Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

International Revenue Share Fraud (IRSF)

knock-knock.net

Post reply on HN
Print view View original

11–20 of 24 posts

Re: International Revenue Share Fraud (IRSF)

#11

Post by djkurlander »

richwater wrote: post #5

This is quite the claim (and I'm not saying you are wrong from making it). I just would have expected some of these institutions to be better.

Yes - I would have expected better from these institutions as well, but there's always going to be someone who brings their rogue laptop onto the corporate net. The key is how fast the security catches it. They can use the api that I describe in the blog to check my honeypot for their IPs. Very simple to put into a daily or hourly script.

Re: International Revenue Share Fraud (IRSF)

#12

Post by djkurlander »

saaaaaam wrote: post #9
djkurlander wrote: post #2

[flagged]

"Coordinated attack" might raise more than eyebrows with the legal departments of the companies you've called out. >Over the next 27 hours, in four distinct waves, all of them tried to use my VoIP (SIP) server to place phone calls on my dime. As you've clarified in your comment here the companies did not do this. Compromised machines on their networks, controlled by third parties did it.

The actual blog post clarifies this as well. But still in some sense these organizations share some level of responsibility if it is their machines, attacking from their ASN.

Re: International Revenue Share Fraud (IRSF)

#13

Post by djkurlander »

sciencejerk wrote: post #10

Thanks for sharing your interesting research! Can you explain your honeypotting approach further? How are you "presenting" as a SIP relay? What other honeypots or protocols can you detect?

I set up servers on the net that masquerade as a SIP relay by essentially supporting the protocol but with few authentication protections. Malware bots scan the IPv4 space looking for such machines that they can use as a relay. My honeypot is actually an extensible framework, and we also can mimic SSH, Telnet, HTTP, SMB, FTP, RDP, SMTP, MQTT, Node-Red, MODB, S7, and SNMP. Individual servers can easily be set up to scan any subset of those. Check out https://knock-knock.net to get a visual sense of what the honeypot is doing!

Re: International Revenue Share Fraud (IRSF)

#14

Post by saaaaaam »

djkurlander wrote: post #12
saaaaaam wrote: post #9

Earlier quoted context omitted.

"Coordinated attack" might raise more than eyebrows with the legal departments of the companies you've called out. >Over the next 27 hours, in four distinct waves, all of them tried to use my VoIP (SIP) server to place phone calls on my dime. As you've clarified in your comment here the companies did not do this. Compromised machines on their networks, controlled by third parties did it.

The actual blog post clarifies this as well. But still in some sense these organizations share some level of responsibility if it is their machines, attacking from their ASN.

Did you use AI to write the blog post?

Re: International Revenue Share Fraud (IRSF)

#16

Post by djkurlander »

saaaaaam wrote: post #14
djkurlander wrote: post #12

Earlier quoted context omitted.

The actual blog post clarifies this as well. But still in some sense these organizations share some level of responsibility if it is their machines, attacking from their ASN.

Did you use AI to write the blog post?

Wrote the blog post myself, and used AI to clear up typos and occasionally improve wording. I have a PhD in computer science, but I was initially planning to pursue journalism instead, so I like to think that I can write good :-).

Re: International Revenue Share Fraud (IRSF)

#17

Post by djkurlander »

Tiberium wrote: post #6
djkurlander wrote: post #2

[flagged]

A question: why are you writing this with an LLM? Can you not write with your own words, at least on HN?

As mentioned above, wrote the blog post myself and had AI proofread and edit. As for the honeypot itself, I'm a greybeard computer scientist, and I architected the system very deliberately myself, using AI as a coding accelerator. Earlier in my career, moving from Assembly to C, I certainly appreciated the convenience of a higher level language. Same from C to C++ to Java/Lisp/Python to LLM. It's always a march to higher level languages and letting the computer do more work.
Post reply on HN