Hacker News Reader

I've worked on a large federated IP reputation system. It sounds like a great idea, but does not work in practice.

The main problem is that it's just too hard to map different kinds of abusive/non-abusive actions to a shared scale. The model here seems to be basically a boolean OR: if anyone flagged an IP as bad, it's marked as bad in the data set. Let's say that you're running a shop and detect a bunch of fraudulent transactions for expensive items, and add the IPs to the list. What can somebody else using this list for say spam-filtering comments to a web forum do with your data points in isolation? Not much, because the action you're protecting is rare, high impact, and unlikely to have FPs so the threshold where you'd mark the IP as abusive would be very different than for the spam-filter use case.

At a minimum you'd need all the client of the IP reputation signal to also share the positive reputation signals, not just the negative, and to export some forms of volumes or ratios of good and bad traffic. But it'll still be really hard to combine those reports to a single verdict that's generally useful.

A secondary problem is that different kinds of abuse don't even correlate particularly well. Let's say that you've got an IP address sending SMTP spam; the odds are that this IP will not be doing ssh credential stuffing, credit card fraud, mass-scraping, traffic pumping, warez distribution, or DDOS attacks.

The classic SMTP IP blocklists work only because everyone using them is using them for the same purpose, and is as such on a shared scale, and there is a high likelihood of the same abusive actor attacking multiple different organizations. Your example would fit that as well, and doing reputation for that one domain would actually tractable unlike federated cross-domain IP reputation.

> whatever "why don't you just" you're about to reply with,

I love that you added this. So many armchair experts with brilliant solutions to problems they know nothing about.

'I could fix it over a weekend' is pretty much the motto of this page.

These two smug all-knowing above comments aside, how do you actually get charged money for dialling numbers that don't exist?

Corrupt carriers in other countries splitting the money, etc.

So stop dialling out to these few places? Otherwise it's a cost of doing business if you insist on keeping at it knowing full well what happens.

This is what most people do, at my employment we restricted it to US/Canada with a reach out for other countries.

They do usually exist. They answer immediately and than play the "it is ringing"-sound forever.

(Some SIP providers allow you to disallow expensive numbers to be called and/or state the minute costs before the call starts (giving you time to hang up.))

Countries are demanding access to private citizen encrypted messages,

but can't legislate away the basic 1980s phone scam.

Wonder why their priorities are so skewed.

> They answer immediately and than play the "it is ringing"-sound forever.

Except that clearly is a number which exists? One that answers, GP isn't fighting 1980's phreakers with a bluebox, they are using Twilio, Signalwire, etc to make automated verification calls/sms for a very large company as far as I understood it. The call being answered is baked entirely into your programmatic logic.

Unless I'm missing some niche telco semantics or lingo here? Or they are rolling their own?

To embrace the "don't question it, you don't understand" narrative, I'm actually quite stunned someone would let this go on for such a long time, if this is corruption, crime or some other sort of telecom fraud aided and abetted by foreign governments/companies why not just turn off the tap and ban the country code if it was such a cost sink? Why not use some of the many alternative (and significantly more secure) verification methods for your customers?

The project page?

The HN page.

:-D

It is arrogant to assume that if you haven't found a solution then nobody will. (trust expert when they say something can be done, ignore them if they say it can't be done, just do it)

It is also arrogant to assume you can find a solution in a few minutes after reading a HN comment when an entire team couldn’t think of one in years.

> an entire team couldn’t think of one in years

There's literally no other solution for customer verification other than an automated phone call into third world countries with corrupt telcos?

We clearly aren't talking about the engineering team here.

There are clearly other constraints involved that we don’t know.

Nobody is assuming that. The arrogance is when people with no knowledge of the people, systems, or problem at hand jump in as though they’re experts. It happens all the time here (hell I’m guilty myself)

Oh good, mob justice on the networks. Surely this IP system itself can never be manipulated to cut off people by mistake or for revenge.

Humans always investigate thoroughly before serving themselves.

None of these IPs could be zombies; here come internet Supermen to save us!

Yeah, this is to gather the raw data and learn probe and attack patterns. How you use the API is your choice really.

Since you say you tried and hard to stop this, I guess you are implying that it's not possible to tell in advance what it costs to call a given number? How do telcos get away with that?

For consumers at least, it's the law in the EU. Every phone network has either a pricing document or a webpage where you can type a number and it tells you the price, and if you were charged something that isn't that price, I guess you could demand a refund, and escalate to a court if the refund wasn't forthcoming.

Note that these documents frequently list some numbers at ridiculously high prices (eg. €25 per minute), presumably to deter such fraud.

I think the problem with that is that these schemes rely on the phone network being ridiculously insecure. The scammers send a surprise bill to your telco, then they pass it along to you.

It wouldn't surprise me if the list only applies to consumer plans, or (as you say) high-balls stuff in certain countries.

I wonder what would happen if the telco would say "we wont pay the bill, since we believe it is fraudulent". They wont "lose much" if some fraudulent telco from third world cuts them - the numbers dont work anyway. And what can the scammers do? Try to sue an US telecom? If they reveal their true names, then the embassy knows where to send the "operators" who will solve the case for good.

There is normally a long chain of intermediate telco operators between the fraudsters and the US operator. Some of those intermediate operators are large and have a lot of legit calls. Each operator adds their profit margin on and passes the bill to the next. So no operator has any incentive to police this stuff, because they all profit from it.

It does make me wonder why they don't just switch to pre-paid sim cards (or the contractually equivalent thing that doesn't involve cell phones).

Good luck collecting your scam cash from my personal line! The phone company doesn't have a mechanism to pass the cost on to me, so I'm guessing the telcos already figure out how to block this at the network level.

Has anyone tried calling some of the bad actor numbers from a burner phone?

IRSF is a fascinating topic.

As it was explained to me (anyone feel free to correct me if I'm wrong), a shady/criminal organization takes control of a piece of the phone network. They pick a range a phone numbers for a country that is usually expensive to call, maybe a range of numbers that doesn't actually exist in that country, and they use the phone network to "advertise" a slightly cheaper route to connect phone calls to those numbers. Instead if it costing $1, it costs $0.80.

When someone makes a call to those numbers, they charge the cheaper rate, and then don't actually connect them to a real phone. Every time a call is made, they just get money.

The "S" is for "shared". They offer other organizations "for every call you generate to this range of numbers, we give you a cut". Let's call it 20 cents.

Now picture how many organizations are vulnerable to this. Every "call me back when a customer service rep is available". Every "call me to let me type in a code to verify I'm human". Every "leave a number our sales team can reach you at". They're all being attacked by these sorts of things constantly.

The cost to get a bot to trick the system into making a phone call is much smaller than the revenue generated. As long as that is true, the attacker wins.

There are definitely two kinds of bad actors when it comes to scraping/scripting things.

The automated drive by ones trying to spam posts in every form or are probing for word press exploits or what have you.

The ones where someone is specifically taking time out of their day to tailor their attack to your specific page.

The former is easy to deal with the latter is far harder to sort out.

This problem would not exist if the price of a call would be known before making the call. But we live in a world where "it's cheap, just use it, we will the exact bill later" is the norm.

A calling prefix for "place call if it's free" would be great. Or even "place call if it's at or below this standard fare".

I hope to expand the protocol list once I can figure out Network Discovery on the WAN - https://github.com/zeromq/zyre/issues/701

It s like the electricity companies who cant preemptively check usage to cut before it explodes, cant anything be done at the phone provider level to just...cut before the cost is incurred ?

I mean if credit cards can do it...

Why are these systems making verification phone calls?

two factor authentication

As they normally have a deal with the numbers they can successfully call for outpayments from the Telco.