How I Could Steal Money from Instagram, Google and Microsoft

Sometimes used for payment and donations, especially in countries where a lot of people have phones but not credit/debit cards (e.g. Germany)

I remember few car parks that were accepting this payment method. I think it is the most illustrative legitimate use case of premium numbers or the pay-by-call method.

What about paid phone support?

Not really. The examples mentioned here are very edge case and don't warrant the risk and fraud that this system brings. Big providers love the traffic and can blame things on "international tariffs." Though for all I know, AT&T and so might have deals that require them to terminate all traffic.

In the US it is compounded by the fragmented telco system. You can find numbers in the US that'll pay several cents (some bill up to dozens of cents/minute). This was really heavily abused by things like FreeConferenceCalls or "sexy local chat" lines. It's also used to provide "radio-by-phone" for expats. They'll target a large immigrant population, then play home-town stations over the phone call. This lets people without data use their unlimited-US calling get radio from home without paying directly. Lots of money to be made coming up with ideas like this.

The FCC has ruled this is mandatory and slapped US telcos that blocked such traffic. Though the owners of such numbers now usually mandate that the business be based or have operation in their jurisdiction to avoid running into more challenges.

If price per bug will be increased, then there will be motivation among developers to create bugs and sell them to bug hunters.

Abusing a bug is not really worth it imo, otoh reporting it through a bug bounty seems like borderline scam. $500 for bugs supposedly top engineers missed and you worked on for days (e.g. communicating with the respective teams can take up considerable time) is a measly return. I get that money might not be the main concern here, but people could really negotiate a fee before disclosing the details. Lowballing this hard is mildly insulting imo.

the risk I suppose would be getting caught. I'm sure quarterly fin. auditing would detect something abnormal after awhile

Only if you're motivated solely by money. In which case you'd frankly be better doing neither and getting a more conventional job.

As they explained, the bug doesn't affect other users. There's no data compromise.

I'm surprised they got anything at all.

A few hundred dollars a year is nothing for these companies, not to mention that if you actually tried to abuse this to a substantial level I am 100% confident that it would be detected and blocked.

It's like filing a bug bounty that you can sign up for multiple AWS accounts and mine bitcoins in the free tier. Up to a certain level, they just don't care. Past that level, you'll be detected and mitigated against.

I used to think this. I have exploits that I can make a ton of money off of (exploiting phone systems). The only issue is that in order to generate money, I need to do illegal things. To sell these exploits, I need to find a criminal buyer. It's like noticing that you can rob people by hacking their smart-lock. It's hard to out-pay criminal activity.

In this case, the attacker would be committing fraud by repeatedly causing calls. But they can probably get away with it. They'll just get cut off. Especially with premium ($0.50+) numbers from more exotic locales - it's too hard to chase people down and prove it. Heck, a US company I advised for lost $90K to a guy in Quebec and it was too hard to go bother going after him. We thought about it for about 30 minutes than just gave up.

They mention that they have monitoring that would quickly notify people if any significant amounts of money started to be stolen.

So you can obtain a premium number, and then when anyone calls you on that number they get charged the rate that you set per minute and after fees, you get the money. That's how pay per minute phone services (esp. adult services) work.

So what he did was to get one of those numbers and then have Google / Facebook / Instagram call that number repeatedly and that's how he would get money.

You would be the one behind the premium number.

The account holder is the operator of the premium number. When they set up the premium number, they receive a large portion of the fees of any calls to that number.

It's why malware that lets you call and text from a compromised phone is so dangerous to your typical user.

I would have thought that North Korea would be flagged as spam.

I think I recall viruses doing the same in the early 90's, so this isn't exactly a new idea.

That's very common, yes. But it's also idiotic for general VoIP providers to allow access to such numbers. There's no reason they need to do that, and they hurt themselves and customers. Many of their US customers don't even need international dialing for the most part.

While you can make some money off fraud on normal-priced international calling it certainly makes it much more difficult and noticeable.

Why do the effort if I have literally never had it show up on my bill? If it did I wouldn't pay it.

I wonder what "substantial" would mean to a company like google or microsoft.

Besides, if the exploiter spreads the calls out well enough, I wonder how long it would take until it gets detected..

Yeah, but it seemed that they were low because both Google and Microsoft value the security of customer data over their own finances, and thus don't care as much about exploits that drain their wallets. Resulting in a lower bounty.

The smaller ones would be using services like Twilio, I would imagine. Does Twilio insulate users from this at all?