Subject: [stir] In case you had the slightest doubt of the problem we are trying to solve

From: "Richard Shockey" <[email-masked]>
Date: Fri, 19 Jul 2013 00:36:07 -0400

This is one of the worst. 

http://www.latimes.com/business/la-fi-phone-hacking-20130719,0,5710787.story

Richard Shockey
Shockey Consulting
Chairman of the Board of Directors SIP Forum
PSTN Mobile: +1 703.593.2683
< <mailto:richard(at)shockey.us> mailto:richard(at)shockey.us>
skype-linkedin-facebook: rshockey101
http//www.sipforum.org

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 18 Jul 2013 22:46:33 -0700

Actually, no.  Extortion attacks often use compromised PBXes, so they need not forge caller-identification. Open a PBX to incoming SIP from anywhere and check the logs. You will see lots of "background radiation" originating from a wide range of addresses. Forget blacklisting - we are way past that now. 

On Jul 18, 2013, at 9:36 PM, "Richard Shockey" <[email-masked]> wrote:

> This is one of the worst…
>  
> <mailto:richard(at)shockey.us>
> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir

---

From: Hadriel Kaplan <[email-masked]>
Date: Fri, 19 Jul 2013 10:17:47 -0400

Yeah, the article is inconsistent and self-contradictory.  For example, it says:
"The hospital attack, confirmed by two independent sources familiar with it, was eventually stopped using a computer firewall filter. "

If a computer "firewall" filter could stop it, then it wasn't caused by caller-id spoofing coming through their SIP/whatever trunk.  It was caused by not restricting communications to only be possible from the trunk provider.  Even a simple router/firewall ACL would have stopped it.  They simply didn't secure their deployment the way everyone should and could today already do.

And the article starts with:
"She had picked up the emergency room's phone line, expecting to hear a dispatcher or a doctor. But instead, an unfamiliar male greeted her by name and then threatened to paralyze the hospital's phone service if she didn't pay him hundreds of dollars."

That's got nothing to do with "flooding lines".  That's just a typical PBX hacking case - which is a common problem, and has been going on for decades.  This used to happen now and then on Nortel Meridian and Lucent Merlin/Definity PBXs back in the day, too.  The CFCA lists PBX hacking as the #1 fraud cost worldwide, at over $4 Billion.  That's more than even international revenue share fraud.

The good news is if we get STIR deployed it will at least be easier to track down the culprits, and it may even help prevent some specific forms of PBX hacks (maybe).  But STIR is not a silver bullet to prevent DoS attacks, and won't overcome the issues with people deploying stuff in an insecure manner - like, for example not changing the default PBX password/pin for administration, or not deploying a firewall or SBC correctly.  Only education can help with that.

-hadriel

---

From: Brian Rosen <[email-masked]>
Date: Fri, 19 Jul 2013 10:22:09 -0400

Right.

That means we have to be careful when we say we're aiming to stop robocalling, vishing and swatting.  If the vish or swat is accomplished by compromising a legitimate UA, what we're doing won't help.  It's only when they are impersonating a UA that we may be able to help.

Brian

---

From: Bernard Aboba <[email-masked]>
Date: Fri, 19 Jul 2013 08:03:34 -0700

To get an idea of how prevalent this is, take a look at this:
http://www.darkreading.com/attacks-breaches/voip-abuse-project-blacklists-attackers/227500994

On Thu, Jul 18, 2013 at 10:46 PM, Bernard Aboba <[email-masked]>wrote:

> Actually, no.  Extortion attacks often use compromised PBXes, so they need
> not forge caller-identification. Open a PBX to incoming SIP from anywhere
> and check the logs. You will see lots of "background radiation" originating
> from a wide range of addresses. Forget blacklisting - we are way past that
> now.
>
> This is one of the worst… ****
>
> ** **
>
>
> ****
> PSTN Mobile: +1 703.593.2683 <#>
> <mailto:richard(at)shockey.us <richard(at)shockey.us>>
> http//www.sipforum.org****
>
> ** **
>

---

From: "Kinder, Robert (CCI-Atlanta)" <[email-masked]>
Date: Fri, 19 Jul 2013 11:19:47 -0400

An in depth review of TDoS:
https://krebsonsecurity.com/2013/04/dhs-warns-of-tdos-extortion-attacks-on-public-emergency-networks/

Robert

From: [email-masked] [mailto:[email-masked]] On Behalf Of Bernard Aboba
Sent: Friday, July 19, 2013 11:04 AM
To: Richard Shockey
Cc: <[email-masked]>
Subject: Re: [stir] In case you had the slightest doubt of the problem we are trying to solve

To get an idea of how prevalent this is, take a look at this:
http://www.darkreading.com/attacks-breaches/voip-abuse-project-blacklists-attackers/227500994
On Thu, Jul 18, 2013 at 10:46 PM, Bernard Aboba <[email-masked]<mailto:[email-masked]>> wrote:
Actually, no.  Extortion attacks often use compromised PBXes, so they need not forge caller-identification. Open a PBX to incoming SIP from anywhere and check the logs. You will see lots of "background radiation" originating from a wide range of addresses. Forget blacklisting - we are way past that now.

On Jul 18, 2013, at 9:36 PM, "Richard Shockey" <[email-masked]<mailto:[email-masked]>> wrote:
This is one of the worst...

http//www.sipforum.org<http://www.sipforum.org>

_______________________________________________
stir mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/stir

---

From: Hadriel Kaplan <[email-masked]>
Date: Fri, 19 Jul 2013 13:39:36 -0400

> The good news is if we get STIR deployed it will at least be easier to track down the culprits, and it may even help prevent some specific forms of PBX hacks (maybe).  But STIR is not a silver bull…

BTW, when I said "it may even help prevent some specific forms of PBX hacks (maybe)", I didn't mean STIR alone would do it.  I just meant since some forms of PBX hacks are performed by calling the PBX and pressing specific digits for a PIN, then if we had STIR, we'd at least be able to track back what the hacker's calling number was when that was done.  I.e., the PBX itself might keep the logs, but even if it doesn't the service provider will have call detail records.  So if you know the PBX got hacked in the past few hours or day, you can look at who called the PBX in that time and narrow it down.

(this is of course assuming everyone uses STIR, and the PBX doesn't allow administration for anonymous calls, etc.)

-hadriel