happening and have to do something manually to
> protect my infrastructure.
>
> This seems like something that should be an API in which trusted people can
> access.
>
> But then you have concerns about trust of the data. Do I trust your
> reasoning for an IP block? Do I even get to see your evidence?
>
> Honestly I don't need a list or an API to block stuff.
>
> HOWEVER, if this can become a private discussion list to talk about
> methods, techniques and tactics that we can all implement in order to
> prevent telecom/SIP/VoIP fraud on our own, THAT I'd be interested in.
>
> Beckman
>
>
>
> On Fri, 21 Feb 2014, J. Oquendo wrote:
>
> On Fri, 21 Feb 2014, Sergey Kolesnichenko wrote:
>>
>> One more mailing list? :-) I'm sure it is a bad idea. I'm working for a
>>> company to protect it from VoIP related attacks, but you will never have
>>> gurantess that I will not be using the data in a private list to attack
>>> someone as a private individual :-) it is a security hole in a private
>>> list
>>> about VoIP security...
>>>
>>>
>> I disagree with it being a bad idea. There is never any
>> guarantees in life. The purpose for a private list, is it
>> protects COMPANIES data. There is a trust mechanism in the
>> sense that should/if/when someone wants to contest data,
>> I can go back based on checksum to determine WHO submitted
>> what. I HIGHLY doubt, someone would throw away their
>> reputation, and or damage company reputation by submitting
>> falsified data.
>>
>>
>> --
>> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>> J. Oquendo
>> SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM
>>
>> "Where ignorance is our master, there is no possibility of
>> real peace" - Dalai Lama
>>
>> 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
>> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
>> _______________________________________________
>> VoiceOps mailing list
>> ***@voiceops.org
>> https://puck.nether.net/mailman/listinfo/voiceops
>>
>>
> ------------------------------------------------------------
> ---------------
> Peter Beckman Internet Guy
> ***@angryox.com
> http://www.angryox.com/
> ------------------------------------------------------------
> ---------------
>

[J. Oquendo]

On Fri, 21 Feb 2014, Sergey Kolesnichenko wrote:

> Why dont't you want to speak about tactics here openly?
>

Common sense. This is a public list, and there is no way
for me to determine the intentions of anyone who is a
subscriber to the list. It is a KNOWN fact, that criminals
subscribe to security mailing lists such as Bugtraq,
Full Disclosure and others. Not for the sake of lending a
helping hand, but for other means. Much similar to malware
authors who run their malware through VirusTotal to see
if anything is going to detect it.

On a private list, there is the accountability factor to
equate. Someone subscribed using a corporate email address.
Therefore SOME form of vetting took place.


--
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM

"Where ignorance is our master, there is no possibility of
real peace" - Dalai Lama

42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

[Mark Collier]

I like the idea of the list and will participate

Mark D. Collier
Chief Technology Officer/VP Engineering
Securelogix Corporation
13750 San Pedro
San Antonio, Texas 78232
[phone]
www.SecureLogix.com
www.voipsecurityblog.com



> On Feb 21, 2014, at 12:23 PM, "J. Oquendo" <***@infiltrated.net> wrote:
>
>> On Fri, 21 Feb 2014, Sergey Kolesnichenko wrote:
>>
>> Why dont't you want to speak about tactics here openly?
>>
>
> Common sense. This is a public list, and there is no way
> for me to determine the intentions of anyone who is a
> subscriber to the list. It is a KNOWN fact, that criminals
> subscribe to security mailing lists such as Bugtraq,
> Full Disclosure and others. Not for the sake of lending a
> helping hand, but for other means. Much similar to malware
> authors who run their malware through VirusTotal to see
> if anything is going to detect it.
>
> On a private list, there is the accountability factor to
> equate. Someone subscribed using a corporate email address.
> Therefore SOME form of vetting took place.
>
>
> --
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
> J. Oquendo
> SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM
>
> "Where ignorance is our master, there is no possibility of
> real peace" - Dalai Lama
>
> 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org

[J. Oquendo]

On Fri, 21 Feb 2014, Hiers, David wrote:

> The key is vetting the participants. Even the feds have a hard time with that...
>

Indeed which is why I stated:

1) Private mailing list - to prevent talks from being seen

2) NON freemail addresses - easier to establish that this
individual works for this company, therefore its highly
unlikely he is going to throw himself, and or his company,
under the bus passing bogus information.

The "private mailing list" is not to try to start some
secret club, VoIP Gestapo. It is merely to be able to share
data, methods, etc., with other peers in an effort to keep
our networks from piping out 100s of thousands of dollars
in toll fraud. PERIOD. ANYONE is open to participate, with
the clause that we want to, and NEED to be able to trust
data. Otherwise it will never work.

I will re-think this over the weekend and have a take two.
I think it could, and would work. I do also believe that
there are likely individuals even on this list, that would
not like the idea much, so hosting decisions need be met,
etc., in order to keep away DDoS attacks, reputation based
attacks, and so forth. That's my train of thought though.

--
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM

"Where ignorance is our master, there is no possibility of
real peace" - Dalai Lama

42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

[Raul Dusa]

This is a great ideea as long as participants validation is well defined
to avoid unwanted members. I also suggest that the archive of the mailing
list is kept private only to its members.

Thanks,
Raul Dusa
Information Security Manager
Vail Systems Inc.
Personal 800 Direct Line: [phone]





On 2/21/14, 2:37 PM, "J. Oquendo" <***@infiltrated.net> wrote:

>On Fri, 21 Feb 2014, Hiers, David wrote:
>
>> The key is vetting the participants. Even the feds have a hard time
>>with that...
>>
>
>Indeed which is why I stated:
>
>1) Private mailing list - to prevent talks from being seen
>
>2) NON freemail addresses - easier to establish that this
>individual works for this company, therefore its highly
>unlikely he is going to throw himself, and or his company,
>under the bus passing bogus information.
>
>The "private mailing list" is not to try to start some
>secret club, VoIP Gestapo. It is merely to be able to share
>data, methods, etc., with other peers in an effort to keep
>our networks from piping out 100s of thousands of dollars
>in toll fraud. PERIOD. ANYONE is open to participate, with
>the clause that we want to, and NEED to be able to trust
>data. Otherwise it will never work.
>
>I will re-think this over the weekend and have a take two.
>I think it could, and would work. I do also believe that
>there are likely individuals even on this list, that would
>not like the idea much, so hosting decisions need be met,
>etc., in order to keep away DDoS attacks, reputation based
>attacks, and so forth. That's my train of thought though.
>
>--
>=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>J. Oquendo
>SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM
>
>"Where ignorance is our master, there is no possibility of
>real peace" - Dalai Lama
>
>42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
>http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
>
>_______________________________________________
>Voipsec mailing list
>***@voipsa.org
>http://voipsa.org/mailman/listinfo/voipsec_voipsa.org

[Robin Wood]

Interesting in theory but do you think that people smart enough to do
VOIP fraud aren't smart enough to get onto a list? Does anyone here
have enough time to fully vet everyone who applies. Just one bad guy
on the list and all the intelligence gets leaked all over the forums.

Robin

On 21 February 2014 21:07, Raul Dusa <***@vailsys.com> wrote:
> This is a great ideea as long as participants validation is well defined
> to avoid unwanted members. I also suggest that the archive of the mailing
> list is kept private only to its members.
>
> Thanks,
> Raul Dusa
> Information Security Manager
> Vail Systems Inc.
> Personal 800 Direct Line: [phone]
>
>
>
>
>
> On 2/21/14, 2:37 PM, "J. Oquendo" <***@infiltrated.net> wrote:
>
>>On Fri, 21 Feb 2014, Hiers, David wrote:
>>
>>> The key is vetting the participants. Even the feds have a hard time
>>>with that...
>>>
>>
>>Indeed which is why I stated:
>>
>>1) Private mailing list - to prevent talks from being seen
>>
>>2) NON freemail addresses - easier to establish that this
>>individual works for this company, therefore its highly
>>unlikely he is going to throw himself, and or his company,
>>under the bus passing bogus information.
>>
>>The "private mailing list" is not to try to start some
>>secret club, VoIP Gestapo. It is merely to be able to share
>>data, methods, etc., with other peers in an effort to keep
>>our networks from piping out 100s of thousands of dollars
>>in toll fraud. PERIOD. ANYONE is open to participate, with
>>the clause that we want to, and NEED to be able to trust
>>data. Otherwise it will never work.
>>
>>I will re-think this over the weekend and have a take two.
>>I think it could, and would work. I do also believe that
>>there are likely individuals even on this list, that would
>>not like the idea much, so hosting decisions need be met,
>>etc., in order to keep away DDoS attacks, reputation based
>>attacks, and so forth. That's my train of thought though.
>>
>>--
>>=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>>J. Oquendo
>>SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM
>>
>>"Where ignorance is our master, there is no possibility of
>>real peace" - Dalai Lama
>>
>>42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
>>http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
>>
>>_______________________________________________
>>Voipsec mailing list
>>***@voipsa.org
>>http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
>
>
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org

[Golan ben-oni]

My feeling is that we should propose an automated format for delivering
information such as (CEF) (TAXI) (STIX) and figure out how to create a
bilateral sharing architecture with the ability to compartmentalize and
anonymize information. This would be similar to the efforts taking place in
other vertical markets, specifically financial and energy relative to IOCs
and related matters. It is important to build a parallel authenticated
(AAA) and encrypted human exchange interface to limit data leakage and
create accounting. There should be membership guidelines which restrict
sharing of private or compartmentalizes information with non-member 3rd
parties -- and I do not believe public forums are the right place as the
rate of information disclosure risk is too high! Otherwise you don't have
buy in and contribution at any meaningful level from larger Carrier
organizations.

My 2c.

Golan.



On Fri, Feb 21, 2014 at 4:07 PM, Raul Dusa <***@vailsys.com> wrote:

> This is a great ideea as long as participants validation is well defined
> to avoid unwanted members. I also suggest that the archive of the mailing
> list is kept private only to its members.
>
> Thanks,
> Raul Dusa
> Information Security Manager
> Vail Systems Inc.
> Personal 800 Direct Line: [phone]
>
>
>
>
>
> On 2/21/14, 2:37 PM, "J. Oquendo" <***@infiltrated.net> wrote:
>
> >On Fri, 21 Feb 2014, Hiers, David wrote:
> >
> >> The key is vetting the participants. Even the feds have a hard time
> >>with that...
> >>
> >
> >Indeed which is why I stated:
> >
> >1) Private mailing list - to prevent talks from being seen
> >
> >2) NON freemail addresses - easier to establish that this
> >individual works for this company, therefore its highly
> >unlikely he is going to throw himself, and or his company,
> >under the bus passing bogus information.
> >
> >The "private mailing list" is not to try to start some
> >secret club, VoIP Gestapo. It is merely to be able to share
> >data, methods, etc., with other peers in an effort to keep
> >our networks from piping out 100s of thousands of dollars
> >in toll fraud. PERIOD. ANYONE is open to participate, with
> >the clause that we want to, and NEED to be able to trust
> >data. Otherwise it will never work.
> >
> >I will re-think this over the weekend and have a take two.
> >I think it could, and would work. I do also believe that
> >there are likely individuals even on this list, that would
> >not like the idea much, so hosting decisions need be met,
> >etc., in order to keep away DDoS attacks, reputation based
> >attacks, and so forth. That's my train of thought though.
> >
> >--
> >=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
> >J. Oquendo
> >SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM
> >
> >"Where ignorance is our master, there is no possibility of
> >real peace" - Dalai Lama
> >
> >42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
> >http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
> >
> >_______________________________________________
> >Voipsec mailing list
> >***@voipsa.org
> >http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
>
>
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
>



--

*Golan Ben-Oni*
Chief Security Officer, SVP Network Architecture

IDT Corporation

*IDT* <http://www.idt.net/>
520 Broad Street
<http://maps.google.com/maps?q=520+Broad+Street%2CNewark%2CNJ+07102%2CUSA&hl=en>Newark,
NJ 07102
USA

*Work:* 1 [phone]
*FindMe:* 1 (973) GET-HELP

*Email:* ***@idt.net

*Vidyo: *tiny.url/seegolan

[Jim Dalton]

It is a list of subscriber numbers that have been identified as destinations
for fraudulent calls. The list is compiled by members of the GSM Fraud
Forum and the CFCA.

In addition to the subscriber number, the list identifies the organization
that submitted the number and the reason why.



Jim Dalton

TransNexus



From: Christopher Aloi [mailto:***@gmail.com]
Sent: Monday, February 24, 2014 10:50 AM
To: Jim Dalton
Cc: J. Oquendo; Hiers, David; ***@voiceops.org; Mark Collier;
***@voipsa.org
Subject: Re: [VoiceOps] [VOIPSEC] Tackling VoIP fraud, new idea





What does the "International Revenue Fraud Number Database" on cfa.org
contain?



I agree it's tricky to block based on hosts, you hit one and the others
start popping up.








-- Christopher Aloi
-- ***@gmail.com






On Fri, Feb 21, 2014 at 4:17 PM, Jim Dalton <***@transnexus.com>
wrote:

One option maybe to cooperate with the Communications Fraud Control
Association (www.cfca.org). They do vet their members, but they do not
have a mailing list. The association also has an annual membership fee.

Jim Dalton


-----Original Message-----
From: VoiceOps [mailto:voiceops-***@voiceops.org] On Behalf Of J.
Oquendo
Sent: Friday, February 21, 2014 3:38 PM
To: Hiers, David
Cc: ***@voiceops.org; Mark Collier; ***@voipsa.org
Subject: Re: [VoiceOps] [VOIPSEC] Tackling VoIP fraud, new idea

On Fri, 21 Feb 2014, Hiers, David wrote:

> The key is vetting the participants. Even the feds have a hard time with
that...
>

Indeed which is why I stated:

1) Private mailing list - to prevent talks from being seen

2) NON freemail addresses - easier to establish that this individual works
for this company, therefore its highly unlikely he is going to throw
himself, and or his company, under the bus passing bogus information.

The "private mailing list" is not to try to start some secret club, VoIP
Gestapo. It is merely to be able to share data, methods, etc., with other
peers in an effort to keep our networks from piping out 100s of thousands of
dollars in toll fraud. PERIOD. ANYONE is open to participate, with the
clause that we want to, and NEED to be able to trust data. Otherwise it will
never work.

I will re-think this over the weekend and have a take two.
I think it could, and would work. I do also believe that there are likely
individuals even on this list, that would not like the idea much, so hosting
decisions need be met, etc., in order to keep away DDoS attacks, reputation
based attacks, and so forth. That's my train of thought though.

--
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM

"Where ignorance is our master, there is no possibility of real peace" -
Dalai Lama

42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
http://pgp.mit.edu:11371/pks/lookup?op=get
<http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF>
&search=0x2BF7D83F210A95AF

[Jim Dalton]

The CFCA may not want that information shared publicly. It would be best to
ask them directly at ***@cfca.org <mailto:***@cfca.org%A0>



From: Paul Timmins [mailto:***@timmins.net]
Sent: Monday, February 24, 2014 1:04 PM
To: ***@transnexus.com
Cc: 'Christopher Aloi'; 'Mark Collier'; ***@voipsa.org;
***@voiceops.org
Subject: Re: [VoiceOps] [VOIPSEC] Tackling VoIP fraud, new idea



How many entries are on the list, and how quickly are they added? Mulling
over the $2500 cost of membership to gain access.

On Mon, 02/24/2014 12:43 PM, "Jim Dalton" <***@transnexus.com> wrote:

It is a list of subscriber numbers that have been identified as destinations
for fraudulent calls. The list is compiled by members of the GSM Fraud
Forum and the CFCA.

In addition to the subscriber number, the list identifies the organization
that submitted the number and the reason why.



Jim Dalton

TransNexus



From: Christopher Aloi [mailto:***@gmail.com]
Sent: Monday, February 24, 2014 10:50 AM
To: Jim Dalton
Cc: J. Oquendo; Hiers, David; ***@voiceops.org; Mark Collier;
***@voipsa.org
Subject: Re: [VoiceOps] [VOIPSEC] Tackling VoIP fraud, new idea





What does the "International Revenue Fraud Number Database" on cfa.org
contain?



I agree it's tricky to block based on hosts, you hit one and the others
start popping up.








-- Christopher Aloi
-- ***@gmail.com







On Fri, Feb 21, 2014 at 4:17 PM, Jim Dalton <***@transnexus.com>
wrote:

One option maybe to cooperate with the Communications Fraud Control
Association (www.cfca.org). They do vet their members, but they do not
have a mailing list. The association also has an annual membership fee.

Jim Dalton


-----Original Message-----
From: VoiceOps [mailto:voiceops-***@voiceops.org] On Behalf Of J.
Oquendo
Sent: Friday, February 21, 2014 3:38 PM
To: Hiers, David
Cc: ***@voiceops.org; Mark Collier; ***@voipsa.org
Subject: Re: [VoiceOps] [VOIPSEC] Tackling VoIP fraud, new idea

On Fri, 21 Feb 2014, Hiers, David wrote:

> The key is vetting the participants. Even the feds have a hard time with
that...
>

Indeed which is why I stated:

1) Private mailing list - to prevent talks from being seen

2) NON freemail addresses - easier to establish that this individual works
for this company, therefore its highly unlikely he is going to throw
himself, and or his company, under the bus passing bogus information.

The "private mailing list" is not to try to start some secret club, VoIP
Gestapo. It is merely to be able to share data, methods, etc., with other
peers in an effort to keep our networks from piping out 100s of thousands of
dollars in toll fraud. PERIOD. ANYONE is open to participate, with the
clause that we want to, and NEED to be able to trust data. Otherwise it will
never work.

I will re-think this over the weekend and have a take two.
I think it could, and would work. I do also believe that there are likely
individuals even on this list, that would not like the idea much, so hosting
decisions need be met, etc., in order to keep away DDoS attacks, reputation
based attacks, and so forth. That's my train of thought though.

--
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM

"Where ignorance is our master, there is no possibility of real peace" -
Dalai Lama

42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
http://pgp.mit.edu:11371/pks/lookup?op=get
<http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF>
&search=0x2BF7D83F210A95AF
_______________________________________________
VoiceOps mailing list
***@voiceops.org
https://puck.nether.net/mailman/listinfo/voiceops

[Mike Preston]

Who is to know if a seemingly legit telco also harbours a blackhat?

Mike

On 21/02/14 20:04, J. Oquendo wrote:
> On Fri, 21 Feb 2014, Sergey Kolesnichenko wrote:
>
>> Why dont't you want to speak about tactics here openly?
>>
> Common sense. This is a public list, and there is no way
> for me to determine the intentions of anyone who is a
> subscriber to the list. It is a KNOWN fact, that criminals
> subscribe to security mailing lists such as Bugtraq,
> Full Disclosure and others. Not for the sake of lending a
> helping hand, but for other means. Much similar to malware
> authors who run their malware through VirusTotal to see
> if anything is going to detect it.
>
> On a private list, there is the accountability factor to
> equate. Someone subscribed using a corporate email address.
> Therefore SOME form of vetting took place.
>
>

[Philippe Langlois]

Hi,

This happens quite freqently: for example some smaller telecom (and this
cannot be proved) watch for discrepancies in billing i.e. calls/SMS
being made by SimBox / SimGW and not being reported in TAP/CDR nor
NRTRDE. When this happens, massive amount of minutes+SMS are then sent
on prepaid account that will not be decremented... :(

(refs: P1VID#722; https://saas.p1sec.com/vulns/722 ; "CDR-reporting
daemon crash goes undetected and can be abused")

This problem can be somewhat mitigated by "chain of trust" style of
sharing as we have with tcert.org. Problem is that this kind of "closed
club" is often either recuperated for vested interests or fades away.
No silver bullet here. How we dealt with that was a KYC[1] approach to
validate who we share the information with, but that's not perfect in
term of openness and equal access.

Best regards,
Philippe Langlois.
--
P1 Security - Priority One Security
http://www.p1sec.com

[1] Know Your Customer

On 2/22/14 1:25 PM, Mike Preston wrote:
> Who is to know if a seemingly legit telco also harbours a blackhat?
>
> Mike
>
> On 21/02/14 20:04, J. Oquendo wrote:
>> On Fri, 21 Feb 2014, Sergey Kolesnichenko wrote:
>>
>>> Why dont't you want to speak about tactics here openly?
>>>
>> Common sense. This is a public list, and there is no way
>> for me to determine the intentions of anyone who is a
>> subscriber to the list. It is a KNOWN fact, that criminals
>> subscribe to security mailing lists such as Bugtraq,
>> Full Disclosure and others. Not for the sake of lending a
>> helping hand, but for other means. Much similar to malware
>> authors who run their malware through VirusTotal to see
>> if anything is going to detect it.
>>
>> On a private list, there is the accountability factor to
>> equate. Someone subscribed using a corporate email address.
>> Therefore SOME form of vetting took place.
>>
>>
>
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
>

[Golan ben-oni]

My feeling is that we should propose an automated format for delivering
information (CEF) (TAXI) (STIX) and figure out how to create a bilateral
sharing architecture with the ability to compartmentalize and anonymize
information. This would be similar to the architecture utilized by the
banking industry (FSISAC).

On Friday, February 21, 2014, J. Oquendo <***@infiltrated.net> wrote:

> On Fri, 21 Feb 2014, Sergey Kolesnichenko wrote:
>
> > Why dont't you want to speak about tactics here openly?
> >
>
> Common sense. This is a public list, and there is no way
> for me to determine the intentions of anyone who is a
> subscriber to the list. It is a KNOWN fact, that criminals
> subscribe to security mailing lists such as Bugtraq,
> Full Disclosure and others. Not for the sake of lending a
> helping hand, but for other means. Much similar to malware
> authors who run their malware through VirusTotal to see
> if anything is going to detect it.
>
> On a private list, there is the accountability factor to
> equate. Someone subscribed using a corporate email address.
> Therefore SOME form of vetting took place.
>
>
> --
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
> J. Oquendo
> SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM
>
> "Where ignorance is our master, there is no possibility of
> real peace" - Dalai Lama
>
> 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org <javascript:;>
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
>


--

*Golan Ben-Oni*
Chief Security Officer, SVP Network Architecture

IDT Corporation

*IDT* <http://www.idt.net/>
520 Broad Street
<http://maps.google.com/maps?q=520+Broad+Street%2CNewark%2CNJ+07102%2CUSA&hl=en>Newark,
NJ 07102
USA

*Work:* 1 [phone]
*FindMe:* 1 (973) GET-HELP

*Email:* ***@idt.net

*Vidyo: *tiny.url/seegolan

[Gast, Jim]

(Apologies if you got 2 copies . . . I had not been a subscriber to ***@voipsa.org<mailto:***@voipsa.org> so my reply bounced!)



Hi, team -



In the early days of Public Key Infrastructure, we had easy ways to solve these trust questions.



The list admin creates a public-key / private-key pair called the LIST_CERT. Giving anyone the LIST_CERT gives them both keys in the pair.

The list admin creates a public-key / private-key pair called the VoIPSec Certificate Authority key-pair. The public-key becomes publicly available, but the private key is NEVER GIVEN OUT to anyone. The VoIPSec_CA_CERT contains the public-key, but NOT the private-key.



To join the list, each participant must prove (once) that the email address they give us is authentic. The new participant creates a personal key pair and gives ONLY the public key to the list administrator as a certificate signing request. The new participant will then be given a CERTificate that signs his personal public key with the VoIPSec_CA key.



Legitimate participants to the mailing list are given the LIST_CERT. If someone does not have the LIST_CERT, eavesdroppers will be unable to decrypt emails on the list.

All emails to the email list are SIGNED by an personal CERT (that is SIGNED by VoIPSec_CA) and the body of the email is also ENCRYPTED using the LIST_CERT.



Since the signature will match, the email could only have come from that particular sender (and the body could not have been altered). And the body of every email can be decrypted by any authentic list member.



Does that work well?



Cheers,



/ Jim Gast, TDS Telecom

[Fred Posner]

The more difficult we make it to share information, the less information
will get shared.

Personally, I'm in favor of an open forum, as the ideal way to attack
fraud would be to bring any discussion into the sunlight -- again, just
my seasoned opinion.

The more we discuss, the more they will change tactics. Which we will
learn, discuss, and then they will again change tactics.

Fraud, at it's simplest description, is an exploitation of flaws. The
more we harden our systems to prevent the exploitation of a flaw, the
better we will be; the better VoIP will be.

I feel that the more cloaked these conversations will be, the more our
systems and protocols will remain flawed.

I see the potential for fraudsters to see what we know, what we don't
know (potentially), and to me... that's fine. When they realize we have
found a certain scheme, they will move on to discover a new method.

--
Fred Posner | The Palner Group, Inc.
http://qxork.com

On 2/21/14, 5:04 PM, Gast, Jim wrote:
> (Apologies if you got 2 copies . . . I had not been a subscriber to
> ***@voipsa.org<mailto:***@voipsa.org> so my reply bounced!)
>
> Hi, team -
>
> In the early days of Public Key Infrastructure, we had easy ways to
> solve these trust questions.
>
> The list admin creates a public-key / private-key pair called the
> LIST_CERT. Giving anyone the LIST_CERT gives them both keys in the
> pair.
>
> The list admin creates a public-key / private-key pair called the
> VoIPSec Certificate Authority key-pair. The public-key becomes
> publicly available, but the private key is NEVER GIVEN OUT to anyone.
> The VoIPSec_CA_CERT contains the public-key, but NOT the
> private-key.
>
> To join the list, each participant must prove (once) that the email
> address they give us is authentic. The new participant creates a
> personal key pair and gives ONLY the public key to the list
> administrator as a certificate signing request. The new participant
> will then be given a CERTificate that signs his personal public key
> with the VoIPSec_CA key.
>
> Legitimate participants to the mailing list are given the LIST_CERT.
> If someone does not have the LIST_CERT, eavesdroppers will be unable
> to decrypt emails on the list.
>
> All emails to the email list are SIGNED by an personal CERT (that is
> SIGNED by VoIPSec_CA) and the body of the email is also ENCRYPTED
> using the LIST_CERT.
>
> Since the signature will match, the email could only have come from
> that particular sender (and the body could not have been altered).
> And the body of every email can be decrypted by any authentic list
> member.
>
> Does that work well?
>
> Cheers,
>
> / Jim Gast, TDS Telecom

[Mark R Lindsey]

Why would $BIG_CORPORATION allow disclosure of any breach they're not obligated to disclose?

We know the most common way that home burglaries occur is to knock in the front door. And we talk about it openly. And we build better doors.

I'm with Fred Posner.

>>> ***@ecg.co [phone] http://ecg.co/lindsey

On Feb 21, 2014, at 17:20 , Fred Posner <***@palner.com> wrote:

> The more difficult we make it to share information, the less information will get shared.
>
> Personally, I'm in favor of an open forum, as the ideal way to attack fraud would be to bring any discussion into the sunlight -- again, just my seasoned opinion.
>
> The more we discuss, the more they will change tactics. Which we will learn, discuss, and then they will again change tactics.
>
> Fraud, at it's simplest description, is an exploitation of flaws. The more we harden our systems to prevent the exploitation of a flaw, the better we will be; the better VoIP will be.
>
> I feel that the more cloaked these conversations will be, the more our systems and protocols will remain flawed.
>
> I see the potential for fraudsters to see what we know, what we don't know (potentially), and to me... that's fine. When they realize we have found a certain scheme, they will move on to discover a new method.
>
> --
> Fred Posner | The Palner Group, Inc.
> http://qxork.com
>
> On 2/21/14, 5:04 PM, Gast, Jim wrote:
> > (Apologies if you got 2 copies . . . I had not been a subscriber to
> > ***@voipsa.org<mailto:***@voipsa.org> so my reply bounced!)
> >
> > Hi, team -
> >
> > In the early days of Public Key Infrastructure, we had easy ways to
> > solve these trust questions.
> >
> > The list admin creates a public-key / private-key pair called the
> > LIST_CERT. Giving anyone the LIST_CERT gives them both keys in the
> > pair.
> >
> > The list admin creates a public-key / private-key pair called the
> > VoIPSec Certificate Authority key-pair. The public-key becomes
> > publicly available, but the private key is NEVER GIVEN OUT to anyone.
> > The VoIPSec_CA_CERT contains the public-key, but NOT the
> > private-key.
> >
> > To join the list, each participant must prove (once) that the email
> > address they give us is authentic. The new participant creates a
> > personal key pair and gives ONLY the public key to the list
> > administrator as a certificate signing request. The new participant
> > will then be given a CERTificate that signs his personal public key
> > with the VoIPSec_CA key.
> >
> > Legitimate participants to the mailing list are given the LIST_CERT.
> > If someone does not have the LIST_CERT, eavesdroppers will be unable
> > to decrypt emails on the list.
> >
> > All emails to the email list are SIGNED by an personal CERT (that is
> > SIGNED by VoIPSec_CA) and the body of the email is also ENCRYPTED
> > using the LIST_CERT.
> >
> > Since the signature will match, the email could only have come from
> > that particular sender (and the body could not have been altered).
> > And the body of every email can be decrypted by any authentic list
> > member.
> >
> > Does that work well?
> >
> > Cheers,
> >
> > / Jim Gast, TDS Telecom
>
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org

[Hiers, David]

Here's a model of limited membership, private, vetted information sharing:

https://www.infragard.org/

The notion of sharing your problems so you can learn from the problems of others is valid, but I'm not sure how well it works.

There are many non-technical drivers to keep things private; your stock price could take a hit, etc.

David


-----Original Message-----
From: Voipsec [mailto:voipsec-***@voipsa.org] On Behalf Of Mark R Lindsey
Sent: Friday, February 21, 2014 14:26
To: Fred Posner
Cc: ***@voipsa.org
Subject: Re: [VOIPSEC] [VoiceOps] Tackling VoIP fraud, new idea

Why would $BIG_CORPORATION allow disclosure of any breach they're not obligated to disclose?

We know the most common way that home burglaries occur is to knock in the front door. And we talk about it openly. And we build better doors.

I'm with Fred Posner.

>>> ***@ecg.co [phone] http://ecg.co/lindsey

On Feb 21, 2014, at 17:20 , Fred Posner <***@palner.com> wrote:

> The more difficult we make it to share information, the less information will get shared.
>
> Personally, I'm in favor of an open forum, as the ideal way to attack fraud would be to bring any discussion into the sunlight -- again, just my seasoned opinion.
>
> The more we discuss, the more they will change tactics. Which we will learn, discuss, and then they will again change tactics.
>
> Fraud, at it's simplest description, is an exploitation of flaws. The more we harden our systems to prevent the exploitation of a flaw, the better we will be; the better VoIP will be.
>
> I feel that the more cloaked these conversations will be, the more our systems and protocols will remain flawed.
>
> I see the potential for fraudsters to see what we know, what we don't know (potentially), and to me... that's fine. When they realize we have found a certain scheme, they will move on to discover a new method.
>
> --
> Fred Posner | The Palner Group, Inc.
> http://qxork.com
>
> On 2/21/14, 5:04 PM, Gast, Jim wrote:
> > (Apologies if you got 2 copies . . . I had not been a subscriber to
> > ***@voipsa.org<mailto:***@voipsa.org> so my reply bounced!)
> >
> > Hi, team -
> >
> > In the early days of Public Key Infrastructure, we had easy ways to
> > solve these trust questions.
> >
> > The list admin creates a public-key / private-key pair called the
> > LIST_CERT. Giving anyone the LIST_CERT gives them both keys in the
> > pair.
> >
> > The list admin creates a public-key / private-key pair called the
> > VoIPSec Certificate Authority key-pair. The public-key becomes
> > publicly available, but the private key is NEVER GIVEN OUT to anyone.
> > The VoIPSec_CA_CERT contains the public-key, but NOT the
> > private-key.
> >
> > To join the list, each participant must prove (once) that the email
> > address they give us is authentic. The new participant creates a
> > personal key pair and gives ONLY the public key to the list
> > administrator as a certificate signing request. The new participant
> > will then be given a CERTificate that signs his personal public key
> > with the VoIPSec_CA key.
> >
> > Legitimate participants to the mailing list are given the LIST_CERT.
> > If someone does not have the LIST_CERT, eavesdroppers will be unable
> > to decrypt emails on the list.
> >
> > All emails to the email list are SIGNED by an personal CERT (that is
> > SIGNED by VoIPSec_CA) and the body of the email is also ENCRYPTED
> > using the LIST_CERT.
> >
> > Since the signature will match, the email could only have come from
> > that particular sender (and the body could not have been altered).
> > And the body of every email can be decrypted by any authentic list
> > member.
> >
> > Does that work well?
> >
> > Cheers,
> >
> > / Jim Gast, TDS Telecom
>
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org


_______________________________________________
Voipsec mailing list
***@voipsa.org
http://voipsa.org/mailman/listinfo/voipsec_voipsa.org


This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

[Robin Wood]

On 21 February 2014 22:50, Hiers, David <***@adp.com> wrote:
> Here's a model of limited membership, private, vetted information sharing:
>
> https://www.infragard.org/

Any idea how much the vetting process for a new member costs in both
time and money?

Robin


> The notion of sharing your problems so you can learn from the problems of others is valid, but I'm not sure how well it works.
>
> There are many non-technical drivers to keep things private; your stock price could take a hit, etc.
>
> David
>
>
> -----Original Message-----
> From: Voipsec [mailto:voipsec-***@voipsa.org] On Behalf Of Mark R Lindsey
> Sent: Friday, February 21, 2014 14:26
> To: Fred Posner
> Cc: ***@voipsa.org
> Subject: Re: [VOIPSEC] [VoiceOps] Tackling VoIP fraud, new idea
>
> Why would $BIG_CORPORATION allow disclosure of any breach they're not obligated to disclose?
>
> We know the most common way that home burglaries occur is to knock in the front door. And we talk about it openly. And we build better doors.
>
> I'm with Fred Posner.
>
>>>> ***@ecg.co [phone] http://ecg.co/lindsey
>
> On Feb 21, 2014, at 17:20 , Fred Posner <***@palner.com> wrote:
>
>> The more difficult we make it to share information, the less information will get shared.
>>
>> Personally, I'm in favor of an open forum, as the ideal way to attack fraud would be to bring any discussion into the sunlight -- again, just my seasoned opinion.
>>
>> The more we discuss, the more they will change tactics. Which we will learn, discuss, and then they will again change tactics.
>>
>> Fraud, at it's simplest description, is an exploitation of flaws. The more we harden our systems to prevent the exploitation of a flaw, the better we will be; the better VoIP will be.
>>
>> I feel that the more cloaked these conversations will be, the more our systems and protocols will remain flawed.
>>
>> I see the potential for fraudsters to see what we know, what we don't know (potentially), and to me... that's fine. When they realize we have found a certain scheme, they will move on to discover a new method.
>>
>> --
>> Fred Posner | The Palner Group, Inc.
>> http://qxork.com
>>
>> On 2/21/14, 5:04 PM, Gast, Jim wrote:
>> > (Apologies if you got 2 copies . . . I had not been a subscriber to
>> > ***@voipsa.org<mailto:***@voipsa.org> so my reply bounced!)
>> >
>> > Hi, team -
>> >
>> > In the early days of Public Key Infrastructure, we had easy ways to
>> > solve these trust questions.
>> >
>> > The list admin creates a public-key / private-key pair called the
>> > LIST_CERT. Giving anyone the LIST_CERT gives them both keys in the
>> > pair.
>> >
>> > The list admin creates a public-key / private-key pair called the
>> > VoIPSec Certificate Authority key-pair. The public-key becomes
>> > publicly available, but the private key is NEVER GIVEN OUT to anyone.
>> > The VoIPSec_CA_CERT contains the public-key, but NOT the
>> > private-key.
>> >
>> > To join the list, each participant must prove (once) that the email
>> > address they give us is authentic. The new participant creates a
>> > personal key pair and gives ONLY the public key to the list
>> > administrator as a certificate signing request. The new participant
>> > will then be given a CERTificate that signs his personal public key
>> > with the VoIPSec_CA key.
>> >
>> > Legitimate participants to the mailing list are given the LIST_CERT.
>> > If someone does not have the LIST_CERT, eavesdroppers will be unable
>> > to decrypt emails on the list.
>> >
>> > All emails to the email list are SIGNED by an personal CERT (that is
>> > SIGNED by VoIPSec_CA) and the body of the email is also ENCRYPTED
>> > using the LIST_CERT.
>> >
>> > Since the signature will match, the email could only have come from
>> > that particular sender (and the body could not have been altered).
>> > And the body of every email can be decrypted by any authentic list
>> > member.
>> >
>> > Does that work well?
>> >
>> > Cheers,
>> >
>> > / Jim Gast, TDS Telecom
>>
>>
>> _______________________________________________
>> Voipsec mailing list
>> ***@voipsa.org
>> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
>
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
>
>
> This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org

[Robin Wood]

On 21 February 2014 22:20, Fred Posner <***@palner.com> wrote:
> The more difficult we make it to share information, the less information
> will get shared.
>
> Personally, I'm in favor of an open forum, as the ideal way to attack fraud
> would be to bring any discussion into the sunlight -- again, just my
> seasoned opinion.
>
> The more we discuss, the more they will change tactics. Which we will learn,
> discuss, and then they will again change tactics.
>
> Fraud, at it's simplest description, is an exploitation of flaws. The more
> we harden our systems to prevent the exploitation of a flaw, the better we
> will be; the better VoIP will be.
>
> I feel that the more cloaked these conversations will be, the more our
> systems and protocols will remain flawed.
>
> I see the potential for fraudsters to see what we know, what we don't know
> (potentially), and to me... that's fine. When they realize we have found a
> certain scheme, they will move on to discover a new method.
>

I'd fully agree with that, you can't keep them out but if you make it
open then you increase the cost to them as they have to change tactics
or at least IP/phone numbers every time they are caught.

If they know they've been caught but the knowledge of it is only
shared between 6 highly trusted people on a secret list then they
could just carry on as they can still do their damage to everyone
else. If the information is completely public then they have to assume
that now the majority know about it so have to make changes. Each time
they make a change it is a cost to them. As well as doing all the
locking down that you should be doing anyway a good way to get rid of
these people is to make their business model unworkable as it costs to
much to be worth the risk.

Robin

> --
> Fred Posner | The Palner Group, Inc.
> http://qxork.com
>
>
> On 2/21/14, 5:04 PM, Gast, Jim wrote:
>> (Apologies if you got 2 copies . . . I had not been a subscriber to
>> ***@voipsa.org<mailto:***@voipsa.org> so my reply bounced!)
>>
>> Hi, team -
>>
>> In the early days of Public Key Infrastructure, we had easy ways to
>> solve these trust questions.
>>
>> The list admin creates a public-key / private-key pair called the
>> LIST_CERT. Giving anyone the LIST_CERT gives them both keys in the
>> pair.
>>
>> The list admin creates a public-key / private-key pair called the
>> VoIPSec Certificate Authority key-pair. The public-key becomes
>> publicly available, but the private key is NEVER GIVEN OUT to anyone.
>> The VoIPSec_CA_CERT contains the public-key, but NOT the
>> private-key.
>>
>> To join the list, each participant must prove (once) that the email
>> address they give us is authentic. The new participant creates a
>> personal key pair and gives ONLY the public key to the list
>> administrator as a certificate signing request. The new participant
>> will then be given a CERTificate that signs his personal public key
>> with the VoIPSec_CA key.
>>
>> Legitimate participants to the mailing list are given the LIST_CERT.
>> If someone does not have the LIST_CERT, eavesdroppers will be unable
>> to decrypt emails on the list.
>>
>> All emails to the email list are SIGNED by an personal CERT (that is
>> SIGNED by VoIPSec_CA) and the body of the email is also ENCRYPTED
>> using the LIST_CERT.
>>
>> Since the signature will match, the email could only have come from
>> that particular sender (and the body could not have been altered).
>> And the body of every email can be decrypted by any authentic list
>> member.
>>
>> Does that work well?
>>
>> Cheers,
>>
>> / Jim Gast, TDS Telecom
>
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org

[Philippe Langlois]

Hi Fred,

I totally agree with this:
Telecom domain is a perfect example of the lack of script kiddies:
Not much script kiddies -> not much publicized breaches
-> not much security pressure from attacks/compromise
-> not much awareness
-> not much budget
-> security through obscurity (STO) somewhat works
-> disclosure of information is targeted rather than the fundamental
problem ("shoot the messenger" paradigm)
-> interested/experts attackers (gov, intelligence) invest time to make
sure the attacks don't get known
-> when compromise occur, it is massive and ultimate, with often total
destruction or compromise of the targeted system :(
and that's where the system fails...

So indeed, openness is extremely important yet needs to be balanced.
With vendors that are not mature (extremely resistive, patch time
counted in YEARS, ...) and specification bodies that are closed to
independent experts, it does not help.

We're trying to change the game by making the R&D race of new attacks
and detection faster than what some of the attackers (fraud, crackers,
intelligence) can find. I said "some" because as you said, you NEVER
know what they might know ;-/

Best regards,
Philippe Langlois.
--
P1 Security - Priority One Security
http://www.p1sec.com


On 2/21/14 11:20 PM, Fred Posner wrote:
> The more difficult we make it to share information, the less information
> will get shared.
>
> Personally, I'm in favor of an open forum, as the ideal way to attack
> fraud would be to bring any discussion into the sunlight -- again, just
> my seasoned opinion.
>
> The more we discuss, the more they will change tactics. Which we will
> learn, discuss, and then they will again change tactics.
>
> Fraud, at it's simplest description, is an exploitation of flaws. The
> more we harden our systems to prevent the exploitation of a flaw, the
> better we will be; the better VoIP will be.
>
> I feel that the more cloaked these conversations will be, the more our
> systems and protocols will remain flawed.
>
> I see the potential for fraudsters to see what we know, what we don't
> know (potentially), and to me... that's fine. When they realize we have
> found a certain scheme, they will move on to discover a new method.
>

[Sergey Kolesnichenko]

Add IP reputation scoring to your systems and forget about posting to this
list for several years.



2014-02-22 17:15 GMT+02:00 Philippe Langlois <***@p1sec.com>:

> Hi Fred,
>
> I totally agree with this:
> Telecom domain is a perfect example of the lack of script kiddies:
> Not much script kiddies -> not much publicized breaches
> -> not much security pressure from attacks/compromise
> -> not much awareness
> -> not much budget
> -> security through obscurity (STO) somewhat works
> -> disclosure of information is targeted rather than the fundamental
> problem ("shoot the messenger" paradigm)
> -> interested/experts attackers (gov, intelligence) invest time to make
> sure the attacks don't get known
> -> when compromise occur, it is massive and ultimate, with often total
> destruction or compromise of the targeted system :(
> and that's where the system fails...
>
> So indeed, openness is extremely important yet needs to be balanced.
> With vendors that are not mature (extremely resistive, patch time
> counted in YEARS, ...) and specification bodies that are closed to
> independent experts, it does not help.
>
> We're trying to change the game by making the R&D race of new attacks
> and detection faster than what some of the attackers (fraud, crackers,
> intelligence) can find. I said "some" because as you said, you NEVER
> know what they might know ;-/
>
> Best regards,
> Philippe Langlois.
> --
> P1 Security - Priority One Security
> http://www.p1sec.com
>
>
> On 2/21/14 11:20 PM, Fred Posner wrote:
> > The more difficult we make it to share information, the less information
> > will get shared.
> >
> > Personally, I'm in favor of an open forum, as the ideal way to attack
> > fraud would be to bring any discussion into the sunlight -- again, just
> > my seasoned opinion.
> >
> > The more we discuss, the more they will change tactics. Which we will
> > learn, discuss, and then they will again change tactics.
> >
> > Fraud, at it's simplest description, is an exploitation of flaws. The
> > more we harden our systems to prevent the exploitation of a flaw, the
> > better we will be; the better VoIP will be.
> >
> > I feel that the more cloaked these conversations will be, the more our
> > systems and protocols will remain flawed.
> >
> > I see the potential for fraudsters to see what we know, what we don't
> > know (potentially), and to me... that's fine. When they realize we have
> > found a certain scheme, they will move on to discover a new method.
> >
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
>

[Philippe Langlois]

Chasing IPs or MSISDNs or GTs is very limited game, useful yes. The
things that bites you big time in fraud & security is often the new kind
of attacks, or innovative variants of existing ones. That's what I was
speaking about.

On 2/23/14 10:52 PM, Sergey Kolesnichenko wrote:
> Add IP reputation scoring to your systems and forget about posting to
> this list for several years.
>
>
>
> 2014-02-22 17:15 GMT+02:00 Philippe Langlois <***@p1sec.com
> <mailto:***@p1sec.com>>:
>
> Hi Fred,
>
> I totally agree with this:
> Telecom domain is a perfect example of the lack of script kiddies:
> Not much script kiddies -> not much publicized breaches
> -> not much security pressure from attacks/compromise
> -> not much awareness
> -> not much budget
> -> security through obscurity (STO) somewhat works
> -> disclosure of information is targeted rather than the fundamental
> problem ("shoot the messenger" paradigm)
> -> interested/experts attackers (gov, intelligence) invest time to make
> sure the attacks don't get known
> -> when compromise occur, it is massive and ultimate, with often total
> destruction or compromise of the targeted system :(
> and that's where the system fails...
>
> So indeed, openness is extremely important yet needs to be balanced.
> With vendors that are not mature (extremely resistive, patch time
> counted in YEARS, ...) and specification bodies that are closed to
> independent experts, it does not help.
>
> We're trying to change the game by making the R&D race of new attacks
> and detection faster than what some of the attackers (fraud, crackers,
> intelligence) can find. I said "some" because as you said, you NEVER
> know what they might know ;-/
>
> Best regards,
> Philippe Langlois.
> --
> P1 Security - Priority One Security
> http://www.p1sec.com
>
>
> On 2/21/14 11:20 PM, Fred Posner wrote:
> > The more difficult we make it to share information, the less
> information
> > will get shared.
> >
> > Personally, I'm in favor of an open forum, as the ideal way to attack
> > fraud would be to bring any discussion into the sunlight -- again,
> just
> > my seasoned opinion.
> >
> > The more we discuss, the more they will change tactics. Which we will
> > learn, discuss, and then they will again change tactics.
> >
> > Fraud, at it's simplest description, is an exploitation of flaws. The
> > more we harden our systems to prevent the exploitation of a flaw, the
> > better we will be; the better VoIP will be.
> >
> > I feel that the more cloaked these conversations will be, the more our
> > systems and protocols will remain flawed.
> >
> > I see the potential for fraudsters to see what we know, what we don't
> > know (potentially), and to me... that's fine. When they realize we
> have
> > found a certain scheme, they will move on to discover a new method.
> >
>
> _______________________________________________
> Voipsec mailing list
> ***@voipsa.org <mailto:***@voipsa.org>
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
>
>

[Kurt Jaeger]

Hi!

> Why dont't you want to speak about tactics here openly?

There is precedence in other network security-related fields with closed,
vetted mailing lists and positive results. So apparently it helps
to have that kind of mailing list.

--
***@opsec.eu [phone] 6 years to go !