6 ms·

To give a good example of why something like this matters... I spent a bit more than a year as the most senior dev on the team that owned the sign up page for

by mabbo 5y ago

To give a good example of why something like this matters... I spent a bit more than a year as the most senior dev on the team that owned the sign up page for a cloud computing company. We faced bot attacks constantly. They had a variety of reasons to attack, but International revenue sharing fraud (IRSF) was a major one. In short, bots would convince our sign up flow to make verification phone calls to numbers that charge a lot of money but don't actually exist. (Note: whatever "why don't you just" you're about to reply with, we had an entire team of people doing nothing but trying to stop this for months and years- we tried that and it didn't succeed, or there were business reasons it was not feasible.) I switched companies. In my new role, I happened to be on a team in the same org as their sign up page. Chatting with them, I learned that they were not facing similar attacks, but identical ones. The countries involved, the patterns of the attack, everything- this was the same attacker, going up against two completely unrelated companies. I don't know if this system is the right implementation- I need to do a deeper dive on this- but I do know that something like this is needed so that companies can coordinate their defenses.

im3w1l 5y ago
Since you say you tried and hard to stop this, I guess you are implying that it's not possible to tell in advance what it costs to call a given number? How do telcos get away with that?
- londons_explore 5y ago
  For consumers at least, it's the law in the EU. Every phone network has either a pricing document or a webpage where you can type a number and it tells you the price, and if you were charged something that isn't that price, I guess you could demand a refund, and escalate to a court if the refund wasn't forthcoming. Note that these documents frequently list some numbers at ridiculously high prices (eg. €25 per minute), presumably to deter such fraud.
  - hedora 5y ago
    I think the problem with that is that these schemes rely on the phone network being ridiculously insecure. The scammers send a surprise bill to your telco, then they pass it along to you. It wouldn't surprise me if the list only applies to consumer plans, or (as you say) high-balls stuff in certain countries.
    - rvba 5y ago
      I wonder what would happen if the telco would say "we wont pay the bill, since we believe it is fraudulent". They wont "lose much" if some fraudulent telco from third world cuts them - the numbers dont work anyway. And what can the scammers do? Try to sue an US telecom? If they reveal their true names, then the embassy knows where to send the "operators" who will solve the case for good.
      - londons_explore 5y ago
        There is normally a long chain of intermediate telco operators between the fraudsters and the US operator. Some of those intermediate operators are large and have a lot of legit calls. Each operator adds their profit margin on and passes the bill to the next. So no operator has any incentive to police this stuff, because they all profit from it.
- hedora 5y ago
  It does make me wonder why they don't just switch to pre-paid sim cards (or the contractually equivalent thing that doesn't involve cell phones). Good luck collecting your scam cash from my personal line! The phone company doesn't have a mechanism to pass the cost on to me, so I'm guessing the telcos already figure out how to block this at the network level. Has anyone tried calling some of the bad actor numbers from a burner phone?
- mabbo 5y ago
  IRSF is a fascinating topic. As it was explained to me (anyone feel free to correct me if I'm wrong), a shady/criminal organization takes control of a piece of the phone network. They pick a range a phone numbers for a country that is usually expensive to call, maybe a range of numbers that doesn't actually exist in that country, and they use the phone network to "advertise" a slightly cheaper route to connect phone calls to those numbers. Instead if it costing $1, it costs $0.80. When someone makes a call to those numbers, they charge the cheaper rate, and then don't actually connect them to a real phone. Every time a call is made, they just get money. The "S" is for "shared". They offer other organizations "for every call you generate to this range of numbers, we give you a cut". Let's call it 20 cents. Now picture how many organizations are vulnerable to this. Every "call me back when a customer service rep is available". Every "call me to let me type in a code to verify I'm human". Every "leave a number our sales team can reach you at". They're all being attacked by these sorts of things constantly. The cost to get a bot to trick the system into making a phone call is much smaller than the revenue generated. As long as that is true, the attacker wins.
secondaryacct 5y ago
It s like the electricity companies who cant preemptively check usage to cut before it explodes, cant anything be done at the phone provider level to just...cut before the cost is incurred ? I mean if credit cards can do it...
- deleted 5y ago
  [deleted]
rco8786 5y ago
> whatever "why don't you just" you're about to reply with, I love that you added this. So many armchair experts with brilliant solutions to problems they know nothing about.
- Nowado 5y ago
  'I could fix it over a weekend' is pretty much the motto of this page.
  - Grimburger 5y ago
    These two smug all-knowing above comments aside, how do you actually get charged money for dialling numbers that don't exist?
    - Operyl 5y ago
      Corrupt carriers in other countries splitting the money, etc.
      - Grimburger 5y ago
        So stop dialling out to these few places? Otherwise it's a cost of doing business if you insist on keeping at it knowing full well what happens.
        Operyl 5y ago
        This is what most people do, at my employment we restricted it to US/Canada with a reach out for other countries.
    - noAnswer 5y ago
      They do usually exist. They answer immediately and than play the "it is ringing"-sound forever. (Some SIP providers allow you to disallow expensive numbers to be called and/or state the minute costs before the call starts (giving you time to hang up.))
tempest_ 5y ago
There are definitely two kinds of bad actors when it comes to scraping/scripting things. The automated drive by ones trying to spam posts in every form or are probing for word press exploits or what have you. The ones where someone is specifically taking time out of their day to tailor their attack to your specific page. The former is easy to deal with the latter is far harder to sort out.
shirly88 5y ago
Oh good, mob justice on the networks. Surely this IP system itself can never be manipulated to cut off people by mistake or for revenge. Humans always investigate thoroughly before serving themselves. None of these IPs could be zombies; here come internet Supermen to save us!
- gavinhenry 5y ago
  Yeah, this is to gather the raw data and learn probe and attack patterns. How you use the API is your choice really.
hedora 5y ago
Why are these systems making verification phone calls?
- Shermanium 5y ago
  two factor authentication
- gavinhenry 5y ago
  As they normally have a deal with the numbers they can successfully call for outpayments from the Telco.
NullPrefix 5y ago
This problem would not exist if the price of a call would be known before making the call. But we live in a world where "it's cheap, just use it, we will the exact bill later" is the norm.
- kzrdude 5y ago
  A calling prefix for "place call if it's free" would be great. Or even "place call if it's at or below this standard fare".
jsnell 5y ago
I've worked on a large federated IP reputation system. It sounds like a great idea, but does not work in practice. The main problem is that it's just too hard to map different kinds of abusive/non-abusive actions to a shared scale. The model here seems to be basically a boolean OR: if anyone flagged an IP as bad, it's marked as bad in the data set. Let's say that you're running a shop and detect a bunch of fraudulent transactions for expensive items, and add the IPs to the list. What can somebody else using this list for say spam-filtering comments to a web forum do with your data points in isolation? Not much, because the action you're protecting is rare, high impact, and unlikely to have FPs so the threshold where you'd mark the IP as abusive would be very different than for the spam-filter use case. At a minimum you'd need all the client of the IP reputation signal to also share the positive reputation signals, not just the negative, and to export some forms of volumes or ratios of good and bad traffic. But it'll still be really hard to combine those reports to a single verdict that's generally useful. A secondary problem is that different kinds of abuse don't even correlate particularly well. Let's say that you've got an IP address sending SMTP spam; the odds are that this IP will not be doing ssh credential stuffing, credit card fraud, mass-scraping, traffic pumping, warez distribution, or DDOS attacks. The classic SMTP IP blocklists work only because everyone using them is using them for the same purpose, and is as such on a shared scale, and there is a high likelihood of the same abusive actor attacking multiple different organizations. Your example would fit that as well, and doing reputation for that one domain would actually tractable unlike federated cross-domain IP reputation.
gavinhenry 5y ago
I hope to expand the protocol list once I can figure out Network Discovery on the WAN - https://github.com/zeromq/zyre/issues/701 https://github.com/zeromq/zyre/issues/701

by mabbo 5y ago

im3w1l 5y ago

Since you say you tried and hard to stop this, I guess you are implying that it's not possible to tell in advance what it costs to call a given number? How do telcos get away with that?

londons_explore 5y ago
For consumers at least, it's the law in the EU. Every phone network has either a pricing document or a webpage where you can type a number and it tells you the price, and if you were charged something that isn't that price, I guess you could demand a refund, and escalate to a court if the refund wasn't forthcoming. Note that these documents frequently list some numbers at ridiculously high prices (eg. €25 per minute), presumably to deter such fraud.
- hedora 5y ago
  I think the problem with that is that these schemes rely on the phone network being ridiculously insecure. The scammers send a surprise bill to your telco, then they pass it along to you. It wouldn't surprise me if the list only applies to consumer plans, or (as you say) high-balls stuff in certain countries.
  - rvba 5y ago
    I wonder what would happen if the telco would say "we wont pay the bill, since we believe it is fraudulent". They wont "lose much" if some fraudulent telco from third world cuts them - the numbers dont work anyway. And what can the scammers do? Try to sue an US telecom? If they reveal their true names, then the embassy knows where to send the "operators" who will solve the case for good.
    - londons_explore 5y ago
      There is normally a long chain of intermediate telco operators between the fraudsters and the US operator. Some of those intermediate operators are large and have a lot of legit calls. Each operator adds their profit margin on and passes the bill to the next. So no operator has any incentive to police this stuff, because they all profit from it.
hedora 5y ago
It does make me wonder why they don't just switch to pre-paid sim cards (or the contractually equivalent thing that doesn't involve cell phones). Good luck collecting your scam cash from my personal line! The phone company doesn't have a mechanism to pass the cost on to me, so I'm guessing the telcos already figure out how to block this at the network level. Has anyone tried calling some of the bad actor numbers from a burner phone?
mabbo 5y ago
IRSF is a fascinating topic. As it was explained to me (anyone feel free to correct me if I'm wrong), a shady/criminal organization takes control of a piece of the phone network. They pick a range a phone numbers for a country that is usually expensive to call, maybe a range of numbers that doesn't actually exist in that country, and they use the phone network to "advertise" a slightly cheaper route to connect phone calls to those numbers. Instead if it costing $1, it costs $0.80. When someone makes a call to those numbers, they charge the cheaper rate, and then don't actually connect them to a real phone. Every time a call is made, they just get money. The "S" is for "shared". They offer other organizations "for every call you generate to this range of numbers, we give you a cut". Let's call it 20 cents. Now picture how many organizations are vulnerable to this. Every "call me back when a customer service rep is available". Every "call me to let me type in a code to verify I'm human". Every "leave a number our sales team can reach you at". They're all being attacked by these sorts of things constantly. The cost to get a bot to trick the system into making a phone call is much smaller than the revenue generated. As long as that is true, the attacker wins.

secondaryacct 5y ago

It s like the electricity companies who cant preemptively check usage to cut before it explodes, cant anything be done at the phone provider level to just...cut before the cost is incurred ? I mean if credit cards can do it...

deleted 5y ago
[deleted]

rco8786 5y ago

> whatever "why don't you just" you're about to reply with, I love that you added this. So many armchair experts with brilliant solutions to problems they know nothing about.

Nowado 5y ago
'I could fix it over a weekend' is pretty much the motto of this page.
- Grimburger 5y ago
  These two smug all-knowing above comments aside, how do you actually get charged money for dialling numbers that don't exist?
  - Operyl 5y ago
    Corrupt carriers in other countries splitting the money, etc.
    - Grimburger 5y ago
      So stop dialling out to these few places? Otherwise it's a cost of doing business if you insist on keeping at it knowing full well what happens.
      - Operyl 5y ago
        This is what most people do, at my employment we restricted it to US/Canada with a reach out for other countries.
  - noAnswer 5y ago
    They do usually exist. They answer immediately and than play the "it is ringing"-sound forever. (Some SIP providers allow you to disallow expensive numbers to be called and/or state the minute costs before the call starts (giving you time to hang up.))

tempest_ 5y ago

There are definitely two kinds of bad actors when it comes to scraping/scripting things. The automated drive by ones trying to spam posts in every form or are probing for word press exploits or what have you. The ones where someone is specifically taking time out of their day to tailor their attack to your specific page. The former is easy to deal with the latter is far harder to sort out.

shirly88 5y ago

Oh good, mob justice on the networks. Surely this IP system itself can never be manipulated to cut off people by mistake or for revenge. Humans always investigate thoroughly before serving themselves. None of these IPs could be zombies; here come internet Supermen to save us!

gavinhenry 5y ago
Yeah, this is to gather the raw data and learn probe and attack patterns. How you use the API is your choice really.

hedora 5y ago

Why are these systems making verification phone calls?

Shermanium 5y ago
two factor authentication
gavinhenry 5y ago
As they normally have a deal with the numbers they can successfully call for outpayments from the Telco.

NullPrefix 5y ago

This problem would not exist if the price of a call would be known before making the call. But we live in a world where "it's cheap, just use it, we will the exact bill later" is the norm.

kzrdude 5y ago
A calling prefix for "place call if it's free" would be great. Or even "place call if it's at or below this standard fare".

jsnell 5y ago

I've worked on a large federated IP reputation system. It sounds like a great idea, but does not work in practice. The main problem is that it's just too hard to map different kinds of abusive/non-abusive actions to a shared scale. The model here seems to be basically a boolean OR: if anyone flagged an IP as bad, it's marked as bad in the data set. Let's say that you're running a shop and detect a bunch of fraudulent transactions for expensive items, and add the IPs to the list. What can somebody else using this list for say spam-filtering comments to a web forum do with your data points in isolation? Not much, because the action you're protecting is rare, high impact, and unlikely to have FPs so the threshold where you'd mark the IP as abusive would be very different than for the spam-filter use case. At a minimum you'd need all the client of the IP reputation signal to also share the positive reputation signals, not just the negative, and to export some forms of volumes or ratios of good and bad traffic. But it'll still be really hard to combine those reports to a single verdict that's generally useful. A secondary problem is that different kinds of abuse don't even correlate particularly well. Let's say that you've got an IP address sending SMTP spam; the odds are that this IP will not be doing ssh credential stuffing, credit card fraud, mass-scraping, traffic pumping, warez distribution, or DDOS attacks. The classic SMTP IP blocklists work only because everyone using them is using them for the same purpose, and is as such on a shared scale, and there is a high likelihood of the same abusive actor attacking multiple different organizations. Your example would fit that as well, and doing reputation for that one domain would actually tractable unlike federated cross-domain IP reputation.

gavinhenry 5y ago

I hope to expand the protocol list once I can figure out Network Discovery on the WAN - https://github.com/zeromq/zyre/issues/701 https://github.com/zeromq/zyre/issues/701