28 ms·

You can do some fun stuff with SIP and the hacked up VoIP networks today. I found at least one Asterisk-based company followed 302 redirects, but didn't update

You can do some fun stuff with SIP and the hacked up VoIP networks today. I found at least one Asterisk-based company followed 302 redirects, but didn't update the CDRs. So I could forward my phone to an expensive destination, but only hey charged for a few seconds of incoming call to my phone. An enterprising user exploited this to offer free calling to Haiti to a bunch of customers. Oops. SIP is convoluted from the parsing on up, so there's plenty of space for interesting behavior to hide. Not to mention the interactions resulting from lots of custom platform code interacting with what's traditionally considered s closed network, written by people that still have that mindset... Of course, the stakes are higher, now. It's not hard to earn $0.30+ per minute per channel. In a day, you can earn $30k just compromising one little box and 10Mbps of bandwidth. But it just doesn't have the same mystique and feel as old phreaking. Plus since it's just often computer hacking and fraud, and these days people are more sensitive about all that, it even feels more criminal.

sedachv 12y ago
> Of course, the stakes are higher, now. It's not hard to earn $0.30+ per minute per channel. In a day, you can earn $30k just compromising one little box and 10Mbps of bandwidth. Is that from premium number dialing or something else?
- MichaelGG 12y ago
  With a premium number you can get the money directly. Just get a premium number and pump calls to it. But there are other legitimate destinations that are rather expensive. So you could setup shop and proxy calls to hacked boxes. But then you've gotta get customers, accept payments from them, etc. - sounds like more work.
  - sedachv 12y ago
    > But there are other legitimate destinations that are rather expensive. What would those be today? I can't see how long-distance reselling could be worth it anymore.
- car 12y ago
  A recent article describing this issue pretty well: http://www.nytimes.com/2014/10/20/technology/dial-and-redial-phone-hackers-stealing-billions-.html http://www.nytimes.com/2014/10/20/technology/dial-and-redial...

sedachv 12y ago

> Of course, the stakes are higher, now. It's not hard to earn $0.30+ per minute per channel. In a day, you can earn $30k just compromising one little box and 10Mbps of bandwidth. Is that from premium number dialing or something else?

MichaelGG 12y ago
With a premium number you can get the money directly. Just get a premium number and pump calls to it. But there are other legitimate destinations that are rather expensive. So you could setup shop and proxy calls to hacked boxes. But then you've gotta get customers, accept payments from them, etc. - sounds like more work.
- sedachv 12y ago
  > But there are other legitimate destinations that are rather expensive. What would those be today? I can't see how long-distance reselling could be worth it anymore.
car 12y ago
A recent article describing this issue pretty well: http://www.nytimes.com/2014/10/20/technology/dial-and-redial-phone-hackers-stealing-billions-.html http://www.nytimes.com/2014/10/20/technology/dial-and-redial...