Spit Will Be Worse Than Spam

KentuckyFC writes "A team of German computer scientists has developed a program that reproduces all the known forms of spit (spam over internet telephony) attack. Their plan is to make the spitting software available to computer security experts wanting to test antispit strategies. Developing these won't be easy. There are various antispit techniques, such as white lists that allow only calls from predetermined callers, Turing tests such as audio CAPTCHAs that make a caller prove he or she is human and payment-at-risk services where the caller makes a small payment in advance and is refunded immediately if the receiver acknowledges the call as legitimate. But all have weaknesses, say the researchers. The main difference between junk calls and junk email is that the email arrives at your mail server before you access it. This gives the server time to analyze its content and filter out the junk before it gets to you. Not so with internet telephony, which is why radically different strategies are needed."

Comments

#1 question

[khasim]

Can this get to my regular phone or cell phone?

If yes, then this is a problem.

If no, then this is not that big of a problem.

If yes, but only if the spammers (spitters?) pay for cell minutes or something, then this is not a problem at all.

Re:#1 question

[Hatta]

That's called telemarketing. This isn't.

What's the difference?

This has the potential to be as bad as (or worse) than spam. Think about it - if you were telemarketing, you'd have to hire a bunch of people to work in a call center. This costs money (rent, phone lines, people).

So the difference is how many people you need to do it? Then it's just a matter of degree, and not a fundamental difference. VOIP spam is only worse than telemarketing because there's more of it.

It's like why the spam problem is worse than junk mail - sender has to invest in sending junk mail, while spam costs just bandwidth and botnet fees. It probably won't reach normal landlines since things like SkypeOut etc. cost money.

Funny thing is, I get a lot more paper spam than email spam. From where I stand, paper spam is a worse problem. It certainly kills a lot more trees. And I can't set up a filter for my paper spam.

Re:#1 question

[Anonymous Coward]

I can't say I ever saw a commercial for Skype or even heard of MagicJack. As far as Vonage is concerned, I have actually seen their commercial.

The problem with Vonage is that I've also seen their 1/2 infomercial. Trying to sell your product using infomercials completely destroys your credibility in my eyes. I will never trust a product I've seen in an infomercial**. I am sure I am not alone.

And, no, thankfully I was smart enough that I did not have to learn that the hard way.

    **Except for (maybe) the Little Giant Ladder. I've had hands-on and they are actually pretty well built.

Re:#1 question

[brianosaurus]

I've "solved" my junkmail problem by putting a recycling bin by my front door. I let the mail collect by the door for a week, then on trash day I go through the pile, separating the bills and throwing everything else in the recycler without even bothering to open them. Its absurd.

My email still gets spam, but spamassassin and Apple's junkmail filter do a pretty good job of hiding most of it. Hitting "delete" a few times a day is annoying, but tolerable, especially since I don't constantly check email, so I can batch delete the spams that slip through. I don't check for false positives anymore, since about 97% of my email is spam (I get over 1000 spams a day.. its ridiculous), so false positives are rare and too hard to find.

As for the phone, I don't answer my home phone anymore. The last time I did, it was "Jill with a recorded message from ". F That. I keep the phoneline for my alarm system, and to receive faxes. In fact, the fax machine is what answers calls, which has done more to eliminate telemarketing calls than any of the "pay extra to not be annoyed" extortion services offered by Qwest.

If I start getting spam calls on my cell phone, my cellular provider will either fix it or lose my business.

I already filter calls based on the caller ID. If I don't recognize the caller (or I'm not expecting an unknown caller... like when I'm expecting a call from a delivery driver), I don't answer. If its important, they'll probably leave a message and I'll check it later. I don't think I've had more than one or two spam calls on my cell phone for as long as I can remember.

I check my voicemail maybe once a week, but only when I suspect there's an important message. I wish I had the iPhone's "Visual Voicemail", since then I could selectively listen to the important message and delete all the, "Hi. its me. call me back" messages that are redundant with the missed call log. I wish providers would enable that feature for other phones (and I really hope Apple doesn't have some retarded patent on the "technology").

If VoIP spit starts clogging my voicemail, I'll just stop checking it, period. In fact I'll ask my provider to remove voicemail from my account, and if they cannot do it, I'll switch to a carrier that can. I already consider voicemail an inconvenient, inefficient means of communication, so I really wouldn't miss it.

I'm still dumbfounded that spam (and junkmail, and etc) are viable businesses.

Re:#1 question

[Sandbags]

I doubt you'll every see that level of activity. Remember, VoIP calls to a person have to be placed through a central service, and that service does NOT provide free toll charges to businesses the way it does to people.

Folks on Skype, and other non-centralized VoIP (direct IP to IP calling) may be suceptable to this, but since SSkype can't support e-911, it;s not really an issue... IP to Vonage calls, for example, in part run across telco networks, and those incur charges. The SPITers won;t be able to make good on their investment.

Besides, the Teloc netowkrs and VOIP networks would not be able to handle that volume. e-mail gets bogged down due to Spam, but calls either work or not. If this becomes an issue, the FCC will be on it lightning fast and with great ferocity. Each call is a trunk line, not a few packets...

A PC can't really just CALL a Voip line... The softphone, even for the very small percentage of people who use them as opposed to most people on VOIP havoing a hardware device, is a proprietary program, and on the back end is interfacing with an authentication system. Some random virus is not going to be able to interface with Vonage to make calls that way...

Like I said, Skype might be a hackable system, but business voip is all inter-office (VPN tunnels) not open internet calls. Businesses using VOIP use PRI or BRI trunks and traditionsal call networks to place person to person calls (except intra/inter office over secure systems). SPITing on a business extention means placing a call through a terrestrial phone company. Those can be traced, and blocked, if abused.

If SPITing was potentially that successful, I'd be getting 100 calls a day at my home line already.

Also, a Drone infrected PC that was SPITing, how many calls a day do you think it would be making? and how many calls a day (or at a TIME!) is it reasonable for a human to make? It should be easy for phone companies to identify drone VOIP machines and shut them down... Calling habbits for a household are easy to model, and since even a telemarketer working from home has to have a business class phone license, they'll be easy to identify and eliminate false positive screenings. (most home telemarketers run through VPN to a central switch anyway).

This really isn't a big deal. If they ever figure out HOW to make it a big deal, expect strict and sweeping legislation. Attacks on the US phone system are considdered terrorist activity, unlike spam which is just a civil, not even criminal, in most cases offence. Also, VoIP is easy to trace, since it;s clearly a 2 way communication requirement, unlike spam.

DDoS is a possible abuse, but even that should not effect centralized VoIP providers and their customers (100 calls in 3 minutes? block it. Done.)

Obvious, simple, solution. (Quick! Patent it!)

[ivan256]

Arrange the usage of internet telephony over e-mail, SMS, or IM before initiating or accepting a call.

The intrusive nature of the required synchronicity of telephony is unacceptable anyway. It always has been. Hence the invention of call-screening devices, caller-ID, answering machines/voice mail, etc...

If you weren't expecting the call, don't answer it. Then you won't have to give anybody money for yet another "security" product.

Old Turing Test

[Thelasko]

Play a Special Information Tone before the phone starts to ring. Most autodialers won't waste their time and hang up. Humans will realize it's a fake tone and stay on the line. I don't know if it works with VoIP though.

Anecdote

[Thelasko]

We had a dialer call through our company last year. It was pretty interesting. All of the phones in our company are on the same trunk. You could tell the dialer was just calling every possible number on the trunk in sequence because a wave of rings went through the office (it's normally pretty quiet). Everyone discovered they had a voicemail from "the job hotline" a little while later. The Attorney General eventually caught the guy and shut him down.

Re:Anecdote

[zobier]

Here we've had auto diallers that "prank", i.e. hang up after one ring in an apparent attempt to get you to call back at your expense. That was even funnier with the sequential numbers on our pbx; chirp, chirp, chirp... around the office in quick succession.

Re:Server first

[aaarrrgggh]

For first-time callers, you need a little bit of an IVR front end, ideally some kind of TellMe system. Then you have additional information about a caller before it rings your extension, and if it is really advanced it can determine who the call actually goes to. If the caller is accepted as legitimate, it gets added to the whitelist, if it is rejected (by a human) it goes to the blacklist. Everything else stays greylisted.

So easy to fix

[Sloppy]

Like cryptography, authentication must also be a part of the protocols used in future voice communication. Fortunately, the same tech happens to help with both.

Once you have a solid identity for the caller, they can be looked up somehow, and either be classed as someone you know (i.e. have personally vetted as human) or delegated through a WoT as probably human, or determined to be "nobody."

The reason this is a problem for current VoIP and POTS is merely that those things happen to suck due to legacy interoperability, CALEA, etc.

I really do think those concerns will eventually be left behind. Just like PGP over email, though, there will be social resistance (or inertia, at least). But the very problem being discussed here (phone spam being more annoying than email spam) will make securing voice more attractive to the mainstream, than securing email was.

It's a Scheme to Sell Spitware to End Users

[mpapet]

As someone that runs a VOIP server, I can speak from limited experience.

1. Unlike email, The offender needs a block of voip numbers to do any meaningful spitting. Those blocks aren't as costless as sending spam. Let's argue for a minute they don't need blocks. The VOIP server should not be allowed to process more than ~2 calls out per number. That's a configuration issue. On proprietary voip server software, I don't know if that's possible, but on openser it is.

2. This _should_ be the responsibility of the VOIP host, except we know that most current providers won't do it for free. It can, and should be automated. ex. *69 reports the call as spam. Even if the call is coming from a peering host, the source can be halted swiftly.

3. DB queries on call volume should identify the offender within 30 minutes anyway.

The article is an advertisement disguised as news.

Re:Colour of bits in the packet

[StonedRat]

You pay to receive calls?

Re:Colour of bits in the packet

[Miamicanes]

Um, in case you haven't heard, American cell phone customers pay for airtime on outgoing AND incoming calls.

10 years ago, I thought it was a Bad Thing. Now, I think it was ultimately a Good Thing. Why? Because the people who bore the costs were the cellco's customers, so we exerted direct pressure on our carriers to include more minutes of airtime and/or make nights/weekends/incoming calls (or at least the first minute) free. Nowadays, a typical American cellular customer pays about $50/month for service that, for all intents and purposes, is almost flat-rate. Contrast that with Europe, where the cost to call mobile numbers is set by faceless bureaucrats who are accountable mainly to the carriers themselves, and there's no incentive (or possibly even a legal way) for individual carriers to reduce the cost of incoming calls and use it as a competitive advantage over others. The net result is that a frugal person who rarely makes outgoing mobile calls can get much cheaper service in Europe, but Americans who pay 2-3x as much can basically use their phones all day (or at least all night/weekend) until the battery runs out with little risk of getting a big bill at the end of the month.

Re:Call Screening

[gnuman99]

I just set up Asterisk to answer all my calls. Then it says

  "Hello, thank you for calling Blah & Bo. If you want Blah, press 1. If you want Bo, press 2"

I get about 10-15 calls a day that hang up before even 2 seconds of the automated prompt. And these tend to call the same time each and everyday, until they give up a week or two later.

I get NO telemarketers, EVER, as they don't really have keypads AFAIK. When once was upgrading the Asterisk machine, it was down for 2 hours. I managed to get 2 telemarketers. I just told them to call back in the evening as I had no time. Guess what? Asterisk was up by then and they never got through! :)

iPhone visual voicemail

[SethJohnson]

I wish I had the iPhone's "Visual Voicemail", since then I could selectively listen to the important message and delete all the, "Hi. its me. call me back" messages that are redundant with the missed call log.

That is the killer app on the iPhone. It's the single reason I bought the thing. It has lived up to my expectations, too.

Seth

Solution: Use audio captcha at the handshake level

[bergeron76]

Since this is a real-time negotiation taking place, it will be much easier to include a challenge/response in the "handshake" portion of the connection.

Unlike, email (which gets queued), voice requires an instant connection between endpoints. If you simply used an audio captcha ("Hi, please say my first name after the beep to be connected..."), you can create a hurdle that has to be overcome immediately. Using VOX/IVR technology would easily create an AI nightmare for potential "SPITers". Add a short timeout (like 10 seconds or [with a few retries]) and then dump the dubious caller.

Corporations do it to us all the time when we call customer service "I'm sorry, that's not a valid option. Goodbye".