Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Voice Phishing Scams Are Getting More Clever

krebsonsecurity.com

Post reply on HN
Print view View original

121–130 of 226 posts

Re: Voice Phishing Scams Are Getting More Clever

#121

Post by DenisM »

xoa wrote: post #110

I'm personally somewhat nervous about what voice phishers will be able to accomplish with call ID once voice sample synthesis gets good enough and cheap enough, which is well on the way from what I can tell. Shades of that old Uplink game, call up a family member or friend and just get them to talk into the phone at all, not even give up personal information but literally just speak enough. Then the phisher can call…

Simple workaround - you call me and leave voicemail, I call you back on the # I know and we talk.

Re: Voice Phishing Scams Are Getting More Clever

#122

Post by skh »

emptybits wrote: post #80
skh wrote: post #71

Earlier quoted context omitted.

I suggest downloading a silent ring tone. I got one for a dollar. The silent ringtone is my default ringtone. I went into my contacts and changed the ringtone associated with them to be one that makes noise. I no longer am bothered by scam calls as a result.

> I went into my contacts and changed the ringtone associated with them to be one that makes noise. That gets the job done, but rather than modify each of your existing contacts (and each new one), consider just turning on Do No Disturb and setting your Do Not Disturb level to "Allow Calls From All Contacts" (or a particular Group or Favorites). These are iOS options but I assume there's an equivalent in Android.

That is probably a better solution. I have do not disturb for 10 pm to 8 am and have it set to not allow anyone to disturb me. But thinking about it now maybe I should allow calls from contacts during those times.

Re: Voice Phishing Scams Are Getting More Clever

#123

Post by gerdesj »

walrus01 wrote: post #103
gerdesj wrote: post #82

Earlier quoted context omitted.

The problem here is the ability to spoof caller ID. This should not be possible. Think of incoming CLID in the same way that you do email From: addresses. Often and easily faked. Funnily enough both my office PBX and SMTP daemon check incoming CLID/HELO and drop attempts to spoof their own identity. Its not a particularly sophisticated protection these days but is one of many, many rules. Actually, now I come to thin…

The problem with SS7 is that you extend your SMTP analogy, there is no way to implement the equivalent of SPF, DKIM and DMARC for verification of incoming traffic without breaking SS7-to-SS7 links between the vast majority of installed phone switching gear out there on the PSTN. Which nobody wants to pay money to completely replace.

True, but you can use your firewall for SIP'n'RTP or IAX2.

Creative use of firewall rules can be really powerful. For a very simple example: block VoIP from AWS's address ranges (serious gain).

A classic response for anon calls in telephony is to make the caller record a short identifying message and then play that to the potential recipient. The potential recipient then decides whether or not to accept the call - your staff (family, whatever) become the firewall. Remember that calls are billed to the caller by the terminating provider so this is OK (caller pays).

Those are two simple examples of using IP and humans to firewall telephony. Just because telephony is a bit crap on the identification side does not mean that you can't deploy lots of other weaponry to keep yourself safe. If you look deeply into SIP and IAX2, you get loads more options as well.

Re: Voice Phishing Scams Are Getting More Clever

#124

Post by tonymet »

This highlights what I see as the biggest security weakness with banking and online services -- identity verification is only one-sided. Protocols like passwords , pins, biometrics, secret questions only authenticate the customer and not the service provider. moreover, no one is talking about this huge weakness. For there to be trust, both sides need to be trusted.

For apps, this could be a one-time code validated in the app. As a fall back there could be a unique shared "service pin" that gets rotated.

Re: Voice Phishing Scams Are Getting More Clever

#125

Post by phkahler »

walrus01 wrote: post #50
phkahler wrote: post #23

The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable. Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a…

There is no way to fix the ability to spoof caller ID with the way SS7 is built. Not without breaking functionality to something like 85% of the installed base of PBX and phone switch equipment, most of which is anywhere from 10 to 45 years old. The legacy telco SS7 phone system needs to be burnt to the ground and rebuilt, but it never will be, because people have moved on to friend-opt-in based message platforms lik…

They know who to Bill for the call. Fix the rest. I don't care about excuses for this.

Re: Voice Phishing Scams Are Getting More Clever

#126

Post by gerdesj »

JamesBarney wrote: post #113
gerdesj wrote: post #109

Earlier quoted context omitted.

In email the From: address rarely delivers the mail. From: and To: are the ones that you see in your mail client and correspond to the addresses on the letter within. For example here are some headers from some spam I received: From: "Jeremy Adamson" Reply-To: "Jeremy Adamson" From: is what I see in my client and Reply-To: is where a reply would go to. This one is much better, note how I'm BCCd and To: is complete bo…

What about an out of band verification by the carriers? Basically a large registry. When I call someone I tell t-mobile who I'm calling, and they register it. Then on the receiving end Verizon checks with T-mobile or a central registry, and says yep James's number is calling this number. Then it marks it as a verified call.

Bear in mind that it is not in a carrier's (financial) interest to drop a call. Carriers are not required to verify CLID either.

There are lots of good things that telephony could be required to do but they are not and they wont.

Re: Voice Phishing Scams Are Getting More Clever

#127

Post by nickysielicki »

emptybits wrote: post #80
skh wrote: post #71

Earlier quoted context omitted.

I suggest downloading a silent ring tone. I got one for a dollar. The silent ringtone is my default ringtone. I went into my contacts and changed the ringtone associated with them to be one that makes noise. I no longer am bothered by scam calls as a result.

> I went into my contacts and changed the ringtone associated with them to be one that makes noise. That gets the job done, but rather than modify each of your existing contacts (and each new one), consider just turning on Do No Disturb and setting your Do Not Disturb level to "Allow Calls From All Contacts" (or a particular Group or Favorites). These are iOS options but I assume there's an equivalent in Android.

On my particular Android phone (Pixel) this is not a great solution because setting Do Not Disturb alters the behavior of other things like Calendar reminders or email alerts. You could make DND not do that, but sometimes I do want to mute other things. If you're using DND all the time, you essentially lose that feature on your phone.

The best solution I've found is to just go into the Google Dialer app and set the option to not ring on any call suspected to be spam. I still do get spam calls that haven't yet been reported, but it's down to only about 3-4 a month.

Not sure if Samsung phones / other android flavors have a similar feature or not.

Re: Voice Phishing Scams Are Getting More Clever

#128

Post by hellbanner »

phkahler wrote: post #23

The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable. Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a…

If only there was a way to register a Public Key that only a corresponding Private Key could use.

Re: Voice Phishing Scams Are Getting More Clever

#129

Post by drewmol »

amatecha wrote: post #86
wintermutesGhst wrote: post #65

Earlier quoted context omitted.

Having spent a bit of time working on projects that touch the phone network, I think it is a 'major nightmare' in the Lovecraftian sense--I for one am forever changed by what I saw. As for billing, it is usually based on the destination number, and your originating telco, unless I am misunderstanding your question.

Does this imply I should answer the 1-800 calls and keep them on the line as long as possible? :D

If you suspect a scammer called you, always keep them on the line as long as possible. Feed into the scam and act as gullible as possible, give them fake cc numbers, etc.

Re: Voice Phishing Scams Are Getting More Clever

#130

Post by dredmorbius »

flyinghamster wrote: post #108

I've had an Asterisk box for about 10 years now, mostly to deal with the tide of junk calls, and it has worked nicely. I first just blacklisted numbers (and sometimes whole prefixes), but now I use a CAPTCHA that handles the robocallers beautifully. Calls from known numbers get to ring through without the CAPTCHA. Still, I've been paying too much for that crusty old landline, and finally got motivated to do something…

Could you please point to guides / docs / references for setting this up?

Might make some good HN submissions ;-)

Post reply on HN