Slashdot Mirror
FTC To Trap Robocallers With Open Source Software
coondoggie writes: The Federal Trade Commission today announced the rules for its second robocall exterminating challenge, known this time as Zapping Rachel Robocall Contest. 'Rachel From Cardholder Services,' was a large robocall scam the agency took out in 2012. The agency will be hosting a contest at next month's DEF CON security conference to build open-source methods to lure robocallers into honeypots and to predict which calls are robocalls. They'll be awarding cash prizes for the top solutions.
the folks who keep calling about my (non-existent) google rankings for the (non-existent) business that I don't own.
'Rachel From Cardholder Services,' was a large robocall scam the agency took out in 2012.
Are you sure about that? Because I still get calls from Rachel and friends several times per week.
"Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
I still get calls from 'Rachel From Cardholder Services' on my cell phone all the time, so I don't know what the summary claims to have "taken out". The linked article even says it is an ongoing campaign.
Comcast etc sell their customers phone numbers to illicit third parties. I ended up having to throw together an Asterix system with a simple "no solicitations, press one to continue" message to filter out all the robo-calls I got when I was forced to switch services over to Comcast.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
From what I have seen, getting them to call is not the problem.
I got robocalled by "Rachel from Cardholder Services" last week.
I've already had four calls from Cardholder Services today! I wish they had been taken out!!!!!!!!
I'm not quite sure whether it is cute or sad that the FTC is merrily holding a little contest to attempt to detect robocallers based on the (relatively sparse) information available to the system at the far end of the phone line when it's a matter of public knowledge that somewhere between 'a strikingly large percentage' and 'All' calls connected are logged and potentially retained for quite some time.
Surely the network level is where robocallers stand out most dramatically, unless the caller has spoofing good enough to disguise the origin and frequency of their calls from the telco carrying them (which would also likely allow theft of service and thus be the sort of thing that would actually get fixed, unlike the pitiful state of caller ID), and we know that those logs exist.
Is it just considered polite to pretend that the telephone system can't be so scrutinized, or are robocallers customers who are just too reliable to hunt down and exterminate?
Here in Sweden we as a community got tired to telemarketers etc, so there were talks about limiting telemarketing by law (politicians working for you).. but before that happened all the telemarketers got together then and announced a common opt-out list you can sign up for (to prevent a more limiting law)..
I have not received any telemarketing phone calls in 10 years now - problem solved.
As for all this robo-calling and faking caller-id stuff etc, can't the telephone companies just police their own customers, and weed out illegitimate phone companies who allow such customers and refuse to forward their calls.. how hard can it be?
It's the only way to be sure. That or some public stockades.
Of course, to be fair we'll need to start with politicians.
I used to get repeat calls from some "continuing education" bullshit asking for someone by the name of Sasha by some Indian guy. When I told him I wasn't Sasha, he asked for my name, and I very politely said I don't give out that information. Then they claimed they were from some health organization... Then they claimed they were from M$ and wanted to remote into my "Windows PC" to install their virus scanner because it "was infected, and they were seeing traffic from it". I called that bullshit outright, told the guy I run Linux, and that he was a fscktard scammer. They hung up... Then the next time they called, I acted like I knew him, was too busy to talk, asked for his number, and repeatedly told him I'd call him back in 5 minutes. Man did that piss him off LOL! I'd report them, but they block or disguise their numbers. Now I just don't answer numbers I don't know. If it's important, they will leave a voicemail.
Sure, the "Rachel" didn't kill anyone. Probably. But with the number of calls placed, the overall damage — even if spread among millions of people — certainly exceeded that of a serious bodily injury or even death of one person.
Was any of the scammers sent to prison? I mean, I'd recommend impalement, but prison would've been good enough. Did it happen?
In Soviet Washington the swamp drains you.
My eyes are rolling so hard at this.
So, either the NSA knows exactly who these people are and are not helping the FTC.
OR the Robocallers have found a weakness in the NSA surveillance.
So now, Achmed the terrorist will just robocall his associates for an attack?
We'll keel them!
Maybe they just hate Anonymous Cowards?
Then how come all the FCC commissioners are appointed by Barack Hussien Obama? http://www.fcc.gov/leadership
You are a libtard fuckwit.
ITT: Idiots who give their real phone number with their voter registration.
Or at least she was as of two weeks ago... After a while, I got tired of constantly dropping what I'm doing to run to the phone to see if my kids had gotten hurt (again) only to see it was rachel from cardholder services. So I started having fun.
The name of the game is keep the human on the phone for as long as possible. While it is ever so satisfying to answer their question of "Do you have at least $2000 in debt?" with "No, I don't have any debt.", the real goal is to stall them for as long as you can. So ask them if your mortgage counts... Or a home equity line of credit. How about your car loan? Ask them if Diners club counts. Do they take american express? You get the idea! Play dumb. Have fun with them!
And always, ALWAYS!, be sure to point out that since they're calling dozens of times a day, you felt obligated to talk to them since they must really want to talk to you.
It took a couple of days, and quite a few runs through this game, but now Rachel won't call me anymore.
I feel like I should feel rejected and not nearly this pleased with myself...
Their business model depends on automated harassing of folks. People cost money. If we all did this, poor rachel might go out of business...
Cage match between Rachel from Cardholder Services and Sharron my Google Specialist, Only one gets out of the cage alive!
Sorry if I actually know anyone named Sharon...I rarely get past "This is Sharron " anymore :/
The MS scammers are sure getting lazy lately. Can't even check the area codes they are calling...even Grandma would find it unlikely MS would call at 6:45am!
Death penalty for people who set them up.
Seriously, if a person is willing to violate a just law, the punishment clearly is insufficient.
I got a really rude telemarketer call from a "government grants agency" wanting to give me money. I played along for a while but the guy caught on and ended the call with a sexist racist slur.
I don't read your sig. Why are you reading mine?
LOL! She's still around, now joined by Bridgette and Carmen. I get called twice a day on my cell phone (which is on the "Do-Not-Call list) from them.
They need to get serious about that as people are apparently still willing to give out their credit card numbers.
Do you have ESP?
They need to go after that Roy dude and his, "HELLO!!! Are your carpets dirty?" robo-calls as well.. he never gives up.
Not getting any "Rachel from Cardholder Services" calls here lately..
PPN
All you need is a device that sits on the incoming line before the house wiring. It answers every call and makes all non-whitlisted phone numbers key in a random digit before it allows the call through to the home wiring.
I've been doing exactly that with a PBX setup since 2007 - haven't receive a single telemarketing, charity, policital, survey, or scam phone call since then. I check the incoming call logs occasionally and those unwanted calls are still coming in once or twice a day, but they never get through the simple Turing Test. I can even whitelist numbers so they ring straight through without the hassle.
If someone could distill that down into a simple plug-n-play device we could finally end phone terrorism for everyone.
Let's face it, this is something that should be fixed by professionals employed by the FTC because that is the job they are tasked to perform. This cute little bounty program is a clever way of crowd sourcing the benefits of this skill set without the costs of hiring anyone. MAKE 'EM PAY! Not everything involving human labor should be done on the cheap just because employee costs are high. People cost money, and this tactic wont work forever.... I hope.
Leave it to /. to give us the article so we can be ahead of the... 8/8?!? I can't even get a land line installed by then.
Creator: Build a robocall honeypot by Friday, 8/8, at noon PDT :P
Having to work for a living is the root of all evil.
Ditto the ditto, although for the last few months, when I have just picked up on the call without saying anything, it would cycle thru the same message from "Bridget", then without a name, but now they seem to have an algorithm update to just say "goodbye" on the first after a few seconds of silence from my end. What got me doing this was that a couple months ago, they started using a number from my very own local State Farm agency, Id'ed as such on the caller Id, so I was taken in the first time. Then they started using that spoofed number several times a day. I called my agent's office to see if they had heard of that from any other customers, but not so. Finally, 2 days ago, I cleared some older numbers from my phone system's blocked call list, added that number, and informed my agent's office not to bother calling me from that number (not their "public" number anyway) anymore. Then I got "the call" from MY OWN land line number the next day - my wife flipped out, and started screaming at the schmuck who answered when she punched "1 to continue", and the fool kept talking so she hung up on him (said he had an Indian accent).
So now I block my own land line number on the phone block list - insanity! It is kind of creepy that they used the number of someone local with whom I do business, and that office's folks had not heard of anyone else using their number that way - are they able to "see" any other valid phone numbers that call me?
Is "Rachel from Cardholder Services" the same woman as the "Rachel from Verizon" I also get many robocalls from?
Yes I have a Verizon landline. Yes I intend to ditch it, partly because of their telemarketing.
Why don't they get NSA to do it? They're already working on public money, they have the tech, resources, legal powers and lack of morals among the other things needed for the job.
I want a Telecrapper 2000
http://www.youtube.com/watch?v...
I have to say your experience sounds more like someone you know playing a practical joke on you.
Just put a captcha on your phone calls. Then only a human is getting through to your actual phone line.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
Can't tell me they can't figure out what carriers/shady resellers these are originating from... Other government agencies certainly have the from/to metadata data and what carriers they are going through.. Make it not in the interest of the backbone carriers to carry that voice traffic. Make them financially responsible with fines for large infractions, the fine needs to be larger than the income they are getting from turning their head.
It used to be the "handshake" on phones was: Hello (SYN) Hello (SYN/ACK) What's up? (ACK). Now, thanks to human nature it is: Leave message and call back number = SYN, Call back and leave message (SYN/ACK), return call again and person answers since number is known (ACK). I understand this isn't always possible thanks to business needs and circumstance, but most people I know will simply never answer an unknown number on their phones, instead they let the caller leave a message to determine who the number really is. Any legitimate call will leave a message (and a few non-legits) and all the others can go to hell.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
The FTC needs to set up Honey pots with actual SS7 ANI feeds. Real time query the calling number and provider. The dirty secret here is the telemarketers need VOIP providers to work. Usually ones that are willing to turn a blind eye and willing to let them advertise the outgoing number as anything they want. The FTC needs to put the pressure on them and their upstream connection into the phone system (most likely a CLEC of some sort).
In the long, long ago when telemarketers were humans and more often known as telephone solictors, I listed my phone number under a high school nickname, Heimdallr the Watcher., or Watcher, H.T.
That made it easy to sort out the telemarketers, it was a legit call if they asked from "the Watcher," but a dead giveaway if they asked for Mrs. Watcher.
So the standard rap would be, "Sorry, Mrs. Watcher is here but she can't speak to you."
Sometimes they would bite and ask "Why?"
"Well, you see, Mrs. Watcher used to be a telephone solicitor." [Dramatic pause]
"Until someone caught her." [Another dramatic pause]
"AND CUT HER TONGUE OUT!"
Usually this got a laugh, but at least once the telemarketer said she was calling the cops.
End MGM. Get prospective parents of boys to Google: Men do complain
I work from home most days, and Rachel and her robot army usually call a couple of times a day. I've tried anything from stringing them along to yelling at them for being criminals to putting the phone down, and they still call back. (The one serious thing I haven't tried is the combination of reorder tone and a "The number you are calling has been disconnected" announcement, which I should just have as a handy .wav to play at them.)
I wonder where they get their labor - some of it sounds like Canadian or Caribbean call centers, but there are a lot of US prisons, including the for-profit ones, that run call centers as something more lucrative to have prisoners doing than farm work or making license plates. Given how they're wasting their workers' time almost as badly as the people they call, it must be really cheap.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
At least in most states, DSL service from the main telco can not only carry telco-provided ISP services, but also competitive ISPs, such as Sonic and Speakeasy and whatever Megapath and Covad are called these days. The competitors tend to cost a bit more, but also offer things like static IP addresses at more reasonable prices, and usually don't have usage caps or "no servers at home" policies. They may be renting just the wire from the telco, or maybe the wire and the DSLAM, and usually also some regional distribution network, but it's usually their own email and web servers and upstream bandwidth.
My experience with Sonic.net is that about every 5 years, something goes wrong that takes a day or two to fix, either a telco problem in a box down the street, or my DSL modem getting too old and dying. So I call them up by phone or send them email from work or Starbucks, and get a quick response back from somebody who can diagnose the problem but may need to call the telco to actually fix.
Fiber-based telco services don't have to share with competitors, unlike copper, and I'm not sure if AT&T U-Verse gets resold or not. But copper DSL is definitely not just the local monopoly.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
It's a virtual machine. Running Linux. Firefox instead of Internet Exploder (Sorry, it's a work machine, the IT department installs Firefox instead of IE.) With NoScript and AdBlockPlus. Amazing how much stuff just "didn't work" when I tried it - I'd go to their web pages, and I'd hit the Download button and nothing would happen, or I'd run the installer and it wouldn't work. (I wanted to see all the different things they were trying - most of them were different Remote Login or Remote Execution programs that would have let him log into my machine and then do his real attacks.)
After about half an hour the guy realized I was faking him out, and we had another entertaining half hour while he tried to convince me that what he was doing really was a legitimate kind of business, and after that his boss came on and spent five or ten minutes yelling at me for wasting his employee's time.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
First of all, Caller ID is trivially easy to fake, and the scammers all do it. For now, most of them pick random or fake numbers to avoid getting blacklisted, but if whitelists were common, they'd start forging real numbers to get through.
But many people (ok, me, at least) get lots of calls from numbers I don't recognize, and robocalls that I want that might not come from the number I recognize for somebody. Most of the robocalls are the pharmacy saying I've got something to pick up, or the dentist's office with a reminder about an appointment, or that kind of thing, and the calls from humans might be from some doctor my wife is going to or some business we were trying to reach that has different numbers for outgoing calls than incoming (like the painter calling from his cellphone instead of his office, or a big business calling from their call center or local office instead of their toll-free number.)
And yes, I could just let the answering machine pick up, and you can too. Some of the robocallers' robots do a better job of dealing with that than others.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
They really did go away for a while, or at least slow down a lot, when one of the big "Rachel from Cardholder Services" gangs got busted and shut down. But it's such an easily replicable scam, and probably multiple sets of it are being run independently. I'm pretty sure the call center end is independent contractors or else shady call-centers (I know some are in Canada, and I suspect some are run by prison-labor call centers and some are in the Caribbean.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Tracing the phone calls hasn't worked very well, but the way to go is to follow the money. Flooding them with honeypot credit card numbers would generate a trail that might be followable (e.g. have an FTC web page that'll generate a credit card number and billing name/address, and have Visa track the merchant information for anybody trying to process a charge against those numbers; the risk is that you have to make sure those numbers don't get used for fraud, even if they're set up to always reject charges.)
I don't know how much information the scammers try to get, such as SSNs; generating fake ones of those has its own risks, though it's always fun to give them 078-05-1120 or Richard Nixon's SSN 567-68-0515. It turns out there is a publicly available official list of SSNs of dead people, which is intended to detect people using invalid SSNs, but it's possible that Rachel's gang doesn't bother filtering on it, considering that they don't filter on phone numbers of people who've told them not to call back.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Actually, scrub the last bit. While it'd be amusing, we all know in general what they're trying to do.
List of the domains / ISPs they host their malware on and of the exploits they tried? Just for shits'n'giggles.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
It was too long ago, and I didn't save them. I think one was named something like "Login123". Basically all of their "repair" tools were remote login tools, probably run by entirely different companies that they were just customers of, and they'd load the actual attacks after they got in.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
SNAFU.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"