Your PBX has been hacked
cringely.com
cringely.com
Not to ad-hominem, by this guy doesn't know what he's talking about. (I've seen his posts before.)
The real problem is that no one cares to push any investigations. I've had many many cases of customers sending "illegal" calls through my network. It's not my customers, it's someone down the line. I'm not going to do anything without a warrant. And when an upstream vendor gets a complaint, you know what they ask for, every single time? "Please block this traffic."
I've even written back and told them, hey, if this is oh-so-serious, please have your customer follow up. Have them get a subpoena, court order, etc. They never do. No one cares.
Even with fake IRS calls, the "investigator" wouldn't bother doing the paperwork. The FCC doesn't seem to care either (look at their moronic anti robo dialing contest). The FCC has teeth, they're just very selectively deployed.
Oh, you can't go back to knowing who is allowed to send what number. Things are too mixed up, and it'd break many services. Including many uses of 9-1-1. It's far more difficult than, for instance, preventing spoofed IP source addresses.
If the FCC really wanted to fix it, they just need to do so. Start fining and being aggressive. Actually go after things, hunt the money down.
Finally, if you're relying on caller ID as anything other than a weak hint of authentication, you're doing it wrong, full stop.
That's interesting. Why is that?
1. Don't allow such users to use other caller IDs until they verify themselves (business, USF ID, etc.) or until they verify ownership of the number, or some other limitation. This is fairly reasonable and can be totally automated (some providers do so). Some Indian shop doesn't need to spoof all US numbers, so why allow them?
2. Require deposits against such behavior, and in case of uncontested complaint, keep the money.
3. Share information on offenders (FCC run, mandatory). This is like having a list of known bad agents. Yes, they can get new IDs, but that costs a bit (see point 1, no need to allow someone in India on a free email account, without a company, impersonate all US numbers).
4. Of the FCC really wanted to nuke the problem, they could make providers liable. End of story. Within a month, providers would get together and figure it out.
And this wouldn't need to hurt legitimate usage that much. Established operators are easy enough to figure out (or you can grandfather until there are complaints). End users trying to get going should have no problem, either.
That being said though, if you have access to ISUP fields on an incoming trunk, you can check and see if the JIP parameter matches an office corresponding to one of the two ANI fields, and route it to an operator if it doesn't. There'll always be a way to set your number to whatever you want, but if your number shows you're calling from a Centurylink phone in Seattle while the JIP corresponds to some random CLEC's switch in California, something is definitely up.
And it isn't even just fraud. Charities and marketing companies also fake/alter the caller ID.
I will say that a lot of IP<->phone networks terminate on numbers which look like local residential numbers, so even if caller ID could not be faked, they would just not put a caller ID in at all and let it resolve to the local area code number.
Unfortunately there might be no "good" answer to fraud. Maybe some kind of reporting service?
https://complaints.donotcall.gov/complaint/complaintcheck.as...
If someone wants to spend the money to dial me internationally just to try and pretend they're my credit card company, they're welcome to waste it.
If you're worried about someone spoofing the source of their call you should probably consider using SIP over TCP, although it is unlikely that rest of the world is going to follow suit any time soon.
And no, first-world telcos wouldn't be capable of providing what you want without massive overhauls either... Nor would they want to since there's a plenty of business critical applications that depend on this behavior.
I highly doubt that it would be hard for telcos to implement such a system. I have no doubt that they don't want to, as evidenced by their decision not to in the face of strong demand. I can certainly understand that they might have lots of businesses interested in preventing such a change, but I'm not aware of how legitimate businesses would be harmed. All they need to do is ensure that when they call me they deliver caller ID information that corresponds to a real number that can be used to identify them to the FTC when I file my complaints.
tldr: The technology isn't the only thing that's over 100 years old, the business practices are also extremely broken too. And telcos are not an honest bunch.
The other use case applies pretty much only to people I don't want to hear from in the first place, so I have no sympathy for how it would hurt their bottom line.
Also, note that Google Voice no doubt uses many termination providers (considering they're giving the service away for free, they'll need some pretty sophisticated routing to take advantage of cheap rates), so the second use case applies to any Google Voice user.
Does something bad happen by pressing a number on dial pad or they just transfer to a human to talk to. Just curious because I heard from someone that pressing a button was good enough for the spammer who is calling you, but it does not makes sense how that can harm.
I have however seen a slightly different breed of attack, where an attacker calls a victim (usually a switchboard attendant) and asks to be transferred to extension 9190. If this happens, they dial the rest of a 1-900 number and rack up charges.
For the bank I always hang up and call back. My money is worth the extra step.
Every PBX is just a copy of the old school analog PBX systems, so everything is ugly and a configuration nightmare. I'm not even sure if its even possible to secure these things. PBX's have all the liabilities of the POTS system and a TCP/IP system. Obscure dial presses and IVR hackers are everywhere. No one really understands this stuff and making sure an attacker can't break out of the IVR is actually fairly difficult as these things are designed to do their best to route calls and there are so many ways to do that.
The most popular PBX is FreePBX which runs on a dated CentOS distro where using yum to update breaks things, so everyone waits for a shell script released by Schmooze to do package updates. Of course, they will not be as fast as the distro mirrors so you have to wait for your managed updated while the hackers are loose with exploits for your platform. Then hope to Alexander Grahame Bell that the script doesn't break the Jenga-like system that is Asterisk-based PBX's. Spoiler: they usually do.
Encryption is borderline non-existant as anything that can interfere with the precious jitter and latency limitations of voip is disregarded, so everything is plain-text and open to trivial sniffing. No IPS/IDS out of the box. No botnet filtering out of the box. No captchas on logins for users. No SELinux. No modsecurity. No OSSEC. No nothing really, these distos are not made by people who grok security. They seem to be made by ex-big iron phone cowboys who came from managed Cisco and Avaya environs and think linux is a magical unhackable black box. Spoiler: it isnt.
I was going to write a security guide for the FreePBX distro but gave up when any little change broke something. Other than seriously firewalling these things off behind something that can run IPS/IDS and having Voip on its own vlan with nothing else, there's not much you can do. They're really delicate and easy to hack.
Lastly, in regards to the article, there is zero proof that all these scammers are all using stolen voip servers. They probably are in some cases, but its trivial to sign up with an international provider and make calls from Mumbai to the USA for pennies per minute. The tolls are trivial compared to what you can get just out of one person scammed. Most hacked boxes seem to be lone hackers getting free long distance or small operators reselling that long distance to shady-market buyers using bitcoin.
Easier thing we can do, is to map them down like we do it with IPs and domain names, but as usual, this is far from being a practical solution.
Best think is to let conventional telephony die and VoIP take over its place.
We have been able to map phone numbers to SIP URIs for a long time with E.164 ENUM. Numbers are a hassle, but there's nothing preventing numbers from living alongside proper URIs today.
> let conventional telephony die and VoIP take over its place.
Many places are still circuit-switched at the last mile, whether over landline or cellular. We can't turn off the PSTN in favor of VoIP until everybody has switched over -- similar to the IPv6 changeover dilemma, although more tractable due to the ubiquity of Internet access and proper interworking -- no tunneling required.
What I'm waiting for though, is the ability to "bring your own" SIP URI so the carriers can handle our calls in the same way GMail can handle our email for personal/business domains. (Not to mention the capability to dial out to SIP addresses...)
Ideally, this would extend all the way down to "bring your own SIP proxy and registrar" where the carriers would just act as dumb pipes to carry your calls at the same QoS as theirs, but that's a far ways off.
yes, because dialing 3.0.3.3.8.4.0.3.5.5.1.2.5.e164.arpa is super easy to do.
I was talking about a proper solution, not patching an existing one.
> We can't turn off the PSTN in favor of VoIP until everybody has switched over
Exactly, but we have to start at some point. We have been doing phone calls for more than 100 years, and it remained practically unchanged since then.
Nonsense, the user would never dial that. The number gets mechanically translated as necessary, which is extremely straightforward...
> We have been doing phone calls for more than 100 years, and it remained practically unchanged since then.
Really? Most of your comments in this thread are uninformed, bordering on the absurd. If you are doing a telecom startup (as your profile implies), I would encourage a better understanding of the industry: you can't compete with what you don't know.
(/s)
That's because circuit switching is literally setting up a wired connection between two points.
Good luck trying to be that reliable with a population the size of the Internet, and if you can, good luck being able to pay and maintain an infrastructure of that size.
> T.38 and RFC-2833 exist
Really? The last time I sent a fax was 2006.
You're clearly missing the point here. T.38 and RFC-2833 largely exist because there's many, many voip routes that can't transport low latency audio reliably. There's a lot of other things you can transport in a phone call that don't have out of band standards.
If you require out of band standards to reliably transmit a fax or even something as basic as DTMF, you're clearly stifling what can be done within a perfectly valid form of transport.
> Good luck trying to be that reliable with a population the size of the Internet, and if you can, good luck being able to pay and maintain an infrastructure of that size.
Several companies have, and continue to do just that not just around the country, but around the world; end offices that serve customer lines are connected together by trunks to tandem switches. You clearly have no idea how the phone network works.
> That's because circuit switching is literally setting up a wired connection between two points.
It's not just one channel, though; techniques such as time or frequency division multiplexing allow you to stick thousands of calls over a cable or RF link.
Most VoIP calls are also carried as plain data traffic. Digital voice services, which are basically VoIP (VoLTE, AT&T U-verse, etc), properly differentiate between calls and data, so calls on these networks are going to be much more reliable than simply leasing a SIP trunk. Once reliability is in place, audio quality is certainly going to be better between compatible endpoints.
You say that as if things like GR-303 and ISDN BRIs/PRIs don't exist. The only thing that isn't digital about modern, non-IP phone networks is the last mile when you order an analog loop.
> properly differentiate between calls and data, so calls on these networks are going to be much more reliable than simply leasing a SIP trunk.
In theory, sure. As I said though, in my experience the vast majority of these routes tend to fall behind their circuit switched counterparts in performance even on carrier grade routes.
Granted, "digital voice" was imprecise terminology, but you get the gist... modern consumer phone services are VoIP.
> fall behind their circuit switched counterparts in performance even on carrier grade routes.
Most carrier backbones have been all-IP for years. Pretty sure end-to-end circuit switched calls are atypical nowadays, although I'm happy to be proven wrong.
That certainly depends on what network and where. If you're talking about someone like Level 3, they definitely use IP transport for phone calls. But there's a number of networks that don't. Verizon, for example, has a toll network based on the DMS-250 and DEX-600 switch platforms. Both of these are designed from the ground up to handle circuit switched traffic. There are a few routes that're IP, but they're pretty easy to pick out since there's a combination of comfort noise, significant latency and packet loss (!) on them.
AT&T, similarly has a toll network running on 4ESS, 5ESS and DMS-250s. There are a few IP trunks on there, but they're typically only used for destinations like San Francisco to Chicago.
Sprint has an all DMS-250 network at their disposal as well, as well as TDS Metrocom and the McleodUSA network that Windstream bought. Anyway, you get the idea.
On the local end, to get transport to the phone network, you have to order DSX trunks; there is no IP trunking to be had. Not to mention, there's typically quite a large number of circuit switches in any given market. Typically enough to outnumber the number of softswitches.
No one is saying VoIP is as reliable as PSTN. Not even mobile (GSM, CDMA, etc.) is.
Not only do you not have to deal with the problems of internet routing, you aren't stuck with underwater sounding CELP codecs.
Anyway, if you're arguing voip should replace the PSTN, I'd hope you'd at least have something hinting it could be as reliable.
I did, and the reason some calls sound horrible, is because Skype is trying to save up some money hiring shitty carriers/providers.
> it's relatively easy to use a B channel to transport g.722
Why would you use an HD codec to transcode to G711? Call on any direction can sound only as good as G711.
> Anyway, if you're arguing voip should replace the PSTN, I'd hope you'd at least have something hinting it could be as reliable.
I agree with most of your arguments. VoIP isn't ready now, but it will be soon. Just remember how the Internet was 10 years ago, and how it is today.
The idea is to use the timeslot g.711 normally would sit in to transport your own codec. Studios use this technique pretty frequently when they hire voiceover talent or do remotes.
Second, how does he know the bank's phone system was compromised, just because he couldn't reach it? I'm no expert on phone systems, but it seems like any number of other possibilities are at play here. Like, the bank's phone system actually being down and the call minion he talked to not being in a position to know anything about it (common). Or maybe the call center was up, but it was inaccessible for a brief period of time. I can't imagine phone systems are very reliable. Again, an unsubstantiated conclusion.
Third, he also concludes the bank's records were compromised, leaking his phone number. I get fake calls from "banks" a few times per year, even ones with the right names. I see no reason to assume the bank's records have been compromised, just because you coincidentally got a fake call with your bank's name. Either it was coincidence that the name matched his current bank, or the information leaked through the usual means (bank selling your information to third-parties, who turn out to be unscrupulous or have their information stolen; or any retailer you've used your banks credit/debit card at selling your information).
Fourth, how does any of this lead to the conclusion that "[w]e’ve lost control of our phone network"? These were all typical phracker activities that have been occurring for decades.
And finally, the mention of the Do Not Call list is also a non sequitur. It's only loosely related to what the author previously mentioned.
I'm all for being security aware, but I'm not seeing the story here. In my honest opinion, this looks like a big pile of FUD with no useful substance and it surprises me that it's on the HN front page right now.
If you're talking about a good CO switch like a 5ESS or DMS-100, they're extremely reliable, well engineered machines. They consistently meet and exceed five nines reliability.
I even ran a 5 nines 9-1-1 service off Asterisk, as embarrassing as that is. We missed one call in 18 months during a hard maintenance cutover, but handled it manually, but of course it was only one part and relied on the rest of the PSTN.
With a SIP proxy in an HA setup, almost surely the biggest downtime is going to be operator error or IP connectivity issues. Or someone changing their signalling subtly, but OTOH 5ESS and DMS aren't totally identical in behavior either.
(Though fair enough, the "software" guys haven't shown the same uptimes, overall, as the old style switching, true.)