Slashdot Mirror
Spit Will Be Worse Than Spam
KentuckyFC writes "A team of German computer scientists has developed a program that reproduces all the known forms of spit (spam over internet telephony) attack. Their plan is to make the spitting software available to computer security experts wanting to test antispit strategies. Developing these won't be easy. There are various antispit techniques, such as white lists that allow only calls from predetermined callers, Turing tests such as audio CAPTCHAs that make a caller prove he or she is human and payment-at-risk services where the caller makes a small payment in advance and is refunded immediately if the receiver acknowledges the call as legitimate. But all have weaknesses, say the researchers. The main difference between junk calls and junk email is that the email arrives at your mail server before you access it. This gives the server time to analyze its content and filter out the junk before it gets to you. Not so with internet telephony, which is why radically different strategies are needed."
Can this get to my regular phone or cell phone?
If yes, then this is a problem.
If no, then this is not that big of a problem.
If yes, but only if the spammers (spitters?) pay for cell minutes or something, then this is not a problem at all.
Seems about the only way to avoid junk calls. I never answer if I don't recognize the number, and certainly not if it's private. Pisses the bank off if I forget about a payment or something, but they'll usually send postcards too. If it's a legit call and they can't be bothered to leave a message, then I can't be bothered to call them back.
Of course, once the spam bots start leaving ads in my voicemail, then I'm getting violent.
The name leaves a bad taste in my mouth.
(Sorry.)
Developers: We can use your help.
Spam? Spit? What's next? Spam in Everday Reading Material?
"I'm getting sick of the SPERM in the morning paper."
Those who believe the Internet is private,
find their privates are on the Internet.
Ans SPAN contain enlarged organs! hmm I sense some sort of Soylent green thing going on.
Soylent green: Tastes different from person to person.
The Kruger Dunning explains most post on
Arrange the usage of internet telephony over e-mail, SMS, or IM before initiating or accepting a call.
The intrusive nature of the required synchronicity of telephony is unacceptable anyway. It always has been. Hence the invention of call-screening devices, caller-ID, answering machines/voice mail, etc...
If you weren't expecting the call, don't answer it. Then you won't have to give anybody money for yet another "security" product.
Play a Special Information Tone before the phone starts to ring. Most autodialers won't waste their time and hang up. Humans will realize it's a fake tone and stay on the line. I don't know if it works with VoIP though.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
The point is that the contents of the communication cannot be analysed in advance. The system doesn't know what the caller will say until the conversation has started and you have already been disturbed.
The rapid increase of telemarketing on land lines generically has spawned a whole host of solutions to this "problem", from the only marginally effective legislative angle (the US Gov'ts "Do Not Call" registry) to the completely effective technical ones like Caller ID Whitelisting services offered by the telephone companies.
Ultimately, since most of the VoIP services that have any leverage just extend the PSTN to a network connected voice terminal, the solutions remain the same. Don't accept uninvited sessions from unknown hosts at the terminal. Don't ring the phone for an unknown caller ID. Direct the caller to an IVR asking them for their name, and then give the caller the opportunity to accept or reject the call.
Lastly, perhaps the most effective "anti-spam" measure for voice spam of any kind (be it conventional telemarketers or some new-fangled network-enabled approach) is the simple auto attendant. Even though I don't have numbers in the do-not-call registry (and I see suspect calls hit my Asterisk system all the time) I _NEVER_ get any spam calls. My autoattendant has a voicemail default route and no route for 0 or 1.. this leave s about 99.999% of all junk calls dead in the water.
We had a dialer call through our company last year. It was pretty interesting. All of the phones in our company are on the same trunk. You could tell the dialer was just calling every possible number on the trunk in sequence because a wave of rings went through the office (it's normally pretty quiet). Everyone discovered they had a voicemail from "the job hotline" a little while later. The Attorney General eventually caught the guy and shut him down.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
For first-time callers, you need a little bit of an IVR front end, ideally some kind of TellMe system. Then you have additional information about a caller before it rings your extension, and if it is really advanced it can determine who the call actually goes to. If the caller is accepted as legitimate, it gets added to the whitelist, if it is rejected (by a human) it goes to the blacklist. Everything else stays greylisted.
Like cryptography, authentication must also be a part of the protocols used in future voice communication. Fortunately, the same tech happens to help with both.
Once you have a solid identity for the caller, they can be looked up somehow, and either be classed as someone you know (i.e. have personally vetted as human) or delegated through a WoT as probably human, or determined to be "nobody."
The reason this is a problem for current VoIP and POTS is merely that those things happen to suck due to legacy interoperability, CALEA, etc.
I really do think those concerns will eventually be left behind. Just like PGP over email, though, there will be social resistance (or inertia, at least). But the very problem being discussed here (phone spam being more annoying than email spam) will make securing voice more attractive to the mainstream, than securing email was.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
inventing cutesy acronyms (like "spit") vastly increases awareness in the media and in funding
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
They setup a scenario where every call gives the callee a small payment, then find this weakness in it:
"Let us even assume, that Payment at Risk is used for every call. Even In that case an attacker could circumvent it, by impersonating as another user, so that he can establish calls and shift the costs on to ânormalâ customers."
Umm, if they could do that, wouldn't it be more profitable just to impersonate others and call yourself, collecting all their money?
The cost to send out spam is extremly small. If only, say 0,1%, of the sent mails leads to an order the margin is met. You will not be able to educate those 0,1%. Some always slip through.
As someone that runs a VOIP server, I can speak from limited experience.
1. Unlike email, The offender needs a block of voip numbers to do any meaningful spitting. Those blocks aren't as costless as sending spam. Let's argue for a minute they don't need blocks. The VOIP server should not be allowed to process more than ~2 calls out per number. That's a configuration issue. On proprietary voip server software, I don't know if that's possible, but on openser it is.
2. This _should_ be the responsibility of the VOIP host, except we know that most current providers won't do it for free. It can, and should be automated. ex. *69 reports the call as spam. Even if the call is coming from a peering host, the source can be halted swiftly.
3. DB queries on call volume should identify the offender within 30 minutes anyway.
The article is an advertisement disguised as news.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Want to view a web page? Count the super-distorted kitties in this sequence of letters, numbers & symbols on the Stargate chevrons.
Want to leave a comment? Decrypt this email address that's worse than slashdot's email address obfuscation system, where you spend more time decrypting it than sending in a message.
Want to create an account? Play this java applet where you have to click on the moving bunny.
Ah, what a utopia. A whole internet that doesn't know if you are a dog, but will quiz you to make sure you are not a robot construct, or some farmer in India.
I had a whitelist for my mobile phone starting four years ago...and loved it, but lost it when I "upgraded" my phone a couple of years ago.
The capability was actually built-in to the specific Motorola mobile handset that I was using. The phone had an option to send callers directly to voice mail if they were not in my address book. It would also capture the incoming phone number in my call list. Friends and family got right through. Those whose numbers I did not have left a message...which I then added to the address book just by going to the call list and hitting "save."
The downsides:
- Calls from offices often come in with a semi-random PBX number...so even if I had my wife's or friends' office numbers in my address book, their incoming call would normally get kicked to voice mail. It actually trained them. They stopped calling from those lines and started calling me from their mobile phones.
- I had to remember to turn this feature off if I was expecting a service or delivery person to call me before they dropped by my house...because I didn't have a home phone either.
Small price to pay. That said, the "do not call" list has made my life somewhat easier...but I do miss the whitelist capability at times...and it looks like I might need it again some day according to TFA.
Scuba
I run the SIP gateway for a Major university. We run the SIP gateway in such a way for other universities to bypass toll charges when we call each other. It works great -- other universities can call my email address and my desk phone will ring. The problem is that spammer (SPITters?) are now searching for the SIP TXT DNS records and spamming those domains. They setup a VoIP connection to my SIP gateway and try, one-by-one to dial each number in my PBX. 0@uni.edu, 1@uni.edu, 2@uni.edu, until they start getting people. What we have seen is they play a short message (usually about 30 seconds or so) about some "male enhancement" drug or something. They fill up our trunks really quickly. The problem is, unlike real phone calls and paper marketing, there is no cost-for-entry for this type of marketing. People can have a single computer hooked up to the internet make 1,000 of calls an hour. This would normally cost you major money to run this type of call center.
From RFC 3261 (Session Initiation Protocol): 20.4 Alert-Info
When present in an INVITE request, the Alert-Info header field
specifies an alternative ring tone to the UAS. When present in a 180
(Ringing) response, the Alert-Info header field specifies an
alternative ringback tone to the UAC. A typical usage is for a proxy
to insert this header field to provide a distinctive ring feature.
The Alert-Info header field can introduce security risks. These
risks and the ways to handle them are discussed in Section 20.9,
which discusses the Call-Info header field since the risks are
identical.
In addition, a user SHOULD be able to disable this feature
selectively.
This helps prevent disruptions that could result from the use of
this header field by untrusted elements.
Example:
Alert-Info: <http://www.example.com/sounds/moo.wav>
I wish I had the iPhone's "Visual Voicemail", since then I could selectively listen to the important message and delete all the, "Hi. its me. call me back" messages that are redundant with the missed call log.
That is the killer app on the iPhone. It's the single reason I bought the thing. It has lived up to my expectations, too.
Seth
$5 / month hosted VPS on linux = awesome!
That sounds great as long as the VoIP box is being used by a tech savvy person like you. And as long as the emergency call originates from your family member's home and not an unfamiliar cell phone, pay phone, hospital phone, jail phone, friend's phone....
Yeah, and let's make bets while we're at it. Who'll get to the house first, the fire or the firemen?
Since this is a real-time negotiation taking place, it will be much easier to include a challenge/response in the "handshake" portion of the connection.
Unlike, email (which gets queued), voice requires an instant connection between endpoints. If you simply used an audio captcha ("Hi, please say my first name after the beep to be connected..."), you can create a hurdle that has to be overcome immediately. Using VOX/IVR technology would easily create an AI nightmare for potential "SPITers". Add a short timeout (like 10 seconds or [with a few retries]) and then dump the dubious caller.
Corporations do it to us all the time when we call customer service "I'm sorry, that's not a valid option. Goodbye".
Don't think that a small group of dedicated individuals can't change the world. It's the only thing that ever has.