Home › Blogs › ben's blog

VOIP phoneynet : PART 3 "WHAT WOULD CROOKS DO WITH A COMPROMISED VOIP GATEWAY ANYWAY?"

6 December 2009 - 12:55am — ben

There are quite a few ways that a criminal can make use of a compromised VOIP server. Its important to realize that the criminal mind is very imaginative, and there will be many motives and scams that we have not even imagined yet, much less experienced.
When looking at these types of questions, I think it helps to have the notion of motive in the back of your mind. This may sound obvious, but I find this helps answer the question 'what would a person or group with this motivation want with a compromised VOIP system?'.

Here are some potential motives. While I won't go into every possible scenario, it's really not hard to imagine that the full control of target's phone system would be handy for people with any of these motives.

  • Financial gain
  • Political
  • Religious
  • Reputation and ego of the hacker
  • Intellectual Property theft, Trade Secrets
  • Espionage
  • Retribution, commercial or personal
  • Vandalist, miscreant activity (bored youth..)

    • I got some great local and international feedback on incidents from readers of Part 1 and Part 2 of this blog series (Thank you everyone). Most of these incidents seem to fall into the 'Financial gain' motive group, so I'll give two examples of a common attacks which are currently seen in AU and overseas, and a possible future threat.

    Cheap overseas calls / calling cards.
    One of the most common uses for hacked VOIP servers is to simply make unauthorized calls, and there have been incidents of hacked VOIP servers being used in relation to calling card scams to do just this. This is not to say that all cheap calling cards operations are scams, most I'm sure are legitimate.
    Here is a brief overview of a simple version of the scam:

  • The crook controls a hacked VOIP system in (say) Australia. This means that they can accept and redirect calls, and essentially control every aspect of that phone system.
  • The crook sells 'calling cards' to citizens of another country that live in, or are visiting Australia. The card allows them to call home at ridiculously cheap rates, a tiny fraction of the cost of a legitimate overseas call.
  • The buyer of the calling card is instructed to call a local (probably legitimate) number in Australia and then enter in the international number they are trying to reach. The crook then reroutes these calls through VOIP to the hacked system, which then makes the international call. This functionality could potentially be turned off periodically to evade being uncovered, and could even be configured to only use the hacked VOIP server for calls to a specific set of countries.
  • The buyer of the calling card of course could not be aware that the call was routed through a hacked VOIP system, they are just happy to have spoken to family and friends at a cheap rate.
  • Note also that it is entirely possible for the calls to be re-routed through an entire chain of hacked VOIP servers in more 2 or 3 different countries, effectively 'laundering the call' by making it harder to track down if an investigation is ever launched. Jurisdictional/timezone/culture and language differences are some of the most challenging hurdles faced by cybercrime investigators, and the crooks know how to take advantage of this (I aim to explore these aspects in a later instalment of this blog series)

    • The important thing is that the calling card holder just got an overseas call for the cost of a local call, plus the crooks margin, so they are not really the victim. The owner of the hacked VOIP server however may (or may not depending the size of a normal bill) realize that something is amiss when they get their next phone bill, as it was their system that made the calls. We have heard a few stories of this occurring (in Australia and abroad), where the victim's telephone bill inexplicably sky-rocketed by over $20,000 in one case here in Australia!

    Premium rate number calling
    This attack predates VOIP by many years, first being used on standard corporate PABX systems. VOIP has made this much more lucrative for the crooks due to the call volumes it allows.

    The scam is fairly simple.

  • Crook has control of hacked VOIP system(s) for which the victim gets bills for on a monthly basis. This VOIP system may belong to a corporate entity, and so may be capable of making many concurrent calls.
  • The crook has a premium rate 1900 number, for which they collect revenue on a weekly or daily basis.
  • Crook gets the hacked VOIP system to make multiple, repeated calls to the 1900 number, thus adding to the account of the 1900 number, at the expense of the owner of the hacked VOIP system.
  • Crook collects the revenue from the 1900 number every day/week until someone notices.

    • In this case, the victim may not realise they have been hacked until they receive the bill at the end of the month, by which time the crook has made off with potentially hundreds of thousands of dollars over at least 2 weekly collection periods.
    Note also that there is a money trail here, so the crook must also engage in other crime types such as identity theft, money laundering etc to actually get cash out.

    Future threat – Denial of Service
    The motive behind this attack could probably be any of the ones listed above.
    I've not heard of any instances of this, but it's worthwhile considering how we would deal with the threat of Denial of Service on Voice systems. This could be as simple as an attacker using a hacked VOIP system to dial multiple concurrent calls into a target's phone numbers (VOIP, or PSTN for that matter) which would exhaust all of the available connections, even ISDN/PSTN indials??. Remember that SIP, the predominant VOIP protocol is UDP (connectionless) and being an Internet protocol could be emulated/faked, so perhaps a hacked VOIP system wouldn't even be required to effect a DOS.
    This area needs much more research and consideration from authorities much better funded and capable than us, and yes we are more than happy to brainstorm ideas on threat scenarios and mitigations with the appropriate agencies/researchers, just contact us.

    Given the importance of voice systems both for commerce and its use in emergency situations, it's imperative that threat scenarios are identified and risks are mitigated to within acceptable tolerances. I hope this blog gives some background info to organizations who are starting to consider the threats they face, and put in place appropriate controls and response plans.

    Next in the blog series is PART 4 "HOW BEST TO PROTECT AGAINST VOIP THREATS". Feel free to contact me at ben@honeynet.org.au with any feedback, or input into the next one.