Ian Lamont writes "Remember the report last year that the FBI was concerned about a 'vishing' exploit relating to the Asterisk IP PBX software? Digium played down the report, noting that it was based on a bug that had already been patched, but now the company's open-source community director says that attacks on Asterisk installations are 'endemic.' There have been dozens of reported vishing attacks in recent weeks, says the article: 'The victims typically bank with smaller regional institutions, which typically have fewer resources to detect scams. Scammers hack into phone systems and then call victims, playing prerecorded messages that say there has been a billing error or warn them that the bank account has been suspended because of suspicious activity. If the worried customer enters his account number and ATM password, the bad guys use that information to make fake debit cards and empty their victim's bank accounts.'"
What is that, voice phishing? What's next, we're going to call telemarketers "vammers"? And we'll call phreakers "vackers"?
I'm sure we could come up with a better term than "vishing".
If the alternative is phreashing and phreammers, then I'll prefer "vishing". That said, I doubt most cases are using an actual "bug" in Asterisk, it is much more likely there are different setups, were some are incorrectly setup to handle _one_ of the many combinations of diversion, refer, redirection, route, proxy, RFC and draft SIP features that Asterisk "supports".
Yeah, "Phishing" still seems to apply as an appropriate term to describe social engineering attempts by email, which is already a pretty specialized term, where "email fraud" would have worked just as well to start with (since it is closely related to an existing term "mail fraud" which indicates the snail mail version of the same attempt). As usual, a term was invented to describe something that is harder for the layman to understand than the original term. Hey, we're geeks, new confusing terms are cool, so deal. 1337 n3w w0rdz0rz ru1z!
A phisher is still sending someone an email and asking them to take a specific action that, if you take it, will result in you giving up important information to someone wearing a black hat. We don't need separate terms to describe every possible nuance of the way you would potentially send the information back. If someone sends me an email with form they want me to fill out and mail, do I have to call that mhishing? And what if they want me to fax it? fhishing? What if they simply want me to reply to them with some information? rhishing?
What if you get an email that gives a bad link *AND* a scammer's phone number? pvhishing? Or does the order of the "p" and "v" depend on which appears in the email fraud attempt first, so it could be pvishing or vphishing? And do I read that right-to-left or top-to-bottom to determine "first"?
Is there a 3-week class on this new terminology, or a 12-step program to get people to stop using it?
But as natehoy pointed out in his original post, is it really necessary to coin a new term -- or even a new combination of existing terms -- for every possible permutation of communication media that scammers seek to exploit? How about just saying a scammer is a scammer is a scammer, whether (s)he is using e-mail, snail mail, voice mail, fax, or smoke signal?
IMHO, "FBI warns of scam exploiting Asterisk PBX software" is far more meaningful to more people than "FBI warns of vishing attack e
From a link [computerworld.com] from TFS:
"Vishing is much like phishing, but instead of urging e-mail recipients to click on a link (to a bogus website) this message instructs the reader to call a telephone number to rectify a problem with your account."
What's next, we're going to call telemarketers "vammers"? And we'll call phreakers "vackers"?
How about varmints [merriam-webster.com] and pharmints?
Telemarketers don't deserve a new word, especially when an existing one fits so well. Phreakers at least are exhibiting some level of skill, even if it is in a somewhat antisocial manner (so I assume, at least).
I always hang up as soon as I recognize them for what they are. On the rare occasions when someone who actually has something to say that I need to hear tries to use one they always follow up with a real phone call or a letter.
I was getting a recorded message from a spoofed cid at 000-000-0000 and would always kill the call as I saw it come in. Turns out it was the my gas company trying to resolve some billing issues.
A note to all "legit" businesses out there, blocked numbers and especially spoofed cids are super sketchy, don't do it.
I actually think I got one of these calls sometime last week. The recording left a message and is still in my box, well half of it. Apparently their dialer script doesn't have that great of, if any, PAMD. The audio is what sounds like a native English speaker, speaking very fast but sometimes stumbling, likely reading from a written script asking for account numbers and ATM codes. I immediately knew it was a scam but I am sure others receiving the call might have not have been so lucky to recognize that.
The problem is nobody should *ever* fall for this, no matter how good the caller sounds.
Someone phones you. CLID can be faked. Can't trust that. Unless they have some way of authenticating themselves to you treat them as unknown. That phone call contains another number. Ignore it. Go to the website of your bank, find a published customer service number and ask them.
It's exactly the same as anyone with any sense has been doing for years.. telephone scams aren't new. Now if the bank's calling system is c
> Now if the bank's calling system is compromised..
My credit union has a branch six miles away and head offices at about 25 miles. If I ever get something purports to be a recorded call from them I won't be contacting them by phone.
The solution to phone spammers is - oh the irony - to use more asterisk. With a little creativity [voiptechchat.com] you can keep telemarketers busy without even picking up the phone.
If you RTFA, it's not referring to the actual banks PBX getting hijacked. Regardless, yes there appears to have been an exploit due to a bug and should be fixed now, but the many businesses that use Asterisk and haven't applied patches are those affected.
Which to me is the scarier part, as SMBs have fatter pipes which when compromised can send tons of spam, vishing, etc. As someone who works on plenty of SMBs you'd be amazed at what some of these places are running, we are talking Win2K and sometimes even Win98 machines, most haven't seen a patch since they left the factory, because some PHB is worried about downtime, meanwhile they are wondering "why the network is so slow". Yikes.
You work PC repair for any length of time and the amount of total stupidit
Don't give sensitive information away unless in person. If you bank says there's something wrong with your account, either call them via their listed phone number or go visit them in person.
Exactly! The same tactic that defeats Phishing emails also works for Vishing or any other type of social engineering in the direction of the company to the consumer. It however doesn't fix the problem of when the customer (or someone pretending to be them) calls the company.
Most of the security problems I've seen actually exploited are not a problem with asterisk as such, or even border control, but of retarded admins. For example, many IP phones expect to connect to a fileserver of some sort and download some xml files containing their SIP information. Admins will routinely just create an ftp account somewhere, using the default login and password of the phones, and dump the files there. They'll frequently allow that ftp user to have shell access too, or forget to disable directory listing on the ftp directory, or do anything else that resembles common sense and security.
It would be trivial to portscan far and wide, find some asterisk boxes, and exploit these terribly common mistakes made by clueless admins. I have demonstrated to clients how I was able to log into their server armed only with the knowledge of what the default ftp username and password is, then download all their users' config files containing all the information I'd need to fraudulently use their phone lines. Sometimes it takes a dramatic demonstration like that to make people wake up.
I remember you...you were that guy that spammed the asterisk bug tracker saying that people should switch to FreeSWITCH on about 10 different bugs. Nice to see that some things never change.
No, I was just annoyed at your impolite behavior at the time with all of the spamming. Then I noticed this story and saw that you are still at it. I'm glad you found a solution that works for you. Many people have also found other solutions that work great for them, including Asterisk.
Part of having such a huge user community is that the Asterisk devs have 100s of feature requests or bug reports at any given time. If someone is having a problem that is only having an effect on a very small number of people, sometimes it takes longer to fix than other problems. Everyone has to prioritize.
Also, the quality of the debugging information that is presented is also a major factor in how long it takes to get a problem fixed. This [asterisk.org] is a good example of 3 or 4 actual Asterisk developers trying work on one of your issues and you being rude to them and not giving them the debug information they requested.
I understand that having an issue that is affecting you take a while to get closed is annoying, but something being open for a week with no real information provided to help track it down is certainly no reason to get react the way you did.
And us Asterisk users aren't pissed about FreeSWITCH existing--that is just silly. The more choices out there, the better! We just don't like people coming over and shouting YOU SUCK and doing the equivalent of spray painting our walls with "FreeSWITCH RULEZ!" like you did with the bug tracker. That is just childish. There are many excellent and polite freeswitch users and developers--I just don't think that you are one of them.
I've used Asterisk in installations with 10s of thousands of users--and this was probably 4 years ago or so. It certainly wasn't initially designed for it--but it will most certainly do the job if you are willing to put in the work. And it is light years ahead of where it was when I was using it for carrier-grade operations.
Don't get me wrong, there are certainly things that need improvement--especially in the area of being able to do live migrations and failover w/o dropping calls, but there are some trul
True enough about the admin fail.. But it sucks as a developer to work with software like that. I have to be both the admin and the developer for a small asterisk IVR, and it's really frustrating to have to dick with all the permissions just to get started coding. It should come relatively secure by default, in a repo with a reasonable update schedule. Don't get me wrong, Asterisk is a great tool, but there's definately times when I get that "duct tape and shoe string" impression when I'm coding apps for it.
So as is unfortunately typical, some of the quotes I made of course been taken out of proportion. My quote was not that "Asterisk attacks are endemic", but that SIP-based brute force attacks are endemic. Every SIP system that is open to the "public" Internet is seeing large numbers of brute-force attacks. Sites that have weak username and weak password control will be compromised - this is little different than email accounts being taken over by password-guessing systems and used for sending floods of email. The significant difference is that when someone takes over a SIP platform to make outbound calls, there is usually a direct monetary cost, which gets people's attention very quickly. I hear reports of these types of attacks now all the time - it's not unusual, and it's not just Asterisk. We had a blog about this a year ago; this is just a re-packaging of the same news a year later, when recently I unsurprisingly said that attacks are no longer even newsworthy because they're so frequent (hence, the term "endemic".) Apparently, not being newsworthy means... it's newsworthy!
This has little to do with Asterisk other than it happens to be the most prevalent SIP-based platform on the Internet currently. It has everything to do with protocol attacks by script kiddies, or more professional attackers. Bad passwords = easy penetration. The upside on this is that it yet again gets the attention of administrators who might not otherwise know that their password of '1234' might be guessed by criminal users.
The bug that was mentioned? Old news. Really, really old news. And really not even that much of a threat for most people the way they have their systems configured even if they haven't upgraded.
Asterisk, Broadsoft, Cisco, Kamailio, OpenSER, FreeSwitch, Avaya - they're all vulnerable to the brute force attacks if adequate network and username/password security is not implemented. There are ways to minimize, if not eliminate these threats with very standard security policies that should be familiar to any network administrator (ACLs, random passphrases, random client usernames, adequate exception logging, and limits on account usage, to name a few.)
Just as an aside, the Digium SwitchVox platform, which is our commercial re-packaging of Asterisk, has as an element of it's GUI a tool that indicates the relative strength of passwords. We'd encourage any other re-packagers or users of Asterisk to implement a similar UI hint that forces good password behavior by users and local admins. It's really not something that can be done in the core of Asterisk; it has to be done by whatever is the layered UI on top of Asterisk for configuration, or just by good policy.
John, one of the ways I got people to use "good" passwords is by getting them a Yubikey [yubico.com] and setting it to static mode. It then always generates the same password instead of an OTP, but it's a very long one and as it pretends to be a keyboard it types it in itself. The challenge is always to make it long enough to be safe, but short enough to actually fit in the entry field.
It is a simple way to both SET a decent password and to preserve that setting in other than a file..
Just using FreeSWITCH is not a security solution. It isn't like Asterisk is designed to route toll calls for all callers as a default or something. Software has bugs. Some bugs are security problems. Make sure you apply security updates ASAP. Asterisk even has a mailing list specifically for security updates which makes it super simple to know when you really need to apply a patch.
I do believe that is in fact what mercutioviz was saying. First pick a better tool, then make sure that tool is in proper configuration and working order. There are just somethings that FS is designed to do differently that make it easier implement good security practices. One example is having one SIP profile (UA) for one IP:port combination. I can have multiple SIP UA's with various levels of security bound to various different dialplan contexts all at the same time. There's none of 1 IP 1 port or al
Vishing? (Score:4, Insightful)
What is that, voice phishing? What's next, we're going to call telemarketers "vammers"? And we'll call phreakers "vackers"?
I'm sure we could come up with a better term than "vishing".
Re: (Score:3, Funny)
I'm sure we could come up with a better term than "vishing".
Like voice phishing? ;)
Phone Phishing (Score:3, Insightful)
Re:Vishing? (Score:4, Insightful)
If the alternative is phreashing and phreammers, then I'll prefer "vishing". That said, I doubt most cases are using an actual "bug" in Asterisk, it is much more likely there are different setups, were some are incorrectly setup to handle _one_ of the many combinations of diversion, refer, redirection, route, proxy, RFC and draft SIP features that Asterisk "supports".
Parent
Re:Vishing? (Score:4, Insightful)
Yeah, "Phishing" still seems to apply as an appropriate term to describe social engineering attempts by email, which is already a pretty specialized term, where "email fraud" would have worked just as well to start with (since it is closely related to an existing term "mail fraud" which indicates the snail mail version of the same attempt). As usual, a term was invented to describe something that is harder for the layman to understand than the original term. Hey, we're geeks, new confusing terms are cool, so deal. 1337 n3w w0rdz0rz ru1z!
A phisher is still sending someone an email and asking them to take a specific action that, if you take it, will result in you giving up important information to someone wearing a black hat. We don't need separate terms to describe every possible nuance of the way you would potentially send the information back. If someone sends me an email with form they want me to fill out and mail, do I have to call that mhishing? And what if they want me to fax it? fhishing? What if they simply want me to reply to them with some information? rhishing?
What if you get an email that gives a bad link *AND* a scammer's phone number? pvhishing? Or does the order of the "p" and "v" depend on which appears in the email fraud attempt first, so it could be pvishing or vphishing? And do I read that right-to-left or top-to-bottom to determine "first"?
Is there a 3-week class on this new terminology, or a 12-step program to get people to stop using it?
Parent
Re: (Score:2)
Never mind, I did read, but failed to comprehend, the article. Stupid me.
Anyway, I still don't think we need a new term. In fact, I think we already have one. "Telephone fraud".
Re: (Score:3, Insightful)
But all 9 syllables refer to concepts already stored in my brain. "Code Re-use"!
Re: (Score:2)
IMHO, "FBI warns of scam exploiting Asterisk PBX software" is far more meaningful to more people than "FBI warns of vishing attack e
Re: (Score:2)
I agree - "vishing" is a stupid term.
Re:Vishing? (Score:4, Funny)
Parent
Re: (Score:2)
Nah, following the "vishing" substitution logic, I come up with telemarketing spammers = tammers and phreaker hackers would be phackers.
Re: (Score:2)
And if a phacker tried to spam a woman with kids, he'd be known as a mother phacker?
Re: (Score:2)
Re: (Score:3, Funny)
What's next, we're going to call telemarketers "vammers"? And we'll call phreakers "vackers"?
How about varmints [merriam-webster.com] and pharmints?
Telemarketers don't deserve a new word, especially when an existing one fits so well. Phreakers at least are exhibiting some level of skill, even if it is in a somewhat antisocial manner (so I assume, at least).
Re: (Score:2)
Re: (Score:3, Informative)
vishing is what Dracula does on his holidays.
Re: (Score:2)
I second this sentiment. Let's reserve "Vishing" for people pretending to be Vishnu [wikipedia.org].
Re: (Score:3, Funny)
"Vishing" is what it is called when Vishnu [wikipedia.org] goes fishing [wikipedia.org].
_All_ prerecorded calls are spam. (Score:2)
I always hang up as soon as I recognize them for what they are. On the rare occasions when someone who actually has something to say that I need to hear tries to use one they always follow up with a real phone call or a letter.
Re:_All_ prerecorded calls are spam. (Score:5, Informative)
I was getting a recorded message from a spoofed cid at 000-000-0000 and would always kill the call as I saw it come in. Turns out it was the my gas company trying to resolve some billing issues.
A note to all "legit" businesses out there, blocked numbers and especially spoofed cids are super sketchy, don't do it.
Parent
Re: (Score:2)
Re: (Score:2)
The problem is nobody should *ever* fall for this, no matter how good the caller sounds.
Someone phones you. CLID can be faked. Can't trust that. Unless they have some way of authenticating themselves to you treat them as unknown.
That phone call contains another number. Ignore it. Go to the website of your bank, find a published customer service number and ask them.
It's exactly the same as anyone with any sense has been doing for years.. telephone scams aren't new. Now if the bank's calling system is c
Re: (Score:2)
> Now if the bank's calling system is compromised..
My credit union has a branch six miles away and head offices at about 25 miles. If I ever get something purports to be a recorded call from them I won't be contacting them by phone.
Re: (Score:2, Informative)
Vishing (Score:3, Informative)
http://en.wikipedia.org/wiki/Vishing [wikipedia.org]
Either that or it's an old world ethnic pronunciation of the word "wishing".
Security! (Score:2)
Security patches are there for a reason. Security.
Re: (Score:2)
Re: (Score:3, Informative)
Which to me is the scarier part, as SMBs have fatter pipes which when compromised can send tons of spam, vishing, etc. As someone who works on plenty of SMBs you'd be amazed at what some of these places are running, we are talking Win2K and sometimes even Win98 machines, most haven't seen a patch since they left the factory, because some PHB is worried about downtime, meanwhile they are wondering "why the network is so slow". Yikes.
You work PC repair for any length of time and the amount of total stupidit
Moral of the story (Score:5, Insightful)
Don't give sensitive information away unless in person. If you bank says there's something wrong with your account, either call them via their listed phone number or go visit them in person.
Re: (Score:3, Informative)
You go to your bank, your bank doesn't come to you.
Re: (Score:2)
Re: (Score:2)
> It however doesn't fix the problem of when the customer (or someone
> pretending to be them) calls the company.
That, however, places the liability on the company.
Fishing, phishing, vishing, what's next? (Score:5, Funny)
Re: (Score:2)
We need a "Funny AND Insightful" mod that goes to 6 so there's a little extra when you need it.
Because, for the post I am replying to, we need it.
I got one of those calls. (Score:2, Interesting)
Re:I got one of those calls. (Score:5, Funny)
If you're like me (and most of Slashdot), you don't need to call the FBI at all. Just look straight into the webcam and tell them what the problem is.
Don't believe the naysayers that tell you that government is inefficient.
Parent
Complete crap (Score:4, Insightful)
What a load of crap. Asterisk developers patch security holes relatively quickly. This isn't an Asterisk "endemic."
Brute forced passwords are a bad administrator "endemic."
If your password policy is so stupid that you can be wordlisted then the issue may just be a PICNIC problem and not a fault of an application.
Asterisk isn't a security application. It's an enterprise-grade VoIP server and PBX.
Connecting Asterisk to a public network without some sort of border control is just stupid.
Re:Complete crap (Score:4, Insightful)
It would be trivial to portscan far and wide, find some asterisk boxes, and exploit these terribly common mistakes made by clueless admins. I have demonstrated to clients how I was able to log into their server armed only with the knowledge of what the default ftp username and password is, then download all their users' config files containing all the information I'd need to fraudulently use their phone lines. Sometimes it takes a dramatic demonstration like that to make people wake up.
Parent
Re: (Score:3, Interesting)
I remember you...you were that guy that spammed the asterisk bug tracker saying that people should switch to FreeSWITCH on about 10 different bugs. Nice to see that some things never change.
[OT] Re:Complete crap (Score:4, Insightful)
No, I was just annoyed at your impolite behavior at the time with all of the spamming. Then I noticed this story and saw that you are still at it. I'm glad you found a solution that works for you. Many people have also found other solutions that work great for them, including Asterisk.
Part of having such a huge user community is that the Asterisk devs have 100s of feature requests or bug reports at any given time. If someone is having a problem that is only having an effect on a very small number of people, sometimes it takes longer to fix than other problems. Everyone has to prioritize.
Also, the quality of the debugging information that is presented is also a major factor in how long it takes to get a problem fixed. This [asterisk.org] is a good example of 3 or 4 actual Asterisk developers trying work on one of your issues and you being rude to them and not giving them the debug information they requested.
I understand that having an issue that is affecting you take a while to get closed is annoying, but something being open for a week with no real information provided to help track it down is certainly no reason to get react the way you did.
And us Asterisk users aren't pissed about FreeSWITCH existing--that is just silly. The more choices out there, the better! We just don't like people coming over and shouting YOU SUCK and doing the equivalent of spray painting our walls with "FreeSWITCH RULEZ!" like you did with the bug tracker. That is just childish. There are many excellent and polite freeswitch users and developers--I just don't think that you are one of them.
Parent
Re: (Score:3, Interesting)
I've used Asterisk in installations with 10s of thousands of users--and this was probably 4 years ago or so. It certainly wasn't initially designed for it--but it will most certainly do the job if you are willing to put in the work. And it is light years ahead of where it was when I was using it for carrier-grade operations.
Don't get me wrong, there are certainly things that need improvement--especially in the area of being able to do live migrations and failover w/o dropping calls, but there are some trul
Re:Complete crap (Score:5, Interesting)
Parent
undoing moderation (Score:2, Funny)
Digium says: Protocol, not program (Score:3, Informative)
So as is unfortunately typical, some of the quotes I made of course been taken out of proportion. My quote was not that "Asterisk attacks are endemic", but that SIP-based brute force attacks are endemic. Every SIP system that is open to the "public" Internet is seeing large numbers of brute-force attacks. Sites that have weak username and weak password control will be compromised - this is little different than email accounts being taken over by password-guessing systems and used for sending floods of email. The significant difference is that when someone takes over a SIP platform to make outbound calls, there is usually a direct monetary cost, which gets people's attention very quickly. I hear reports of these types of attacks now all the time - it's not unusual, and it's not just Asterisk. We had a blog about this a year ago; this is just a re-packaging of the same news a year later, when recently I unsurprisingly said that attacks are no longer even newsworthy because they're so frequent (hence, the term "endemic".) Apparently, not being newsworthy means... it's newsworthy!
This has little to do with Asterisk other than it happens to be the most prevalent SIP-based platform on the Internet currently. It has everything to do with protocol attacks by script kiddies, or more professional attackers. Bad passwords = easy penetration. The upside on this is that it yet again gets the attention of administrators who might not otherwise know that their password of '1234' might be guessed by criminal users.
The bug that was mentioned? Old news. Really, really old news. And really not even that much of a threat for most people the way they have their systems configured even if they haven't upgraded.
Asterisk, Broadsoft, Cisco, Kamailio, OpenSER, FreeSwitch, Avaya - they're all vulnerable to the brute force attacks if adequate network and username/password security is not implemented. There are ways to minimize, if not eliminate these threats with very standard security policies that should be familiar to any network administrator (ACLs, random passphrases, random client usernames, adequate exception logging, and limits on account usage, to name a few.)
Just as an aside, the Digium SwitchVox platform, which is our commercial re-packaging of Asterisk, has as an element of it's GUI a tool that indicates the relative strength of passwords. We'd encourage any other re-packagers or users of Asterisk to implement a similar UI hint that forces good password behavior by users and local admins. It's really not something that can be done in the core of Asterisk; it has to be done by whatever is the layered UI on top of Asterisk for configuration, or just by good policy.
http://blogs.digium.com/2009/03/28/sip-security/ [digium.com]
http://blogs.digium.com/2008/12/06/sip-security-and-asterisk/ [digium.com]
John Todd - jtodd@digium.com
Digium, Inc.
Asterisk Open Source Community Director
Re: (Score:3, Interesting)
John, one of the ways I got people to use "good" passwords is by getting them a Yubikey [yubico.com] and setting it to static mode. It then always generates the same password instead of an OTP, but it's a very long one and as it pretends to be a keyboard it types it in itself. The challenge is always to make it long enough to be safe, but short enough to actually fit in the entry field.
It is a simple way to both SET a decent password and to preserve that setting in other than a file..
Just a tip, and no, I don't work f
Vishing and hoping (Score:3, Funny)
'Vishing', eh? Vot are we going to call 'video phishing'?
Pishing?
Re: (Score:2)
This just in: Home cooking is killing McDonalds.
Re: (Score:2)
Just using FreeSWITCH is not a security solution. It isn't like Asterisk is designed to route toll calls for all callers as a default or something. Software has bugs. Some bugs are security problems. Make sure you apply security updates ASAP. Asterisk even has a mailing list specifically for security updates which makes it super simple to know when you really need to apply a patch.
Re: (Score:2)
Re: (Score:2, Funny)