Happy 101st Birthday to Hedy Lamar

The woman who proved that you can really have it all:

- Beauty (she was called the "most beautiful woman in Europe")
- Movie Career with a Star on the Hollywood walk of fame
- Developed an improved traffic stoplight
- Patents for spread spectrum and frequency hopping technology to thwart the Nazis that make our modern communications possible U.S. Patent 2,292,387 (but the US Navy did not use it until the patent had expired).

and she is today's Google Doodle

Astricon 2013 Security Master Class Videos

All of the Official Videos from Astricon 2013 Security Master Class have been posted

http://www.youtube.com/playlist?list=PLighc-2vlRgT3DhE9DkIgSmpUX6v2AtYo

Mine are the first 2.

Astricon 10 October 2013

I will be giving the first 2 sessions in the Asterisk Security Master Class while Nir will be presenting on the last day.

For more information go to http://www.asterisk.org/community/astricon-user-conference

Nice article on effects of Toll Fraud

Thanks to Mark Collier's VoIP Security Blog I point you to this article that  Toll fraud can put SMEs out of business in minutes.

Unfortunately the premise and conclusions are correct. If you think of the example from the 2011 Astricon where a company was hit for $400,000 in fraud over 2 days then it is easy to see how this kind of hit could cost a small business everything in almost no time.

Real time monitory and proper security checks are needed to help prevent this kind of fraud. I will keep posting details on how you can protect your company, or you can contact me directly for more information about real-time monitoring or VoIP Security Audits.

Al Qaeda-linked phone hackers are back

A little over a year ago I was explaining on the VoIP Users Conference weekly call about how Al Qaeda had been hacking AT&T customers for over US$2 million in the session titled  Shssshhhhhh!!!! Al-Qaeda Phreaking!  (a recording of the session is available at:  http://www.voipusersconference.org/?powerpress_embed=3669-podcast.

Now a year later New York Sen. Schumer: Al Qaeda-linked phone hackers costing NY small businesses says that another:

phone hacking ring with ties to Al Qaeda-related groups in the Philippines and Somalia have targeted small businesses in New York, stealing hundreds of thousands of dollars worth of overseas long distance calls.

It is not as large an amount  stolen as last time, but it is scary to think that in-spite of the assassination of their leader Al Qaeda is back to their old tricks of hiring people to hack to fund them.

As Sen. Schumer reports

26 businesses in New York's capital area, which includes Albany, have come forward to say they’ve been victims of a communications scheme. Schumer said hackers were manipulating businesses’ voicemail systems to make thousands of costly long-distance calls overseas, leaving New York businesses on the hook for the substantial bills.

 For example:

One dry cleaning company in the area, he said, was hit with a $150,000 phone bill for nearly 9,000 overseas calls. That business is currently in a legal battle with its telephone provider over the bill .

On his official site he has called on carriers to put in place limits.

A copy of Schumer’s letter to the telecom industry and the Federal Communications Commission appears below:

Dear US Telecom and NTCA,

I am writing today after learning of several instances of a voicemail scam praying on multiple New York small businesses. As I am sure you are aware, this fraud occurs when hackers discover a loophole in the voicemail system and use this to make long-distance calls that can cost thousands of dollars. As this scam can occur over a series of days or even weeks, many of these victims are left with a bill of hundreds of thousands of dollars. During these times, small businesses need all the available help in order for them to continue to prosper and grow.

Both your members and these small businesses have been victims of this crime. These hackers, as they mostly operate from overseas, can be very difficult for law enforcement to catch. Therefore, I am hopeful that we can work together on adequate steps to provide stringent fraud detection services for small business phone lines so that we can eliminate the charges for small businesses and for your members. I believe that the credit card industry could provide inspiration in this effort. They have established robust fraud prevention services to allow businesses and customers to learn almost immediately when a suspicious purchase is made. In addition, they can require authorization prior to a suspicious purchase.

We all have an interest in ending this fraud. Neither your members nor their customers wish to help connect potential criminals or terrorists with their allies overseas. I believe an industry-led effort to detect voicemail fraud and end these unauthorized charges would allow small businesses to continue to innovate without the fear of extremely high charges. I have copied the Federal Communications Commission to ask them to assist your members with their expertise in this matter.

I thank you for your attention to this important matter, and look forward to working with you to assist you in protecting American small businesses from unfair and deceptive practices.

Sincerely,
U.S. Senator Charles E. Schumer

CC: Federal Communications Commission

 Although Senetor Schumer is correct that this is a problem that the carriers need to address, that does not mean that businesses can not, or should not, be proactive with monitoring, blocking, and call restrictions on their phone switch.

As our security audits have shown many PBXs leave open holes that can be exploited.

• Do all phones need long distance or international calling?
• Have unused/unneeded voicemail boxes been left open?
• Do you have time of day/day of week restrictions on your phones (why can calls be made at 2 am on a Saturday if you are only open Monday to Friday 9-5)?
• Do you still have easy to use or default passwords on your voicemail, PBX, or phones?

 Have your phone staff or vendor check to make sure that these basic problems have been addressed or contact me and we can discuss a security audit.

Protect yourself because the phone companies will almost always expect you to pay at least part of the phone fraud done using your phone lines.

Interesting Article on the Challenges and Prevention in a VoIP Environment

 As I have been writing here, VoIP service has become more common and thus more of an attractive target for fraud attacks.

Jim Murphy, President of Phone Power has a nicely written article on TMCNet titled Toll Fraud Challenges and Prevention in a VoIP Environment

He discusses the fact that there are always new targets to attack and that many PBXs use default or easy to crack passwords (1234).

But to me the most worrying thing he mentions is how much this can cost a company:

The risks of toll fraud within a VoIP network are severe. Some hackers are able to hijack systems and push through charges that can total $2,000 an hour or more.

Now we have seen companies hit in a few days with $25,000 - $50,000 in fraud, or even 1 case for $400,000 over 2 days, so this number of $2,000 per hour sounds quite plausible to me.

This is why I moved to Greenfield Technologies and am specializing in doing Security Audits for Asterisk based VoIP PBXs.

After performing auditing on more than 35  PBXs

We have found that the most common Policy issues are:

—

Incomplete, non-existent, unenforced Password policies:

Many had identical default SIP passwords for all phones that were never changed
Many had identical default voice-mail passwords for all extensions that were never changed

Server / PBX Passwords

Multiple PBXs using the same password
Root access and web client interface using the same password (if any)

No update policy

Server OS
PBX software
Phone firmware

No mailbox polices

Who get voice-mail
When to close them

No policy to monitor phone usage / activity

AstriCON '12 presentations

GreenfieldTech Presentations from AstriCON'12 are now available at:

http://www.greenfieldtech.net/corporate/downloads/  

Not exactly fraud - How To Prevent An Illicit Data Dump

I realize that this is not directly related to fraud, but with the news of hacking of sites to get passwords etc from RSA to credit cards, I decided to pass this on:

Dark reading has a good basic article on How To Prevent An Illicit Data Dump that is a summary of a research report that they did.

[Excerpted from "How to Prevent an Illicit Data Dump," a new report posted this week on Dark Reading's Insider Threat Tech Center.] The headline occurs almost every day lately -- a large enterprise or government agency loses a huge cache of data through the actions of an employee. Whether it's a malicious theft and posting, a la WikiLeaks, or an unintentional compromise of sensitive business information, the affected organization is put in a position of serious risk

 Now the report and article offer a lot of advice that can come down to setting proper rules and employee misconduct which can lead to data breaches or Telecom Fraud.

Set your rules, enforce them:

• Set password rules
• Monitor activity
• Educate your employees

Guest blogging on Peer-to-Peer blog: 2011's Biggest Frauds and Phreaks

I have another Guest Blog published on Channel Partners Magazine’s Peer-to-Peer blog

2011's Biggest Frauds and Phreaks 

It reviews the many news stories about Telecom Fraud that occurred during the year.

Shssshhhhhh!!!! Al-Qaeda Phreaking!

Humbug Telecom Lab’s Eric Klein will be making a guest appearance on VoIP Users Conference weekly discussion:

Topic:  As shown by the recent arrest in the case of terrorist who were hacking AT&T business customers to fund Al-Qaeda; Telecom Fraud has come a long way from Captain Crunch and Steve Jobs phreaking Ma Bell for fun and glory. It is now big business aimed at stealing from you via your PBX. Let’s discuss actual cases and some things you can do to make sure your PBX is not funding terror.

Friday at December 2^nd at 12 Noon Eastern Time (9AM Pacific)

To connect see instructions on http://www.voipusersconference.org/how-to-participate/date-and-time/

Term Tuesdays - Telecom Fraud Explained: Known Fraudulent Numbers

Term Tuesdays - Telecom Fraud Explained

Today’s term is actually a type of Telecom Fraud, in this case it is when your PBX makes calls to Known Fraudulent Numbers or Destinations.

Calls to Known Fraudulent Numbers or Destinations

Telecom fraud is a well-known problem, and like the “Nigerian Bank Scam,” there are blacklists of phone numbers, area codes etc. that can be blocked or monitored if the right tools are at hand. To protect yourself you need to use various types of blacklists to prevent inappropriate calls being made. 

Humbug supports several types of Blacklists:

• Community Blacklist - Protect your PBX from over 70,000 industry-confirmed blacklisted numbers
• Number Blacklist - Setup your own list of blacklisted numbers
• Country Blacklist - Receive alerts when traffic to/from specific countries you select are detected

Like PC based antivirus or malware protectors Telecom Fraud prevention needs to be regularly updated as new sources, destinations, and types are tried by the fraudsters.

It is a moving target and thus you need to be vigilant and use a solution that is constantly updated with these new attacks.

Term Tuesdays - PBX Dial-Through

Today's Fraud term is PBX Dial-Through

Dial-through fraud relies on a feature that exists on every PBX. This feature allows employees to call into the switchboard or their voicemail and make outgoing calls after inputting a password or pin. Now this is a very convenient feature and the reasons that it exists are legitimate: 

1. Enable traveling or out of office employees to make work related calls without having to pay for the calls themselves.
2. Enable people to return calls without having to write down or remember the number left in the message.

Although this feature may be turned off upon installation, hackers will try to break in and create their own mailbox, which will allow them to dial in and then make any calls they wish. (Next week we will discuss how they can get into the system  to do this.)

To protect your company you need to ask these questions - 

• Do we need this at all?
• If so does everyone (and all mailboxes) need it? Can you think of a reason why the server room, break room,conference rooms, or Lobby need a mailbox, let alone one with this feature?
• For those who need it, can calling cards or dial back be used instead?

If the answer is that you do need it, then limit it to:

• Selected people, and make sure that they use strong passwords (no 1111, 1234, or their extension). 
• Specific times of day - do they need to make work calls on weekend nights?
• Specific call types - do they need to make local calls, long distance calls, international calls, calls to Cuba?

Use a proactive monitoring tool like Humbug to monitor and prevent abuse.

Also, make sure that people are aware that the return the call feature on their cellular phone can be set to call premium numbers that can cost more than $2 per min.

In the end it is your PBX, and the phone company will expect you to pay for the calls so protect yourself.

Telecom Fraud from Smartphone malware apps

About 2 weeks ago I wrote about a phony NetFlicks app for the Android, today the BBC has an article titled Smartphone scams: Owners warned over malware apps which talks about how these apps are made and how they can be used to commit phone fraud.

Criminals are typically creating Trojan copies of reputable apps and tricking users into installing them.
Once on the phone, the app can secretly generate cash for criminals through premium rate text messages. 

Get Safe Online, a joint initiative between the government, police and industry, said it was concerned that users of smartphones, such as Android devices, were not taking steps to protect their devices.
Get Safe Online said fraudsters are designing apps which generate cash secretly in the background without the owner realising until their monthly bill.A typical scam involves an app designed to send texts to premium rate services without the user knowing. 

As with all telecom fraud the solution is a combination of setting the right controls and proactive monitoring.

To prevent a large, unexpected phone bill you should:

• Confirm that the app you are installing is certified and is from the company that it claims to be from.
• Install a malware protection app just like you have anti-virus on your laptop - and make sure it updates regularly. I wrote about some of these in the Netflix post.  
• Pay attention to performance. If your  battery seem to be running out too fast, if apps (and games)are running slowly, if calls or web sites take longer to connect you could have a malware app running on your system. If you do not have any protection install one and run a full system check.
• Occasionally look at your call and SMS (Text) logs to see if you have items that you did not make.
• Actually review your phone bill, you usually only have a month to challenge mistakes or fraud so this is your last line of defense.

New article about Humbug Telecom in iTWire

New article Keeping PBX fraudsters at bay By Sam Varghese
http://www.itwire.com/business-it-news/security/50928-keeping-pbx-fraudsters-at-bay explains a little about how the Humbug Telecom Labs service works, and gives a little preview of things to come.

Astricon updates

Rather than another Fraud Terms Tuesday today I bring you 2 links from Astricon.

In the first, Tom Keating from TMC Net caught me and Nir running the first part of the Security Round Table. Here is his blog entry about it AstriCon VoIP Security - $400,000 toll fraud - YIKES! and here is the video he took at the start of the session.

Later that day we were interviewed by Chris DiMarco, also from TMC Net. Here is the link to his article  Saying Humbug to Telephony Fraud.

Term Tuesdays - Subscription Fraud

Guest post by Boaz Bechar, VP Business Development at Humbug Labs

Consumer-facing ITSPs are battling to optimize their user-acquisition costs versus lifetime value – and are constantly trying out new techniques for signing up users. Registration form fields are reduced, making it as simple as possible for newcomers to join the service, while leaving the ITSP with many questions on who the user is – which may be a challenge when tackling subscription fraud.

In many cases, a free call or free calling credit is offered before/after account creation, allowing the user to familiarize with the system. The revenue-assurance decision tree from here can only get longer and wider, for example: If providing the user with a free call after signing up, what stops them from creating multiple accounts and making multiple free calls?

The low-hanging fruit would clearly be to place limits on the IP address and phone number the user is dialing from/ to, however this can get problematic if disposable phone numbers are brought into the equation, and even more-so with hackers who have full number- ranges in their war chest. There is no easy way to tackle this problem – but taking steps to greatly limit the financial exposure can be taken, such as limiting the total calls on a per-destination level, routing all free calls through cost-limited trunks, as well as carefully scrutinizing daily cost, duration and call volume user leader-boards, to make sure they are consistent with your rule-set.  Additionally, maintaining blacklists of numbers and registration domains (i.e. blocking sites such as 10minutemail.com from registering) increases the barriers for fake-subscriptions while not effecting valued users.

Paying users, while the bread and butter of the ITSP, can also be a great concern in terms of subscription fraud. While pay-as-you go based programs do have a certain limit on the financial exposure per user, margins can easily diminish due to costs associated with credit card charge-back fees from accounts using stolen credit cards or hacked online payment accounts (paypal, etc).  Scrutinizing paying users becomes even more critical with postpaid accounts, which may bypass initial checks as a seeming legitimate business, but then the account is used for fraud with no intent to pay (NITP).

To minimize exposure to fraud from paying users, it's important that an 'activation process' take place, where payment details are matched against the users registration data. Other vital indicators become relevant on a case-by-case basis, including review of the users credentials, looking for similar registered accounts, similar billing details previously used on the system, etc.

 While ITSPs don't currently have the sophistication level of traditional carrier subscription fraud prevention techniques, they do have the ability to leverage new sets of data unique to their environment, in order to create new activation funnels. One proven technique is matching the password- hash used during registration, against a blacklist of known unwanted passwords as well as against previously flagged accounts. Creating more opportunities for unique data sets and matching against historical information is one method that can easily be deployed in an ITSP environment.

Relying on rule-based results completely can be ineffective and its important to have mechanisms in place which allow anomalies to be spotted. For example, a South-American ITSP serving Brazil may find it an anomaly to receive a transaction from an account with a billing address in Congo. Different techniques work well in different operational scales and requirements, and it's up to the ITSP to find the balance between financial risk and rules required to activate an account prior to manual checks.

You can learn more by reading Boaz’s White Paper - Fraud Management in an ITSP Environment

Term Tuesdays - Telecom Fraud Explained

Each Tuesday I will be attempting to explain a different Telecom Fraud related term or concept. 


Where possible, I will include real world examples. For some cases I may not be allowed to release the specific information about the customer and then will provide the cases in general terms.

Topics will include

• Calls to Known Fraudulent Numbers or Destinations
• Hacking
• Internal Misconduct
• Malware
• Off Hour Call
• PBX Dial-Through
• Phishing
• Proactive Monitoring
• Service & Application Level Fraud
• Subscription Fraud

As this is intended to be educational I will try to include links to original articles or sources where the information originated, where they exist. Many of these will be related to white papers I, or my coworkers publish on the Humbug Telecom Labs site.

Where they are applicable to a specific market segment or product type, I will identify them.

When ever possible I will give tips or suggestions on how to prevent this type of fraud.

Guest blogging at Channel Partners Magazine’s Peer-to-Peer blog

You can read my guest blog Channel Partners Magazine’s Peer-to-Peer blog

Telecom Fraud Is Alive & Kickin’

Why isn't everyone hacked every day? VoIP security is not the same as on PC

Michael Kassner has a good interview on TechRepublic today called Why isn't everyone hacked every day? In this article he interviews Microsoft Principal Researcher, Cormac Herley, along with Dinei Florencio, also a Microsoft Researcher about their paper “Where Do All the Attacks Go?"

Now, both the article and the paper are quite informative, but the conclusions they give are valid for personal and corporate computer networks but do not translate to VoIP Security.

So let me explain why. First the premise of the paper is what we thought we know about security is not correct.

“Internet security has a puzzling fact at its core. If security is only as strong as the weakest link; then all who choose weak passwords, reuse credentials across accounts, fail to heed security warnings or neglect patches and updates, should be hacked — regularly and repeatedly.Clearly this fails to happen.”

VoIP not so safe says Ian Kilpatrick

Ian Kilpatrick has written a nice piece highlighting the problems with how people deal with VoIP Security as they extend services.  In his article VoIP not so safe he says that

Many companies have now adopted VoIP, and many more are considering adopting it. But they don't necessarily realise that, by moving to VoIP, they have also moved into converged (phone/data) systems and a potentially dangerous security environment.

As companies deal with both the advent of VoIP services and employees connecting their mobile devices to the company network service the risks to the company increase exponentially.


I have  a new whitepaper that offers some insights to the Benefits of Telecom Analytics and Fraud Detection for Enterprises that shows some of the risks companies face and ways to deal with them.