[VOIPSEC] Phone fraud doubles

[J. Oquendo]

Fluff, fluff, fluff, fluff, fluff...

"Pindrop Security, a startup focused on combating phone-based fraud for banks and enterprise call centers, has released a new report outlining some of the risks phone fraud poses to financial institution call centers."

http://www.securityweek.com/financial-phone-fraud-attempts-double-1h-2013-report

------------

Outside of a nice little bit of marketing, I think most of
us know, and see that phone fraud is up however, some of
what is quoted just sounds off: "counted over 2.4 million
consumer complaints of phone fraud attempts." First... How
big of a call center would they have to count this many
complaints. Second, we can go back to the "Ghost calls"
thread (Hennigan) from 11/12 and others... Does a phantom
call constitute a complaint. What about the 100,000 ghost
calls sent my one attacker?

I have been meaning to do some more analytics on some of
the junk I have seen, but become overwhelmed. I am highly
convinced that right now, there is 1) About a half dozen
groups highly focused on this (VoIP heavy hitters), and 2)
there is a forum shared by the attackers amongst one another
sort of a "VoIP carders market" (if you will), where an
attacker will post compromised servers to share in what I
perceive is a "fraudulent calling card" center with a way
to give kickbacks to carriers in questionable countries.
I believe the end destination carrier in some cases is
likely related (family wise) to some of the attackers.

E.g.: Palestine has been ramping things up via VoIP attacks.
What I notice is these attackers try to call numbers whose
carrier is owned by another Palestinian elsewhere. And it
is not isolated to Palestine, they happen to be the heavy
hitters via my logs this quarter.

I have seen: Romanian attacker --> route calls to company
in UK which happens to be owned by (drum roll) another
Romanian. Nevertheless, thought I'd ramp up some discourse
on VoIP and the oft overlooked (or is it underlooked) topic
of security.
--
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM

"Where ignorance is our master, there is no possibility of
real peace" - Dalai Lama

42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

[Philip Veale]

Post by J. Oquendo
E.g.: Palestine has been ramping things up via VoIP attacks.
What I notice is these attackers try to call numbers whose
carrier is owned by another Palestinian elsewhere. And it
is not isolated to Palestine, they happen to be the heavy
hitters via my logs this quarter.

We've noticed this lately too. What we're looking at doing now is
maintaining a list of all known IP address blocks / networks
associated with the Palestine Territories / Gaza & blocking them at
the border routers.

(does anyone out there already maintain such a list they wouldn't mind sharing?)

I don't really like the profiling but it's just a matter of mitigating
risk to the business.

We're a fairly small UK company and we've had 3 fraud attempts in the
past 2 weeks, at least 2 of which were directly traceable to
Palestine.


There's always been a small level of background fraud attempts but
it's certainly elevated in the past 6 weeks.

[Sergey Kolesnichenko]

Which lists are you asking about? Faudsters... they are here! Right in this
mail list. They will get the shared list and will use it to be able to
bypass it.

Post by Philip Veale

Post by J. Oquendo
E.g.: Palestine has been ramping things up via VoIP attacks.
What I notice is these attackers try to call numbers whose
carrier is owned by another Palestinian elsewhere. And it
is not isolated to Palestine, they happen to be the heavy
hitters via my logs this quarter.

We've noticed this lately too. What we're looking at doing now is
maintaining a list of all known IP address blocks / networks
associated with the Palestine Territories / Gaza & blocking them at
the border routers.
(does anyone out there already maintain such a list they wouldn't mind sharing?)
I don't really like the profiling but it's just a matter of mitigating
risk to the business.
We're a fairly small UK company and we've had 3 fraud attempts in the
past 2 weeks, at least 2 of which were directly traceable to
Palestine.
There's always been a small level of background fraud attempts but
it's certainly elevated in the past 6 weeks.
_______________________________________________
Voipsec mailing list
http://voipsa.org/mailman/listinfo/voipsec_voipsa.org

[Zubair Rafique]

I am more interested in analyzing cyber criminals (involved in phone fraud)  activities through active approach. Blacklisting IPs or extracting features (like in pindr0p etc) are useful to detect frauds but are passive approaches.  I wonder if someone has any thoughts on it? How to probe phone fraudsters before even they start doing malicious stuff?

M Zubair Rafique



On Thursday, November 21, 2013 4:08 PM, Sergey Kolesnichenko <***@ucallweconn.net> wrote:

Which lists are you asking about? Faudsters... they are here! Right in this
mail list. They will get the shared list and will use it to be able to
bypass it.

Post by Philip Veale

Post by J. Oquendo
E.g.: Palestine has been ramping things up via VoIP attacks.
What I notice is these attackers try to call numbers whose
carrier is owned by another Palestinian elsewhere. And it
is not isolated to Palestine, they happen to be the heavy
hitters via my logs this quarter.

We've noticed this lately too. What we're looking at doing now is
maintaining a list of all known IP address blocks / networks
associated with the Palestine Territories / Gaza & blocking them at
the border routers.
(does anyone out there already maintain such a list they wouldn't mind sharing?)
I don't really like the profiling but it's just a matter of mitigating
risk to the business.
We're a fairly small UK company and we've had 3 fraud attempts in the
past 2 weeks, at least 2 of which were directly traceable to
Palestine.
There's always been a  small level of background fraud attempts but
it's certainly elevated in the past 6 weeks.
_______________________________________________
Voipsec mailing list
http://voipsa.org/mailman/listinfo/voipsec_voipsa.org

[Vijay Balasubramaniyan]

Oquendo,
In response to:
"I think most of
us know, and see that phone fraud is up however, some of
what is quoted just sounds off: "counted over 2.4 million
consumer complaints of phone fraud attempts." First... How
big of a call center would they have to count this many
complaints.

The report is split into 2 sections:
A) What we are seeing at call centers
B) What individual consumers are seeing.

The 2.4 million comments are with respect to B) not A). So this is not with
respect to a call center. At FI call centers we are seeing 1 in 2500 calls
being an attempt to take over an account (ATO). So if you get 1 million
calls a month you are likely to see 400 attempts at ATO. Our last report
was purely consumer focussed and in this report we are showing what we
believe are both sides of the coin. Please let me know if this clarifies
your concerns and appreciate your feedback. Let me know if you have any
follow up questions.

This is also a great way to finally send a mail on this group which I have
been following for all the information it provides.

Thanks,
Vijay A. Balasubramaniyan
CEO and Co-Founder, Pindrop Security
www.pindropsecurity.com

Post by J. Oquendo
Fluff, fluff, fluff, fluff, fluff...
"Pindrop Security, a startup focused on combating phone-based fraud for
banks and enterprise call centers, has released a new report outlining some
of the risks phone fraud poses to financial institution call centers."
http://www.securityweek.com/financial-phone-fraud-attempts-double-1h-2013-report
------------
Outside of a nice little bit of marketing, I think most of
us know, and see that phone fraud is up however, some of
what is quoted just sounds off: "counted over 2.4 million
consumer complaints of phone fraud attempts." First... How
big of a call center would they have to count this many
complaints. Second, we can go back to the "Ghost calls"
thread (Hennigan) from 11/12 and others... Does a phantom
call constitute a complaint. What about the 100,000 ghost
calls sent my one attacker?
I have been meaning to do some more analytics on some of
the junk I have seen, but become overwhelmed. I am highly
convinced that right now, there is 1) About a half dozen
groups highly focused on this (VoIP heavy hitters), and 2)
there is a forum shared by the attackers amongst one another
sort of a "VoIP carders market" (if you will), where an
attacker will post compromised servers to share in what I
perceive is a "fraudulent calling card" center with a way
to give kickbacks to carriers in questionable countries.
I believe the end destination carrier in some cases is
likely related (family wise) to some of the attackers.
E.g.: Palestine has been ramping things up via VoIP attacks.
What I notice is these attackers try to call numbers whose
carrier is owned by another Palestinian elsewhere. And it
is not isolated to Palestine, they happen to be the heavy
hitters via my logs this quarter.
I have seen: Romanian attacker --> route calls to company
in UK which happens to be owned by (drum roll) another
Romanian. Nevertheless, thought I'd ramp up some discourse
on VoIP and the oft overlooked (or is it underlooked) topic
of security.
--
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM
"Where ignorance is our master, there is no possibility of
real peace" - Dalai Lama
42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
_______________________________________________
Voipsec mailing list
http://voipsa.org/mailman/listinfo/voipsec_voipsa.org

[J. Oquendo]

Post by Vijay Balasubramaniyan
A) What we are seeing at call centers
B) What individual consumers are seeing.
The 2.4 million comments are with respect to B) not A). So this is not with
respect to a call center. At FI call centers we are seeing 1 in 2500 calls
being an attempt to take over an account (ATO). So if you get 1 million
calls a month you are likely to see 400 attempts at ATO. Our last report
was purely consumer focussed and in this report we are showing what we
believe are both sides of the coin. Please let me know if this clarifies
your concerns and appreciate your feedback. Let me know if you have any
follow up questions.
This is also a great way to finally send a mail on this group which I have
been following for all the information it provides.

So it is just as I expected. I will give you an example.
We have all seen/read/experience 'ye phantom call' that
Sandro Gauci clarified last week. I have a client with a
couple of trunks, Audiocodes gateway thing-a-ma-bob. She
calls us up telling us she is receiving hundreds of calls
a day.

With this data, how accurate would it be if I averaged her
calls, multiplied the number ghost calls, then reported:
"Man, I am seeing 10,000,000 fraud attempts per month!" The
realities behind those numebrs aren't real. They're scaled
sideways. I do this (scaling sideways) when I want new
equipment all the time.

Me: "Man, the amount of attacks has quadrupled. Take a look
at my Splunk parsing. Call leg in, call leg out that's 2
calls! (when its really 1). We need the latest and gr8est
in Juniperism Equipment otherwise we are doomed!"

Manager: "Wow we are getting attacked aren't we!"

Scans - I don't count as attacks
Enumeration - I don't count that either

I could an actual compromise as an attack. We have had
those on PBXs we provided trunks for. This is because
the clients don't learn no matter what we tell them. "Stop
using 12345 as a password k thanx!"

This is not a post to take away from your data, but the
reality is, from my perspective, if you said 2.5 million,
I'm willing to bet a years worth of lunch, the actual number
is in the tens of thousands *IF* even that much. Even our
upstreams (VZ, Level3, MiniLevel3 (GBLX), Tandem, etc.) have
gotten a little smart on alerting for fraud. (Its after the
fact, but its nice to know they saw it tenteen hours late).

My colleagues and I stopped counting managed PBXs, trunks,
etc because it reached too many to keep track of. We do
however, run all through SBCs with using Transnexus which
is great, but at the same time, we have learned the ropes
and created our own Frankenstein alerting system. ATTACK
wise (meaning compromise) these have dwindled into perhaps
the teens, and even then, Transnexus allows us to further
minimize the $ damage.

Mind you, I could easily say: "Im getting scanned! (attack)"
"I'm being brute forced! (attack)" and throw this number
into the tens of millions easily. This doesn't even include
clients softphones, Snoms, Polys, etc., that receive ghost
calls. "I'm getting spammed, ghost calls." Heck I wouldn't
even know where to place the figure. Tens of millions?

So define ATO. Is this a scan, someone bruteforcing. What
is an ATO. I define an attack as a compromise when it comes
to VoIP. Lord knows there aren't enough days in the year
to count scans, sipvicious, other nonsense. Not to forget
about the honeypots I have lurking.

400 "attempts" is literally peanuts (.25%)

sourcetype Count Last Update
CDR-6 5,716,520 Thu Nov 21 16:06:42 2013

One SBC, one month. If I dug out how many failed brute
force attempts, scans, etc., I could easily say.. Of the
5,716,520 calls that were put through, based on the amount
of scans, brute forcers, etc., I have seen, there were
100,000,000 attacker. 1,000 people tried scanning 1,000
accounts! See the dilemma?

No harm no foul. Reality? OF the 5,716,520 calls, we had
450 ATTEMPTED fraudulent attempts, of which 90 completed,
of which most were blocked after N attempts (Transnexus).
So bottom line? we had 90 fraudulent calls aka 0.001574%
fraud. Even if I multiplied this 44x (to meet your 400
call criteria), I'd be in the 0.069% range for fraud at
a little over a quarter billion calls.

I won't even get into what the call center we have is
saying. This is coming from engineering now. People in my
call center will tell me the Internet is blown up simply
because their browser isn't opened. They aren't trained to
see real data. Anyhow ;) Let me stop picking on the list
before someone steps on me!
--
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM

"Where ignorance is our master, there is no possibility of
real peace" - Dalai Lama

42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF