Slashdot Mirror
FBI Vaguely Warns of Asterisk Vishing Vulnerability
coondoggie writes in to let us know about a fraud alert issued by the FBI's Internet Crime Complaint Center, warning that an unspecified bug in unspecified versions of Asterisk IP PBX software could allow criminals to generate "thousands of vishing telephone calls to consumers within one hour." PC World checked with Digium, developer of Asterisk, and found some puzzlement as to what bug the FBI had in mind. "In March, researchers at Mu Security reported a bug that could allow an attacker to take control of an Asterisk system. Digium wasn't certain what vulnerability the FBI was referencing in its advisory. However John Todd, the company's Asterisk open-source community director, believes that it was probably this March bug. That vulnerability 'basically allowed you to take over the account of one individual,' he said. ... However, the attack described by the FBI would be extremely hard to pull off, Todd said." Update: 12/09 02:54 GMT by KD : Digium has put out a statement on the IC3 warning (further details), confirming that what the FBI had in mind was an old bug and difficult in the extreme to exploit.
Wouldnt hurt to mention it, in the summary, would it.
Hello? Hello? May I speak to my friend the honorable Mr. JohnSmith@bigcompany.com, President?
I am Mr. Dramane Yadi, I work in the Accounts/ Operations Department of a Prime banks here in Abidjan Cote D'Ivoire. I actually have an urgent and very confidential business proposal for you. I got your contact from Internet and decided to contact you immediately.
*CLICK**DIALTONE*
Hello? Hello? Can you hear me now?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
So, this?
Quidquid latine dictum sit, altum sonatur.
...what vulnerability the FBI was referencing.
Nice. How many do they have?
thegodmovie.com - watch it
"FBI Vaguely Warns of Asterisk 'Vishing' Vulnerability"
what's next:
"FBI Vaguely Warns of People 'Vanting' To Suck Your Blood"
Summation 2
Back in October, one of our servers was compromised using an ssh vulnerability to gain access to the system. What they did was to install Asterisk on our compromised system, and then try to compromise other Asterisk systems on the network. I am not sure as what the actual vulnerability the FBI is talking about, however I do know that they were using asterisk against other PBX systems.
That vulnerability 'basically allowed you to take over the account of one individual,' he said. ... However, the attack described by the FBI would be extremely hard to pull off , Todd said.
Oh it's difficult! (^_^) Good, then it probably wont be exploited.
Oh...
The recent attacks were conducted by hackers exploiting a security vulnerability in Asterisk software.
Because Asterisk is an Open Source project that will really hurt their ability to TAP communications.
Donde Ser Geek No Duele
Oddly, about a 1/2 hr before this story was posted I received a similar vishing scam. CallID said +23456, a guy with an American name but Indian-like accent claiming to be from the "United States Federal Grant Program" said that he was going to send me $5000 in grant money. He explained this was because I was a good taxpayer, that I didn't have any felonies, and that I can be given this money for a variety of reasons ranging from family care to school etc.. His accent, and sentence composition totally gave away that he wasn't a US paid telemarketer. Curious about how the scam worked I played along, verifying information about my address that he some how already had. He continued to explain how his company would be transferring money to me as soon as I send back the info they are going to send me. He went on to explain further, then eventually he asked for my bank account info; I deferred him until later, claiming I didn't have it, hung up and called the FBI.
Oddly, he had such a long story, and the way he extracted info (aside from his accent) seemed pretty reasonable. I could totally see some fool (my mother) assuming that since the incoming number wasn't a normal one, that only possible explanation was that the government could be calling them.
Strangely, the FBI took my call and I spoke with a detective, however, they were unwilling to work with me to try and catch this guy, because the amount of money he was scamming wasn't high enough; apparently he has to scam $300,000 before they will allocate any resources toward the case!!! It's no wonder there's such a problem with this type of scamming.
but... do you have an Asterisk PBX?
Donde Ser Geek No Duele
Strangely, the FBI took my call and I spoke with a detective, however, they were unwilling to work with me to try and catch this guy, because the amount of money he was scamming wasn't high enough; apparently he has to scam $300,000 before they will allocate any resources toward the case!!!
A minimum scam of $300,000 before the FBI gets involved is +1, Informative, right there. Further to that, any pretense that the cops have about "Crime doesn't pay" is busted right there. Not that I believed them prior to this, but, by itself, that pretty much proves itself right there. Assuming a smart criminal (ok, that's a stretch), you could go out, scam $290,000, and fly under the FBI's radar. That's approximately equivalent to $400,000 at approximately a 25% income tax rate (assuming you don't file with the IRS). If you then lived off that at the median income rate (according to Wikipedia, that's about $50k for a household, before taxes), which means you're doing reasonably well for yourself, until it ran out, you'd be living off the scam for about 8 years before having to do it all over again. The statute of limitations would likely kick in, and you could do it all over again.
Sounds like crime pays to me...
Look, I know editors are sloppy here but honestly...how hard is it to identify the correct agency who issued the alert?
It's not the FBI, you dolts.
It's the IC3 -- which is a "partnership between the Federal Bureau of Investigation (FBI) and the National White Collar Crime Center (NW3C)"
For a tech site, "close" is not good enough. Details matter.
This just goes to show that stupid portmanteaux must die. And the fidiots who use them.
I find your ideas intriguing, and would like to subscribe to your newsletter.
What version of Asterisk was that, again?
Kid-proof tablet..
Sigh.
It's $300k before the FBI gets involved. The OP is an idiot, and should have contacted his local police or state bureau of investigation. Believe it or not, not everything is a federal problem. You wouldn't call the FBI if your car was vandalized, or if your neighbors were fighting really loud, so why would you call them for this?
If the local people get enough calls about it, they'll route it to the FBI when it gets over $300k.
Maybe not
>You wouldn't call the FBI if your car was vandalized, or if your neighbors were fighting really loud, so why would you call them for this?
You don't call the local police because the local police are only allowed to investigate crimes within their jurisdiction. Unless the caller was in your county, they would need to know where he's from so they can call the police department there and open a joint investigation.
Ask a police officer if they are allowed to randomly give out even something as simple as a speeding ticket outside of their county. They'll tell you they aren't going to get in trouble for it, but unless they talk about it with the other police department, it'll just cause problems and likely nobody will prosecute. So why bother?
We have also been subject to an Asterisk Vishing scam. We are an outbound autodialer, and somebody compromised a testing account that did not have a good password and attempted to use our PBX to pass on their Vishing message. It was for a bank and asking people to verify account information. Seriously??
We are always on our * console so it was shut down immediately. We called the a$$hole back too and listened to him sweat while driving in traffic. Still, weird stuff... I was considering filing an FBI report, but your experience is not very encouraging.
LOL! You don't even know where the caller is, though. Maybe it's a big national crime scam, or maybe it's just your next door neighbor fucking with you. Report it to the police, and if they find it's outside of their jurisdiction, ask them to pass it up to the next level. Jumping straight to calling the FBI is just silly.
Maybe not
Ven I vish upon a star,
Dos not matter who you are,
Vor vish vill come true.
(assuming you don't file with the IRS)
If you don't report those earnings, then you are committing another crime, one that probably *will* be investigated.
Digium posted an "official" reply here:
http://blogs.digium.com/2008/12/06/sip-security-and-asterisk/
There was a bug in Asterisk that allowed unauthenticated callers to access the guest context, but in order for that to be a threat one would have to configure the dialplan such that guests were able to dial out on whatever PSTN trunk (SIP or analog/digital trunk) was attached to the system. Unlikely a huge threat, and that bug was fixed 9 months ago for 1.2 and 1.4, and doesn't exist for 1.6.
More likely is that this is a password guessing attack, so there is some confusion as to how this is an "Asterisk bug" and not just a matter of poor password choices.
it rises on a yearly basis it seems. just 4 years ago it was $50,000, two years ago it was $100,000.
And even then, that's not necessarily true. I work for a payroll company, we basically handle the direct deposits. Some scammers are very good and manage to take some of the more idiotic sales guys for millions and we still have issues getting feds involved.
Works something like this, they create a fake company with several other guys who are in on it, rent a building for a few days, put on a show for the sales guys, start moving money, act like they're growing, and after 6-7 months, or longer, are moving millions. The only catch is that the money isn't always paid to the payroll company before cash is deposited into employee's bank accounts, and bam! they take off with it.
I know, always make sure they get the money first, etc. but with long standing customers they want to keep relations and money taking a day to clear banks usually isn't an issue. Biggest take was about 2.5mil from a scammer who was using us for about 3 years. How he got the money to fund that in the meantime, I don't know, but boy is he rich now.
sorry, $25mil, not 2.5mil
Vidishing?
Camishing?
Pishing?
You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
Just use FreeSWITCH instead of Asterisk, it's a lot better. Asterisk is worthless and broken software.
FBI updates the release and says yes, it's just a re-hash of an old security notice that went out in March.
http://www.ic3.gov/media/2008/081205-2.aspx
See the Asterisk [UPDATE] here:
http://blogs.digium.com/2008/12/06/sip-security-and-asterisk/
Unless you know of some other agency that sits between the state level and the FBI, I'd can't imagine who else I'd contact; the call is more than likely out of country, not to mention out of state. Further, I have a NJ number, the caller was pretending to be in DC, and my bill goes to MA. Perhaps where you live the police are helpful, in NJ and MA I'd be lucky to convince the staties to touch it.