Slashdot Mirror
Asterisk Vishing Attacks "Endemic"
Ian Lamont writes "Remember the report last year that the FBI was concerned about a 'vishing' exploit relating to the Asterisk IP PBX software? Digium played down the report, noting that it was based on a bug that had already been patched, but now the company's open-source community director says that attacks on Asterisk installations are 'endemic.' There have been dozens of reported vishing attacks in recent weeks, says the article: 'The victims typically bank with smaller regional institutions, which typically have fewer resources to detect scams. Scammers hack into phone systems and then call victims, playing prerecorded messages that say there has been a billing error or warn them that the bank account has been suspended because of suspicious activity. If the worried customer enters his account number and ATM password, the bad guys use that information to make fake debit cards and empty their victim's bank accounts.'"
Vishing? Really?
What is that, voice phishing? What's next, we're going to call telemarketers "vammers"? And we'll call phreakers "vackers"?
I'm sure we could come up with a better term than "vishing".
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
I always hang up as soon as I recognize them for what they are. On the rare occasions when someone who actually has something to say that I need to hear tries to use one they always follow up with a real phone call or a letter.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Asterix was fishing when he was attacked by the Romans again? Where was Obelix? He'll win in the end, he always does.
http://en.wikipedia.org/wiki/Vishing
Either that or it's an old world ethnic pronunciation of the word "wishing".
When our name is on the back of your car, we're behind you all the way!
Sounds like some banks haven't been keeping things up to date...
Security patches are there for a reason. Security.
Don't give sensitive information away unless in person. If you bank says there's something wrong with your account, either call them via their listed phone number or go visit them in person.
"Our goal each year should be to increase the number of goals we set for ourselves!"
Fast-forward to 2109... ghoting attacks are on the rise, but nobody knows what the hell they are.
Vishing is pronounced "wishing," as in "I am vishing to see your nuclear vessels."
I hung up and immediately called the FBI. I'm glad they are actually doing something about it.
from G.M.A.C..
We owe you a credit on your current loan for your Government Motors clunker and need your bank account number and Social Security Number to deposit this credit in your bank. Do wish to proceed with this authorization?
Yes.
No.
Thank you for your cooperation.
Yours In Lahore,
Y. Omotayo.
Actually, it's lock down your phones, your VM systems, your IVRs, etc. etc. Many years ago I had someone guess a password on a VM system and I had forgotten to disable "external transfers"... oops. Toll fraud. Now I use safe telecom practices. Practice number 1: Use FreeSWITCH instead of anything else. While any system can be configured unsafely and insecurely, at least the initial FreeSWITCH config is "paranoid by default." -MC
What a load of crap. Asterisk developers patch security holes relatively quickly. This isn't an Asterisk "endemic."
Brute forced passwords are a bad administrator "endemic."
If your password policy is so stupid that you can be wordlisted then the issue may just be a PICNIC problem and not a fault of an application.
Asterisk isn't a security application. It's an enterprise-grade VoIP server and PBX.
Connecting Asterisk to a public network without some sort of border control is just stupid.
positing to undo incorrect moderation. nothing to see here, move along...
Insert witty
Why someone would still use Asterisk is beyond me, just use FreeSWITCH, it's a much better alternative.
All of them are highly profitable, even after all the paper shuffling, congressional payola, and obscene executive compensation and bonuses.
I recommend MetLife, MET, 3.2 billion in profits this year and rising, number 39 in the Fortune 500, and rising.
Some people prefer UNH, the largest of the whales, number 21 in the 500 and rising, but they only saw 2.9 billion in profits once they'd paid for all the cheesesteaks and blowjobs for the executive officers.
If you want to make some real money you want to invest in gigantic drug companies, though - they are the only ones with a chance of knocking the telcos and oil magnates off their bloody thrones.
One of my clients got hacked and was being used for a vishing attack. I called the FBI and was passed around and around because no particular office wanted the case. The client had setup SIP devices with the same name and secret and had not limited them to a specific IP range. Not a good idea.
In a more blatant case, someone purchased a toll free number 1 digit away from one that I own and was using an legitimate carrier to process incoming calls. Once again, I notified the authorities after people were misdialing the number and reaching me, and the case was too complex for them to handle.
I've been noticing in my firewall logs a lot attacking with strange user names (not the usual root and test etc.)
When I googled it I found out it was a default system account for some commercial VOIP product. Seemed not very useful to me at the time, but now I get it.
Remember, just dropping FreeSWITCH into an insecure environment isn't a solution. As systems integrators we still have to do our due diligence for security. Locking down Asterisk installs is always a good policy.
I think the real question is why there are so many Asterisk-based systems out there with little or no security in place. My guess is that it's because a lot of people just download it and throw it onto a customer's site. Oopsie.
The advantage that FreeSWITCH gives is that it makes security easier. Note that I said "easier" and not "automatic." If you don't think about security then you will hear about your FreeSWITCH system getting hacked, or vished, or whatever.
Like I said in a previous post: lock it down, people! I also agree that people shouldn't be entering their PIN codes on any incoming call, EVER. However, that doesn't absolve all of these foolish PBX installers (Asterisk or other) from their sin of failing to lock things down.
-MC
Phone Phishing. That way it's clear, and you get an alliteration as a bonus.
I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
"You keep using that word. I do not think it means what you think it means." I'm not entirely sure anyone here knows what "endemic" means. "Endemic" is not newsworthy, unless we've been searching and searching for where these vishing attacks come from. "Pandemic" might be newsworthy. Or "epidemic" might be newsworthy. "Endemic" not so much.
Werewolves?
There...Volves!
"Quote me as saying I was mis-quoted." -Groucho Marx
Our continued technological advancement is having a transformative impact on our way of life (duh). We are creating a world in which one needs ever-higher levels of intelligence (and, more importantly, critical-thinking capacity) just to survive.
Back in the good old days the majority of the human race didn't need to know much more than how to farm (with very simple farming technologies). The intellectual problems they faced weren't very sophisticated.
Today, a seemingly harmless deed like giving an account number (which doesn't really seem secret since it gets printed on checks and stuff) over the phone can result in someone losing everything they had worked for all their lives, and having ruined credit on top of it.
How does one protect themselves from this scam? Knowing the details of this specific scam is not sufficient. There are a whole host of other scams with different details. One must protect one's self from the entire class of scams, and the only way to do that is to have a basic knowledge of how "the system" works (whichever system is in question) as well as a basic capacity to think before one acts and determine if the action being requested is actually likely to be necessary, and whether or not it might be risky. There are also judgments one must make about when one can and cannot trust the voice on the other end of the phone, when one does and does not realistically have a choice, and so on.
All of these mental activities require mature and insightful brains. Education (as to the details of "the system") is also a necessary condition, but not a sufficient condition, for personal saftey.
Some people believe that critical thinking ability is more hereditary than learned. I am no geneticist, but whether it is nature or nurture the bottom line remains: there is a class of person who was born and raised in a technologically advanced nation, but is not mentally capable of surviving in this nation. And this class of person is going to be (slowly and painfully) purged from the human condition because of this.
So as is unfortunately typical, some of the quotes I made of course been taken out of proportion. My quote was not that "Asterisk attacks are endemic", but that SIP-based brute force attacks are endemic. Every SIP system that is open to the "public" Internet is seeing large numbers of brute-force attacks. Sites that have weak username and weak password control will be compromised - this is little different than email accounts being taken over by password-guessing systems and used for sending floods of email. The significant difference is that when someone takes over a SIP platform to make outbound calls, there is usually a direct monetary cost, which gets people's attention very quickly. I hear reports of these types of attacks now all the time - it's not unusual, and it's not just Asterisk. We had a blog about this a year ago; this is just a re-packaging of the same news a year later, when recently I unsurprisingly said that attacks are no longer even newsworthy because they're so frequent (hence, the term "endemic".) Apparently, not being newsworthy means... it's newsworthy!
This has little to do with Asterisk other than it happens to be the most prevalent SIP-based platform on the Internet currently. It has everything to do with protocol attacks by script kiddies, or more professional attackers. Bad passwords = easy penetration. The upside on this is that it yet again gets the attention of administrators who might not otherwise know that their password of '1234' might be guessed by criminal users.
The bug that was mentioned? Old news. Really, really old news. And really not even that much of a threat for most people the way they have their systems configured even if they haven't upgraded.
Asterisk, Broadsoft, Cisco, Kamailio, OpenSER, FreeSwitch, Avaya - they're all vulnerable to the brute force attacks if adequate network and username/password security is not implemented. There are ways to minimize, if not eliminate these threats with very standard security policies that should be familiar to any network administrator (ACLs, random passphrases, random client usernames, adequate exception logging, and limits on account usage, to name a few.)
Just as an aside, the Digium SwitchVox platform, which is our commercial re-packaging of Asterisk, has as an element of it's GUI a tool that indicates the relative strength of passwords. We'd encourage any other re-packagers or users of Asterisk to implement a similar UI hint that forces good password behavior by users and local admins. It's really not something that can be done in the core of Asterisk; it has to be done by whatever is the layered UI on top of Asterisk for configuration, or just by good policy.
http://blogs.digium.com/2009/03/28/sip-security/
http://blogs.digium.com/2008/12/06/sip-security-and-asterisk/
John Todd - jtodd@digium.com
Digium, Inc.
Asterisk Open Source Community Director
How about thieves, frauds, con-men, or scam artists ?? I find it hard to believe this is actually a problem. Is there REALLY anyone out there STUPID enough to give up your pin ? C'mon folks the real bankers don't need it to do what they do,ANYONE asking for your PIN is a thief, plain and simple. If you give anyone your PIN other than your more significant half you are a fool of the worst possible kind, and likely deserve what is coming to you. Tell you parents and grandparents that there is NEVER an emergency or occasion to give up the PIN...NEVER.
errr....umm...*whooosh* *whoosh* Is this thing on ?
I think part of the reason this vulnerability still exists in the wild is because of the appliance style deployment of Asterisk implementations. I believe the term is "Once you have MythTV set up DO NOT FIDDLE WITH IT!!!". Oops, I meant Asterisk not MythTV. Same difference. Not fiddling often involves not updating.
No, I was just annoyed at your impolite behavior at the time with all of the spamming. Then I noticed this story and saw that you are still at it. I'm glad you found a solution that works for you. Many people have also found other solutions that work great for them, including Asterisk.
Part of having such a huge user community is that the Asterisk devs have 100s of feature requests or bug reports at any given time. If someone is having a problem that is only having an effect on a very small number of people, sometimes it takes longer to fix than other problems. Everyone has to prioritize.
Also, the quality of the debugging information that is presented is also a major factor in how long it takes to get a problem fixed. This is a good example of 3 or 4 actual Asterisk developers trying work on one of your issues and you being rude to them and not giving them the debug information they requested.
I understand that having an issue that is affecting you take a while to get closed is annoying, but something being open for a week with no real information provided to help track it down is certainly no reason to get react the way you did.
And us Asterisk users aren't pissed about FreeSWITCH existing--that is just silly. The more choices out there, the better! We just don't like people coming over and shouting YOU SUCK and doing the equivalent of spray painting our walls with "FreeSWITCH RULEZ!" like you did with the bug tracker. That is just childish. There are many excellent and polite freeswitch users and developers--I just don't think that you are one of them.
There's no place I can be, since I found Serenity.
'Vishing', eh? Vot are we going to call 'video phishing'?
Pishing?
You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
So vuck you.
Task Mangler
Hi Slashdot. I'm very sorry, but I fed the troll and I'll try not to do it again.
I've done a bit of research into this Diego fellow and I'd just like to apologize publicly for feeding the troll. You would think with a six-digit ID I'd been around long enough to recognize someone poking through the cage bars but Diego's agenda was well hidden at first and I fell hook, line and sinker.
Evidently, he got pissed off at some Asterisk developers back in the day and he's had a hate on ever since. He's now a Freeswitch fanboi and his lunacy outweighs that of any PC vs. Mac user.
He classifies himself as a FreeSWITCH engineer in job boards but I can't see how this could be helpful to his career in any way based on the way he presents himself in a public forum.
At any rate, even the FreeSWITCH people don't really like him so I'm going to ignore him from now on.
Again, sorry... I'll be more careful in the future.
I'm an asterisk administrator for several systems. I try to keep them up-to-date with the latest versions that patch security flaws, but I can't always get them updated immediately. The easy answer is to just not allow SIP or IAX (or MGCP, SCCP, etc) access from the entire internet. I firewall off those ports except to certain locations that require access to them.
One big question I have, though, is what about all those appliance-type IP-PBX's from the old-school vendors like Panasonic and Toshiba? I would wager that the vast majority of those are NEVER updated after installation. Surely they are subject to many of the same security flaws that Asterisk's SIP stack are. I know that at least one of Asterisk's security advisories was for a fundamental flaw in the SIP protocol. All SIP-capable PBX's would be vulnerable to this. Are Panasonic and Toshiba just not talking openly about this?
If anyone banks with these folks be advised their system was compromised about two days ago. I am not a customer of theirs but I still have a Milwaukee area code cell phone (currently reside in Orlando). They only have two branches, as the article indicated a small institution. I forwarded them these articles so hopefully they will take corrective action.
Branch Info:
333 N 35th St
Milwaukee, WI 53208-4108
(414) 342-7660