Slashdot Mirror
Spit Will Be Worse Than Spam
KentuckyFC writes "A team of German computer scientists has developed a program that reproduces all the known forms of spit (spam over internet telephony) attack. Their plan is to make the spitting software available to computer security experts wanting to test antispit strategies. Developing these won't be easy. There are various antispit techniques, such as white lists that allow only calls from predetermined callers, Turing tests such as audio CAPTCHAs that make a caller prove he or she is human and payment-at-risk services where the caller makes a small payment in advance and is refunded immediately if the receiver acknowledges the call as legitimate. But all have weaknesses, say the researchers. The main difference between junk calls and junk email is that the email arrives at your mail server before you access it. This gives the server time to analyze its content and filter out the junk before it gets to you. Not so with internet telephony, which is why radically different strategies are needed."
Can this get to my regular phone or cell phone?
If yes, then this is a problem.
If no, then this is not that big of a problem.
If yes, but only if the spammers (spitters?) pay for cell minutes or something, then this is not a problem at all.
Spit contains more germs and viruses. Spam contains... well.. info about organ enlargement and secret inherited fortunes. I prefer spam, at least there's something called spam filter. Is there a spit filter available?
India's New Cheap Fuel-less Bike
Seems about the only way to avoid junk calls. I never answer if I don't recognize the number, and certainly not if it's private. Pisses the bank off if I forget about a payment or something, but they'll usually send postcards too. If it's a legit call and they can't be bothered to leave a message, then I can't be bothered to call them back.
Of course, once the spam bots start leaving ads in my voicemail, then I'm getting violent.
Squirt to spit...
The Kruger Dunning explains most post on
The name leaves a bad taste in my mouth.
(Sorry.)
Developers: We can use your help.
Spam? Spit? What's next? Spam in Everday Reading Material?
"I'm getting sick of the SPERM in the morning paper."
Those who believe the Internet is private,
find their privates are on the Internet.
The main difference between junk calls and junk email is that the email arrives at your mail server before you access it.
Not really. With things like Google's phone service (Grand Central or something?) I get a notice of who's calling me an asking me if I want to respond. Couldn't that be tailored to do the same thing?
Bark less. Wag more.
Arrange the usage of internet telephony over e-mail, SMS, or IM before initiating or accepting a call.
The intrusive nature of the required synchronicity of telephony is unacceptable anyway. It always has been. Hence the invention of call-screening devices, caller-ID, answering machines/voice mail, etc...
If you weren't expecting the call, don't answer it. Then you won't have to give anybody money for yet another "security" product.
I never was bothered by SPAM ... I don't think SPIT will bother me either ....
However the solution is simple, and it's not in technology that we will find the answer, it is USER education : don't buy from SPAM/SPIT, then the senders will go backrupt or at least they won't be making profit and since they are money motivated, they will go look for another martket.
Play a Special Information Tone before the phone starts to ring. Most autodialers won't waste their time and hang up. Humans will realize it's a fake tone and stay on the line. I don't know if it works with VoIP though.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Comment removed based on user account deletion
How is this different from phone advertisements over POTS?
Do current measures against telemarketing not apply when the medium is voip? Will there be more voip ads than pots ads?
The rapid increase of telemarketing on land lines generically has spawned a whole host of solutions to this "problem", from the only marginally effective legislative angle (the US Gov'ts "Do Not Call" registry) to the completely effective technical ones like Caller ID Whitelisting services offered by the telephone companies.
Ultimately, since most of the VoIP services that have any leverage just extend the PSTN to a network connected voice terminal, the solutions remain the same. Don't accept uninvited sessions from unknown hosts at the terminal. Don't ring the phone for an unknown caller ID. Direct the caller to an IVR asking them for their name, and then give the caller the opportunity to accept or reject the call.
Lastly, perhaps the most effective "anti-spam" measure for voice spam of any kind (be it conventional telemarketers or some new-fangled network-enabled approach) is the simple auto attendant. Even though I don't have numbers in the do-not-call registry (and I see suspect calls hit my Asterisk system all the time) I _NEVER_ get any spam calls. My autoattendant has a voicemail default route and no route for 0 or 1.. this leave s about 99.999% of all junk calls dead in the water.
How about a default or definable subject line? For persons, it could be something like the sig lines and for companies, it could be a one sentence sales-speak.
It's called headhunters.
Will deal with it in much the same way; known bad callers go directly to the honeypot, known good callers go through. Unknown callers will need some kind of probabilistic assessment as to how much IVR and call screening you put them through.
We had a dialer call through our company last year. It was pretty interesting. All of the phones in our company are on the same trunk. You could tell the dialer was just calling every possible number on the trunk in sequence because a wave of rings went through the office (it's normally pretty quiet). Everyone discovered they had a voicemail from "the job hotline" a little while later. The Attorney General eventually caught the guy and shut him down.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Use FreeSWITCH then you can filter people out.
http://www.freeswitch.org
Whitelisted callers: Ring Ring . . . Answer Phone.
Unknown callers: Ring Ring . . . "If you're a human, please call my cell phone or send me an email containing your name and VOIP ID, and I'll add you to my whitelist, otherwise, have a nice day". Click.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
So what happened to the do not call list? It has worked wonders the last few years eliminating virtually all telemarketers from calling any of my phones.
Makes sense to me
This gives the server time to analyze its content and filter out the junk before it gets to you. Not so with internet telephony which is why radically different strategies are needed
Or, you can just treat your phone as a verbal "inbox", and never actually answer it in person. Back before the Do Not Call registry, I know quite a few people who took that approach (myself included, to some degree).
Telemarketers will almost never actually leave a message, and the few who do, you can instantly detect and delete it.
If enough folks were to use this system and then follow through with filing complaints then perhaps it could be useful in this fight. Several 2007 FTC related Acts set up this site (https://www.donotcall.gov/default.aspx) so you can register phone numbers telemarketers are to refrain from calling (with a few exceptions.) After 31 days you can file a complaint (http://www.ftc.gov/bcp/conline/pubs/alerts/dncverifyalrt.shtm)
Granted I'm remaining cautiously optimistic about it at best however it's worth giving it a shot I think. At least at this point it's the only recourse I have for all the craptastic marketing calls I get. Not answering unknown caller IDs just results in them leaving a voicemail so I'd rather pickup and hang up on them straight away.
That's just my POV... no more, no less.
the phone in my bedroom has the ringer turned off.. so call at 4am if ya want and leave me a message.
-db
I don't understand why telephone and email providers dont adopt the instant messenger system of buddy lists.
Its effectively a white-list solution, but everyone understands it and it already works on MSN/Yahoo/Facebook. Extending it to email and VOIP would be very easy.
Kyle
Like cryptography, authentication must also be a part of the protocols used in future voice communication. Fortunately, the same tech happens to help with both.
Once you have a solid identity for the caller, they can be looked up somehow, and either be classed as someone you know (i.e. have personally vetted as human) or delegated through a WoT as probably human, or determined to be "nobody."
The reason this is a problem for current VoIP and POTS is merely that those things happen to suck due to legacy interoperability, CALEA, etc.
I really do think those concerns will eventually be left behind. Just like PGP over email, though, there will be social resistance (or inertia, at least). But the very problem being discussed here (phone spam being more annoying than email spam) will make securing voice more attractive to the mainstream, than securing email was.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
inventing cutesy acronyms (like "spit") vastly increases awareness in the media and in funding
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I don't really see this as a problem, at least at home. The list of people I actually don't mind calling me at home is very short. For the rest, let them jump through turing hoops to prove they're human. If it's important, they won't mind, if it isn't important, I didn't want to talk to them anyways.
They setup a scenario where every call gives the callee a small payment, then find this weakness in it:
"Let us even assume, that Payment at Risk is used for every call. Even In that case an attacker could circumvent it, by impersonating as another user, so that he can establish calls and shift the costs on to ânormalâ customers."
Umm, if they could do that, wouldn't it be more profitable just to impersonate others and call yourself, collecting all their money?
First the obvious: Have a white list tied with caller ID.
...Enter 1234 backwards
...Enter the sum of 1000 plus 1
...Enter the number one thousand followed by the number you dialed
...Enter the area code for the number you just dialed
...Enter the year as for digits
...Enter the age of the person you called
...Enter the number of pets owned by the person you called
...Enter the number of presidents running for office
...Enter the number of presidents in office.
Next: Be able to exclude out of "area" calls (I get to define what the "area" is)
Next: For non-white listed numbers, have the disconnect signal sent (The there tone noise followed by "The number you have reached..."), followed by a question that requires a human to answer in a timely mannor:
Examples:
By having a few questions - asked at random, that are always changing, the cat and mouse game can go on for years. And, adding some random 'noise' between the words (both low and high frequency, our side of normal human hearing) one could 'trick' the computers performing the dialing in to 'false' answers to the questions.
You're lucky that you've never encountered a voice spam that waits for the initial greeting, and then plays back a pre-recorded message. Sometimes if you answer the phone without saying anything, it will just be silent, but most people answer the phone with "hello."
I once had a signature.
Well, I was just calling to tell you the shed in your backyard is on fire, but if that is going to be your attitude, you can burn in hell. And that will happen pretty soon, too.
As someone that runs a VOIP server, I can speak from limited experience.
1. Unlike email, The offender needs a block of voip numbers to do any meaningful spitting. Those blocks aren't as costless as sending spam. Let's argue for a minute they don't need blocks. The VOIP server should not be allowed to process more than ~2 calls out per number. That's a configuration issue. On proprietary voip server software, I don't know if that's possible, but on openser it is.
2. This _should_ be the responsibility of the VOIP host, except we know that most current providers won't do it for free. It can, and should be automated. ex. *69 reports the call as spam. Even if the call is coming from a peering host, the source can be halted swiftly.
3. DB queries on call volume should identify the offender within 30 minutes anyway.
The article is an advertisement disguised as news.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Want to view a web page? Count the super-distorted kitties in this sequence of letters, numbers & symbols on the Stargate chevrons.
Want to leave a comment? Decrypt this email address that's worse than slashdot's email address obfuscation system, where you spend more time decrypting it than sending in a message.
Want to create an account? Play this java applet where you have to click on the moving bunny.
Ah, what a utopia. A whole internet that doesn't know if you are a dog, but will quiz you to make sure you are not a robot construct, or some farmer in India.
In some countries, that is: Caller pays.
If you think that speaking to me is worthwhile, you pay for the air time.
Have gnu, will travel.
Don't thank God, thank a doctor!
I had a whitelist for my mobile phone starting four years ago...and loved it, but lost it when I "upgraded" my phone a couple of years ago.
The capability was actually built-in to the specific Motorola mobile handset that I was using. The phone had an option to send callers directly to voice mail if they were not in my address book. It would also capture the incoming phone number in my call list. Friends and family got right through. Those whose numbers I did not have left a message...which I then added to the address book just by going to the call list and hitting "save."
The downsides:
- Calls from offices often come in with a semi-random PBX number...so even if I had my wife's or friends' office numbers in my address book, their incoming call would normally get kicked to voice mail. It actually trained them. They stopped calling from those lines and started calling me from their mobile phones.
- I had to remember to turn this feature off if I was expecting a service or delivery person to call me before they dropped by my house...because I didn't have a home phone either.
Small price to pay. That said, the "do not call" list has made my life somewhat easier...but I do miss the whitelist capability at times...and it looks like I might need it again some day according to TFA.
Scuba
Something to look forward to!
It's already illegal in most jurisdictions (in the US) to telemarket with pre-recorded messages. This has teeth with a regular phone call because the phone company is pretty careful about being able to bill people that use its network, and if you can bill them, you can track them down.
And... regular (illegal) pre-recorded telephone spam still costs money to send on a per-unit basis, so the incentive is way overbalanced by the risk.
Firefox 3 needs GTK 2.10+. Too bad for those of use with Enterprise distros such as SLED10 which has GTK 2.8 https://bugzilla.mozilla.org/show_bug.cgi?id=418885
Simple to solve, get a voip account with an IVR, my company will provide a number, extension and ivr department for less than £5, then simply have the message read, to continue to speak with someone please press x
I run the SIP gateway for a Major university. We run the SIP gateway in such a way for other universities to bypass toll charges when we call each other. It works great -- other universities can call my email address and my desk phone will ring. The problem is that spammer (SPITters?) are now searching for the SIP TXT DNS records and spamming those domains. They setup a VoIP connection to my SIP gateway and try, one-by-one to dial each number in my PBX. 0@uni.edu, 1@uni.edu, 2@uni.edu, until they start getting people. What we have seen is they play a short message (usually about 30 seconds or so) about some "male enhancement" drug or something. They fill up our trunks really quickly. The problem is, unlike real phone calls and paper marketing, there is no cost-for-entry for this type of marketing. People can have a single computer hooked up to the internet make 1,000 of calls an hour. This would normally cost you major money to run this type of call center.
Ah, an audio CAPTCHA! Oh, how this will advance voice recognition technology!
When that call comes in at 3:00AM, who do you want to be there to answer it?
No one, it is just spit. 10th time this month, dam Chinese time zones.
I've thought in the past that the ideal setup would be where calls (IM and phone) were only initiated when both sides have confirmed they are interested:
To start a call you identify the person you want to speak to. A notification is sent to that person's device(s) which then indicate a call is "waiting". It can buzz once, chirrup, whatever and then that status sits on your device until the caller cancels it or you indicate yes/no. If you select to accept the conversation, the original callers phone will "ring" and they can pick up to speak to you.
Instant end to ever being interrupted by needless phone calls, together with the flexibility to take calls in a convenient place. Also conveniently avoids phone tag. Note that if the original caller becomes busy (e.g. on another call) the request would be put "on hold", but in that direction only (i.e. if someone phones you they have no way to know whether you're ignoring them or actually busy).
Python coder | PyQt Applications | Writer
That call about me 'winning a free cruise' yesterday morning. Of course, I have pay-as-you go service on my cell, so that cost me 25 cents.
While I applaud these German scientists for their efforts in reducing spit, I don't see where spit is a huge problem. This just sounds like another scheme to sell people on something that inevitably will not work.
I don't know about you, but just cost alone shows how spitting is not the best way to advertise. Why spend a huge amount on servers/telemarketing personnel just to get some small number of actual sales? Instead you can spend your budget on a large data pipe, an email list, and one large server to send out shloads of spam to the gullible idiots who let their email out to the lists in the first place.
The Do Not Call lists work pretty well, and additionally the hate that many telemarketers receive just goes to show that it's a dying breed. People yell and swear at the humans making the sales calls, and soon those humans quit because of stress, then they get replaced by VOIP servers and then people swear at the phone company and the servers get shut down since VOIP is pretty easy to trace right now. I can only see spitting being a problem from foreign countries, but even then it's easy to trace in comparison to today's botnets. So how can spitting ever be worse than spamming? Are people hacking the phone companies to hide their call origins?
Excellent point. Both windows mobile and UIQ has that particular feature. I also remember having this in nokia 7110 (not a smartphone by any standard)
Free Energy
Free Downloads
Free Software
And now this type of "free"... from an earlier post-
"The problem is, unlike real phone calls and paper marketing, there is no cost-for-entry for this type of marketing. People can have a single computer hooked up to the internet make 1,000 of calls an hour. This would normally cost you major money to run this type of call center."
So its not that its 100% for free but its close (Spit Marketing) since broadband is a flat fee for unfettered access creating the economics of annoyance (enabling spitters and spammers) so ultimately Broadband will have to revert to pay for overuse, thats the only way to stop spam, spit or all of the other shit, MAKE THEM PAY
Watch spit and spam die as it begins costing these fuck faces plenty to wreak their havoc because they have no other useful skills, thats too fucking bad for them, get a life.
Now appply "Free" elsewhere and let your imagination run wild
Imagine histories Nightmares, Stalin, Hitler, Binladin with access to Free Energy
And then theres Free Downloading of intellectual property, great...until the producers decide to stop making the content and in a Randian fashion, no one has the desire to create since you cant eat for FREE
Free Software, a Slashdot favorite, where do you think that will lead...
hmmm if your reading this you code for a living and guess what, you will soon be replaced by the UTOPIONOMICS OF FREE
Keep it up, I will always work since my skills encompass far more than just pushing buttons and will watch as you go the way of the US Steel industry
I know right now I use a service called Safercalls.com that blows my mind because of the control it gives me of what calls I get.
As far as I know, SPIT is theoretical only. At my old job I worked with VoIP product development, and worked on a VoIP quality analysis tool with a Maryland based company called Qovia. Their brass was having some drinks and discussing the need for some sort of press release. Their marketing director came up with the idea of SPIT. They had a good laugh, and then decided it could be interesting. They drew up a proposed solution, for a problem that did not exist, applied for a patent, and, voila, instant press release material! So who has ever received a SPIT call?
Call the fire dept, jackass. I don't need to know about it, they do.
Just sign up on a do-not-call list and you won't get SPIT either. Unless you're not living in the United States. I don't know if other countries have do-not-call lists.
Simply do what I do.
Tell ANYONE, that you expect to call you, to dial, wait for 2 rings, hang up, then call back.
I do not answer any call unless they call back in a short time.
The number of rings can be used to "prioritize", or screen people, that you actually expect to call you, i.e., two rings for the Boss, three rings for family, etc.,etc.. Another benefit is that allows me more time to actually get to my phone. If the rings do not fit the profile, I do not even have to go and pick up the phone to see the caller ID info. I just keep doing what I was doing.
Applying for a job but fear that your prospective employer may find the process restrictive and not call you back? Do not worry. Almost every single person I have told about this, and explained the reasoning behind it, has praised me...."Gee! Why didn't I think of that? Good idea!". You've already set yourself apart from the other people applying for the job.
Now, I have not used VoiP, so I do not know if the rings are the same as on a phone, but I am sure the same system could be adapted.
I am intrigued by the TOEJAM Project, a java-based interactive voice response answering machine. This particular project doesn't look like it's had a lot of activity lately, but it's open source and I suspect the code could be modified to make callers jump through a few (highly configurable) hoops before your phone ever actually rings.
If libertarians are so opposed to effective government, why don't they all move to Somalia?
If a spammer ever creates a bot that's smart enough to hear the message, call me on my cell phone and convince me it's human, I'll be happy to talk to it.
So wait -- you're my neighbor, and you have my phone number, but you've never called it till my shed is on fire?
Well, that's only because my kid set the fire.
You are in a maze of twisty little passages, all alike.
From RFC 3261 (Session Initiation Protocol): 20.4 Alert-Info
When present in an INVITE request, the Alert-Info header field
specifies an alternative ring tone to the UAS. When present in a 180
(Ringing) response, the Alert-Info header field specifies an
alternative ringback tone to the UAC. A typical usage is for a proxy
to insert this header field to provide a distinctive ring feature.
The Alert-Info header field can introduce security risks. These
risks and the ways to handle them are discussed in Section 20.9,
which discusses the Call-Info header field since the risks are
identical.
In addition, a user SHOULD be able to disable this feature
selectively.
This helps prevent disruptions that could result from the use of
this header field by untrusted elements.
Example:
Alert-Info: <http://www.example.com/sounds/moo.wav>
I wish I had the iPhone's "Visual Voicemail", since then I could selectively listen to the important message and delete all the, "Hi. its me. call me back" messages that are redundant with the missed call log.
That is the killer app on the iPhone. It's the single reason I bought the thing. It has lived up to my expectations, too.
Seth
$5 / month hosted VPS on linux = awesome!
That sounds great as long as the VoIP box is being used by a tech savvy person like you. And as long as the emergency call originates from your family member's home and not an unfamiliar cell phone, pay phone, hospital phone, jail phone, friend's phone....
Swallow
Yeah, and let's make bets while we're at it. Who'll get to the house first, the fire or the firemen?
Maybe it's not common, but it's not impossible. When I was little my parents kept phone numbers of neighbors they knew but never called, just in case.
Until the U.S. government starts taking spam and spit seriously - and they should, since the millions of dollars generated can be used to fund terrorist activities - the spam will continue to flow.
There's a difference, I think, between "never call" and "have never called once, ever."
Don't thank God, thank a doctor!
Since this is a real-time negotiation taking place, it will be much easier to include a challenge/response in the "handshake" portion of the connection.
Unlike, email (which gets queued), voice requires an instant connection between endpoints. If you simply used an audio captcha ("Hi, please say my first name after the beep to be connected..."), you can create a hurdle that has to be overcome immediately. Using VOX/IVR technology would easily create an AI nightmare for potential "SPITers". Add a short timeout (like 10 seconds or [with a few retries]) and then dump the dubious caller.
Corporations do it to us all the time when we call customer service "I'm sorry, that's not a valid option. Goodbye".
Don't think that a small group of dedicated individuals can't change the world. It's the only thing that ever has.
European carrier charge you roaming fees whenever you're on a some other countries' provider. Both for outgoing *AND* incoming calls. Currently most of the providers have organised a flat standard rate for roaming across whole Europe.
The problem is that Europe isn't very large, and there are rather small countries in there (...Switzerland...) so you can end up often on foreign service providers. In that case, telemarketer cost YOU money. I tend to be not very polite in such cases, specially when they persist.
BTW the way the initial discussion was about VoIP with data over UMTS and voice calls over UMTS are basically the same thing. My point was while technically it's true they are exactly the same kind of things including small details (because voice calls in UMTS are indeed processed as VoIP).
The billing is completely different where the end point with which your phone is communicating is the providers entry to the phone grid (call is charged as "phone call", based on duration, and cost if its an outgoing call or roaming call, but not for a incoming call) or if the end point is some other VoIP correspondent (call is charged as "data exchange", based on data volume, whichever is the direction of call).
Both are technically the same, but are charged differently.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Don't try this! - your voicemail could use 3 for immediate delete.
3 is delete on all UK landlines, using the 1571 voicemail anyway, and the voicemail on most, maybe all, UK mobile carriers.
"Those who cast the votes decide nothing; those who count the votes decide everything." (attrib. Joseph Stalin)
I live in Austria, Vienna and I can filter my paper spam. Its not 100% and you have to know how it works but it goes like:
1) put "no adverisment" sticker to my door2) talk with post service that no sendings without my name are allowed
3) sign to the "robinson list"
It takes some time and an once effort but is very effectiv. Until now I didnt need to enforce these things but I am pretty sure I could. Now I receive one unwanted advertisment once a week (mostly at my door) and thats nothing in comparsion to people who didnt take these steps.