Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Voice Phishing Scams Are Getting More Clever

krebsonsecurity.com

Post reply on HN
Print view View original

191–200 of 226 posts

Re: Voice Phishing Scams Are Getting More Clever

#191

Post by paulie_a »

walrus01 wrote: post #162
zrm wrote: post #160

Earlier quoted context omitted.

> The problem with SS7 is that you extend your SMTP analogy, there is no way to implement the equivalent of SPF, DKIM and DMARC for verification of incoming traffic without breaking SS7-to-SS7 links between the vast majority of installed phone switching gear out there on the PSTN. Why not? That's how it was done for email. SPF doesn't prevent interoperability for sending domains that don't use it or recipients that d…

Because it's a huge installed base of non-upgradeable equipment that is 15, 20, 25 years old. People doing oldschool SS7 telco stuff are just not going to upgrade. They'll sue their upstream carriers if they suddenly cut them off because their new re-implementation of SS7 is incompatible with their old gear. I'm a senior network engineer for a mid sized regional ISP, and encounter this shit on a fairly regular basis.…

Cut them off unless they upgrade, their upstream probably has that option in the agreement anyways. Ptsn should just die. The technicians and customer service are so incompetent that every day I had to call to get a line disabled at the switch because it got re-enabled. After a hundred days in a row I finally just shorted the damn line and problem solved.

Re: Voice Phishing Scams Are Getting More Clever

#192

Post by tomhoward »

rustcharm wrote: post #95
saudioger wrote: post #18

This is why I don't answer the phone unless it's a contact. Everyone else can leave a message.

Did you read the article? The Many people have their bank or credit union in the contacts. This won't help if they're spoofing a bank number. > Cabel Sasser is founder of a Mac and iOS software company called Panic Inc. Sasser said he almost got scammed recently after receiving a call that appeared to be the same number as the one displayed on the back of his Wells Fargo ATM card.

FYI it's against the guidelines to suggest a commenter hasn't read the article. You can make the same point without being insulting or presumptuous in that way.

Re: Voice Phishing Scams Are Getting More Clever

#193

Post by jameshart »

aero142 wrote: post #21
jerf wrote: post #7

I'll give you the flip side of the scammer's deterioration of trust in the phone... a few months back I got a phone call from what appeared to be my bank, and they were asking me about a fraudulent charge that I didn't recognize. Worried that this was the beginning of a scam, I delayed a bit on the phone while I logged in independently to my bank account... and lo, yes, indeed, there was a fraudulent charge to my acc…

It makes me laugh when my banks fraud department calls me and then asks me to verify myself to them by giving personal information before asking me questions. I usually laugh at them and tell them they they are the unverified party in this phone call, not me. I always pull up the website and confirm before telling them anything.

Had a fantastic example of this recently. I called my bank, for some reason they weren't able to connect me to the department I needed immediately, so I arranged to have them call me back when they were able to reach them. Little later, as expected, the bank call me back - same person I spoke to earlier, so I'm satisfied that it's the bank. She routes my call through to the department we needed to reach. That's where things get surreal, because that department isn't set up to have an outgoing call routed to them, so they decide they need to authenticate me.

The method they choose to do that, though, is to ask me for a phone number to which they can send an authentication code. I give them the phone number I'm using - the one they called me on. They ask if I want a text or a voice call. Tempting though it would be to put them on hold while I accept the voice call with the security code, I opt for the text message. Phone buzzes, I read out the number, and they seem happy with the result.

I really hope that when they asked me for a phone number they verified it against a list of known numbers associated with the account, but... it really wasn't clear in the context of the interaction.

Re: Voice Phishing Scams Are Getting More Clever

#194

Post by prebrov »

walrus01 wrote: post #50
phkahler wrote: post #23

The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable. Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a…

There is no way to fix the ability to spoof caller ID with the way SS7 is built. Not without breaking functionality to something like 85% of the installed base of PBX and phone switch equipment, most of which is anywhere from 10 to 45 years old. The legacy telco SS7 phone system needs to be burnt to the ground and rebuilt, but it never will be, because people have moved on to friend-opt-in based message platforms lik…

Compelling telcos to do that is the regulator's job.

Not sure about the US, but in most of the rest of the world regulators come up with new rules and regulations requiring some form of network upgrade all the time – SLAs, connectivity and routing requirements, legal interception, data residency, etc.

And telcos have no other way but to spend billions to protect some monopoly or enable more surveillance power for the governments. It's a matter of priorities, really.

Re: Voice Phishing Scams Are Getting More Clever

#196

Post by xtreme »

nickysielicki wrote: post #127
emptybits wrote: post #80

Earlier quoted context omitted.

> I went into my contacts and changed the ringtone associated with them to be one that makes noise. That gets the job done, but rather than modify each of your existing contacts (and each new one), consider just turning on Do No Disturb and setting your Do Not Disturb level to "Allow Calls From All Contacts" (or a particular Group or Favorites). These are iOS options but I assume there's an equivalent in Android.

On my particular Android phone (Pixel) this is not a great solution because setting Do Not Disturb alters the behavior of other things like Calendar reminders or email alerts. You could make DND not do that, but sometimes I do want to mute other things. If you're using DND all the time, you essentially lose that feature on your phone. The best solution I've found is to just go into the Google Dialer app and set the o…

A great improvement to that would be an option to silently reject all suspected spam calls and send them to the voicemail. This has been suggested many times on Google's product feedback and suggestion boards but for some reason they have not gotten around to doing it. The hard part of detecting spam calls is already there; all it should take is adding a couple of new check boxes.

Re: Voice Phishing Scams Are Getting More Clever

#197

Post by rb666 »

CodeCube wrote: post #25

This is 100% destroying the phone for younger generations ... my kids answer nothing, not even my own phone calls because they set their phones on do not disturb to curb the endless robo, scam, and cold calls. If it wasn't for https://hiya.com/ , I'd be at the end of my wits. Seems like the number of fake calls has ramped up exponentially in the last months. I finally just set it up completely block all telemarketing…

Another typical problem with the American system of deregulating everything and anything. In Europe (at least the parts I know) this is never an issue.

Re: Voice Phishing Scams Are Getting More Clever

#198

Post by nanomonkey »

socialist_coder wrote: post #182
nanomonkey wrote: post #173

Most robo-callers feel like Phishing scams. I've been contemplating giving up my cellphone and just using a Calyx mobile data ( https://www.calyxinstitute.org ) and use Signal, email and Mumble only. Anyone else do something like this successfully?

I did it for 6 years when I lived in Germany. I had a data only sim card and a google voice US phone number. Verdict: It's not doable if you want it to work 100%. And in the US I would say it's not doable at all because Android/dumbphone users are still using SMS instead of a messenger app like Whatsapp, so you have no way of communicating with them at all. The biggest problem for me was online services that want to…

Thanks!

I'm not concerned about Whatsapp, and I figured I use Twilio for text messages. Out of service phones can still call emergency services, 911. My main concern is being "that guy" who everyone has to make exceptions for when contacting.

Re: Voice Phishing Scams Are Getting More Clever

#199

Post by voltagex_ »

reaperducer wrote: post #51
fitzroy wrote: post #36

Earlier quoted context omitted.

Also, for anyone that doesn't know: you can request an old school ATM card (not a debit card, i.e. no MC/Visa logo) from your bank and use a credit card for purchases instead. This reduces the exposure of a critical account. And if you do become a victim of fraudulent charges, you don't have to worry about your bank account being drained immediately (possibly resulting in overdrafts, etc).

Card skimming has become so rampant where I live that I don't ever put a bank or credit card in a gas pump. I got a gas company card (non-Visa/MC) with a super-low limit, and when I need to buy gas I make a payment online with my phone, then pump away knowing if it got skimmed, the perps would probably throw the info out because it's not usable anywhere else, and even if they used it at the gas station, they'd only g…

How quick does the payment from your phone go through? Australia's only just implemented fast cross-bank transfers (PayID) but the implementation compromised privacy and only works in some circumstances.

Re: Voice Phishing Scams Are Getting More Clever

#200

Post by reaperducer »

voltagex_ wrote: post #199
reaperducer wrote: post #51

Earlier quoted context omitted.

Card skimming has become so rampant where I live that I don't ever put a bank or credit card in a gas pump. I got a gas company card (non-Visa/MC) with a super-low limit, and when I need to buy gas I make a payment online with my phone, then pump away knowing if it got skimmed, the perps would probably throw the info out because it's not usable anywhere else, and even if they used it at the gas station, they'd only g…

How quick does the payment from your phone go through? Australia's only just implemented fast cross-bank transfers (PayID) but the implementation compromised privacy and only works in some circumstances.

It’s not cross bank. But because I have a history of paying the gas card from a particular checking account, I get credited for it instantly.
Post reply on HN