Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Voice Phishing Scams Are Getting More Clever

krebsonsecurity.com

Post reply on HN
Print view View original

161–170 of 226 posts

Re: Voice Phishing Scams Are Getting More Clever

#161

Post by my_first_acct »

phkahler wrote: post #23

The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable. Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a…

It looks like Canada is moving in this direction.

Here is a PR piece (by a telecom technology vendor) that explains that the Canadian telecom regulator will require non-spoofable caller id by March 2019 [1]. The technology is called STIR and SHAKEN. (That's all I know; I'm no expert).

The US FCC doesn't seem to be moving as quickly, if at all.

[1] https://transnexus.com/blog/2018/canadian-regulators-mandate...

Re: Voice Phishing Scams Are Getting More Clever

#162

Post by walrus01 »

zrm wrote: post #160
walrus01 wrote: post #103

Earlier quoted context omitted.

The problem with SS7 is that you extend your SMTP analogy, there is no way to implement the equivalent of SPF, DKIM and DMARC for verification of incoming traffic without breaking SS7-to-SS7 links between the vast majority of installed phone switching gear out there on the PSTN. Which nobody wants to pay money to completely replace.

> The problem with SS7 is that you extend your SMTP analogy, there is no way to implement the equivalent of SPF, DKIM and DMARC for verification of incoming traffic without breaking SS7-to-SS7 links between the vast majority of installed phone switching gear out there on the PSTN. Why not? That's how it was done for email. SPF doesn't prevent interoperability for sending domains that don't use it or recipients that d…

Because it's a huge installed base of non-upgradeable equipment that is 15, 20, 25 years old. People doing oldschool SS7 telco stuff are just not going to upgrade. They'll sue their upstream carriers if they suddenly cut them off because their new re-implementation of SS7 is incompatible with their old gear. I'm a senior network engineer for a mid sized regional ISP, and encounter this shit on a fairly regular basis.

It is not as simple as getting everyone who runs public facing smtpd on the Internet to upgrade their software and practices. Telco and PSTN phone stuff is the very opposite of being up to date and continually evolving best practices for security.

Re: Voice Phishing Scams Are Getting More Clever

#163

Post by King-Aaron »

Can anyone offer any insight into the latest series of odd phone calls I've been noticing, where you get either a private number or an out-of-state number call you, and then sit in silence until you utter a word in which it hangs up at that moment?

I've experienced a few so far over the previous months. I've even experimented by not saying anything for an extended time - up to about 30 seconds of silence (and then it usually hangs up itself). But the next time it happens, if you say 'hi' within a few seconds, it immediately hangs up afterwards. Like its waiting for a verbal prompt.

The apathetic part of me thinks 'maybe its a robocall thats bugging out', but then the pessimistic part of me wonders 'are they trying to sample my voice'.

Re: Voice Phishing Scams Are Getting More Clever

#164

Post by zrm »

walrus01 wrote: post #162
zrm wrote: post #160

Earlier quoted context omitted.

> The problem with SS7 is that you extend your SMTP analogy, there is no way to implement the equivalent of SPF, DKIM and DMARC for verification of incoming traffic without breaking SS7-to-SS7 links between the vast majority of installed phone switching gear out there on the PSTN. Why not? That's how it was done for email. SPF doesn't prevent interoperability for sending domains that don't use it or recipients that d…

Because it's a huge installed base of non-upgradeable equipment that is 15, 20, 25 years old. People doing oldschool SS7 telco stuff are just not going to upgrade. They'll sue their upstream carriers if they suddenly cut them off because their new re-implementation of SS7 is incompatible with their old gear. I'm a senior network engineer for a mid sized regional ISP, and encounter this shit on a fairly regular basis.…

It isn't the upstream forcing the upgrade. It isn't forced at all. You can keep using your old equipment as long as you want. But there would come a point that enough people are using the new protocol that recipients start auto-blocking calls from anyone who doesn't use it.

You may not even have to upgrade the old equipment. For an out of band protocol, the upstream may be able to implement it for you.

Re: Voice Phishing Scams Are Getting More Clever

#166

Post by Splines »

JamesBarney wrote: post #113
gerdesj wrote: post #109

Earlier quoted context omitted.

In email the From: address rarely delivers the mail. From: and To: are the ones that you see in your mail client and correspond to the addresses on the letter within. For example here are some headers from some spam I received: From: "Jeremy Adamson" Reply-To: "Jeremy Adamson" From: is what I see in my client and Reply-To: is where a reply would go to. This one is much better, note how I'm BCCd and To: is complete bo…

What about an out of band verification by the carriers? Basically a large registry. When I call someone I tell t-mobile who I'm calling, and they register it. Then on the receiving end Verizon checks with T-mobile or a central registry, and says yep James's number is calling this number. Then it marks it as a verified call.

iOS/Android could do something like this. You register your number with Apple/Google and link your account with them. When you call someone you set a field on your account that you're calling someone. When the person who you're dialing gets rung, their dialer can look up Apple/Google and see if that number was indeed calling them, and add a "verified" checkmark to the call.

This leads down a privacy/metadata rabbit hole, but there are probably ways to make this a lot better. In any case, the phone OS can do some out-of-band signaling and just avoid dealing with the carriers altogether.

Although if you're doing all that then why not just make a call using voip...

Re: Voice Phishing Scams Are Getting More Clever

#167

Post by albedoa »

jefftk wrote: post #159
albedoa wrote: post #150

Earlier quoted context omitted.

Yes! This happened to me too and is very alarming. It’s training users to fall for phishing. I’m not sure what a correction looks like though. Should they call customers and instruct them to find or verify a phone number and call back? Instruct them to log into their online account? That would be fine for you and me, but I’m thinking of the average cardholder.

Telling them to call the customer service number on their credit card seems pretty good?

Oh duh, thanks. You're obviously right. I was thinking of my experience when I was out and didn't have that card on me.

Re: Voice Phishing Scams Are Getting More Clever

#168

Post by ivankolev »

nickysielicki wrote: post #127
emptybits wrote: post #80

Earlier quoted context omitted.

> I went into my contacts and changed the ringtone associated with them to be one that makes noise. That gets the job done, but rather than modify each of your existing contacts (and each new one), consider just turning on Do No Disturb and setting your Do Not Disturb level to "Allow Calls From All Contacts" (or a particular Group or Favorites). These are iOS options but I assume there's an equivalent in Android.

On my particular Android phone (Pixel) this is not a great solution because setting Do Not Disturb alters the behavior of other things like Calendar reminders or email alerts. You could make DND not do that, but sometimes I do want to mute other things. If you're using DND all the time, you essentially lose that feature on your phone. The best solution I've found is to just go into the Google Dialer app and set the o…

Just checked on my Samsung phone and there is a setting 'Caller ID and spam protection' apparently backed by Hiya.

Re: Voice Phishing Scams Are Getting More Clever

#169

Post by GangcaiLin »

gerdesj wrote: post #118
wlesieutre wrote: post #107

Earlier quoted context omitted.

It's not quite "Just like email" because email has systems in place to authenticate this, while phone systems do not. https://en.wikipedia.org/wiki/DMARC

Have you ever tried to implement DMARC? DKIM and SPF are OK but DMARC breaks mail lists. Yes there are ways to mitigate but it might not be worth it unless you also do DNSSEC as well. Well actually I believe that every little helps and use every weapon available. I do think that the analogy works really well. PBXs can have quite a few weapons of their own to attempt to authenticate callers. For example you can pass "…

There is a new standard called Authenticated Received Chain (ARC) designed specifically to address the DMARC authentication failure issue caused by mailing lists. Basically what ARC does is to preserve SPF/DKIM authentication results, and use them to override DMARC authentication result when deemed appropriate. There is a Quora post here for a more detailed explanation: https://www.quora.com/What-is-Authenticated-Received-Chain-A....

Re: Voice Phishing Scams Are Getting More Clever

#170

Post by Kalium »

King-Aaron wrote: post #163

Can anyone offer any insight into the latest series of odd phone calls I've been noticing, where you get either a private number or an out-of-state number call you, and then sit in silence until you utter a word in which it hangs up at that moment? I've experienced a few so far over the previous months. I've even experimented by not saying anything for an extended time - up to about 30 seconds of silence (and then it…

https://www.theregister.co.uk/2011/10/06/termination_bypass/

Probably something like this.

Post reply on HN