10 ms·

Interesting, so if I've understood correctly the attackers are looking for open Asterisk servers and attempting to dial out. What's the pay off? The numbers li

by cixin 10y ago

Interesting, so if I've understood correctly the attackers are looking for open Asterisk servers and attempting to dial out. What's the pay off? The numbers listed in the article are not premium rate. Are they just test numbers or is there another pay off?

telebone_man 10y ago
They've probably dialed a cheap route (UK landline) to be non-obtrusive. Whilst the others are more expensive. I suspect this fraudster would 'resell' the route to a wholesaler.
- trome 10y ago
  Come get your nCLI greylist routes with 1.2sec of audio latency! That is basically what is going on with these routes, or they are used to route calling card traffic.
  - telebone_man 10y ago
    ...indeed!! :(
trome 10y ago
They are almost certainly test numbers, to see if they can get calls through to a country where calling is expensive. Often if you attempt to set up a call & not SIP 403 reject, they won't accept the audio media, so call setup cannot complete.
noselasd 10y ago
Quite often those numbers will be another hacked service, which is set to forward the calls. Perhaps eventually to a premium service. This is done to better hide the origination. Another common fraud is to provide cheap calls to a certain area/country. (often named black/grey routes). Basically the telco or state regulators might have a very expensive price to call a certain country/network. You set up your own telephony service in country A, route incoming calls over the internet to country B where you set up a similar service that can terminate the calls in country B. Your call the phone number in country A , that phone is just a bot/pbx, which routes the call over to country B, but using the cheap internet, instead of the expensive price your telco would charge you to do. Seen from the telco in both in country A and B, it's just two local calls. What's even cheaper than doing this ? Hack an existing PBX tp do the same, to incur all costs to the PBX owner.
- annnnd 10y ago
  Sorry if I'm being naive, but what is keeping users from using Skype & co.?
  - noselasd 10y ago
    Here are a few reasons: 1. Calling user does not have a computer 2. Called user does not have a computer 3. Users are in a situation where they do not have a computer, only their cell phone, with a data plan that is too expensive to use skype, or without a data plan altogether. 4. Users does not know about, are not able or trained to use skype. 5. Internet is not available at the location of either of the users. 6. Users are in a coverage area with only basic phone services, no data availability. Throughout the world there are far, far more people having access to simple phone services than a computer and the internet. The places I often see these kinds of frauds, are for minorities living/working in one country, that wants to talk to their families back home - often poor people with no access to a computer, nor the ability to operate one - but with a mobile phone, and a little bit of money to pay for a few calls - which is enough for someone else to make a buck by selling blakc/grey routes to these people.

by cixin 10y ago

telebone_man 10y ago

They've probably dialed a cheap route (UK landline) to be non-obtrusive. Whilst the others are more expensive. I suspect this fraudster would 'resell' the route to a wholesaler.

trome 10y ago
Come get your nCLI greylist routes with 1.2sec of audio latency! That is basically what is going on with these routes, or they are used to route calling card traffic.
- telebone_man 10y ago
  ...indeed!! :(

trome 10y ago

They are almost certainly test numbers, to see if they can get calls through to a country where calling is expensive. Often if you attempt to set up a call & not SIP 403 reject, they won't accept the audio media, so call setup cannot complete.

noselasd 10y ago

Quite often those numbers will be another hacked service, which is set to forward the calls. Perhaps eventually to a premium service. This is done to better hide the origination. Another common fraud is to provide cheap calls to a certain area/country. (often named black/grey routes). Basically the telco or state regulators might have a very expensive price to call a certain country/network. You set up your own telephony service in country A, route incoming calls over the internet to country B where you set up a similar service that can terminate the calls in country B. Your call the phone number in country A , that phone is just a bot/pbx, which routes the call over to country B, but using the cheap internet, instead of the expensive price your telco would charge you to do. Seen from the telco in both in country A and B, it's just two local calls. What's even cheaper than doing this ? Hack an existing PBX tp do the same, to incur all costs to the PBX owner.

annnnd 10y ago
Sorry if I'm being naive, but what is keeping users from using Skype & co.?
- noselasd 10y ago
  Here are a few reasons: 1. Calling user does not have a computer 2. Called user does not have a computer 3. Users are in a situation where they do not have a computer, only their cell phone, with a data plan that is too expensive to use skype, or without a data plan altogether. 4. Users does not know about, are not able or trained to use skype. 5. Internet is not available at the location of either of the users. 6. Users are in a coverage area with only basic phone services, no data availability. Throughout the world there are far, far more people having access to simple phone services than a computer and the internet. The places I often see these kinds of frauds, are for minorities living/working in one country, that wants to talk to their families back home - often poor people with no access to a computer, nor the ability to operate one - but with a mobile phone, and a little bit of money to pay for a few calls - which is enough for someone else to make a buck by selling blakc/grey routes to these people.