Toll Fraud Research Articles

Strategic Spam Call Control and Fraud Management: Transforming Global Communications

With an ever-increasing number of complaints concerning “robo” and spam calls, the Federal Communications Commission (FCC) mandates service providers (SP) or internet telephone SP to filter or block unauthenticated or unverified calls. To U.S. mobile consumers, the “TRACED” law has passed enforcing the carriers to tag and, if needed, block spoofed numbers. The FCC requires major carriers to adopt and implement “STIR-SHAKEN,” a technology aimed at thwarting robocalls. The regulation imposes substantive fines, in the millions of dollars, for carriers that fail to implement. Alternatively, toll fraud hacks are on the rise, crippling telecommunication firms with revenue losses. Given the business problems with fraud and illegal scam calls, the technology aims at establishing a reliable end-to-end call authentication framework. This paper provides additional insight into technology trends to strategize new technology offerings, securing, and protecting telecommunications (telco) business operations.

Analysis of a PBX Toll Fraud Honeypot

Organisations are moving over from legacy telecommunications to Voice over IP (VoIP), enabling greater flexibility, resilience and an overall cost reduction. Session Initiated Protocol (SIP) is considered to be the main VoIP protocol in the business–to-business market, but the correct implementation and configuration is not always well- understood. The failure to configure SIP systems correctly has led to significant fraud exploiting a range of vulnerabilities and billions of dollars every year being stolen from companies of all sizes through PBX Hacking via the medium of Toll Fraud. Previous research into this area is now dated but suggested fast-changing approaches by attackers. Industry organisations such as the Communications Fraud Control Association (CFCA) acknowledged this is a fast-growing problem. To quantify the size of the current problem, a Honeypot experiment was undertaken using a popular phone system used by businesses. The Honeypot ran for 10 days and recorded just under 19 million SIP messages. This research has identified attackers are using various sophisticated methods to attempt to gain access and trick a PBX into making calls. When comparing previous research, the rate of attack is approximately 30 times more aggressive and the countries from where attacks originate are distributed over 75 countries.

Is your Session Border Controller providing a false sense of security?

Organisations have latched on to the need to secure SIP trunking solutions by implementing a Session Border Controller (SBC). The problem is that the vast majority of SBCs are considered not just one-off investments but also one-off deployments. Yet from denial of service attacks to toll fraud, SIP trunking is not only inherently vulnerable, that vulnerability continues to change and escalate. Few companies would fail to update anti-virus software, so why assume the SBC can protect against changing threats without similar routine updates? The fact is that in their current guise, most SBCs actually leave organisations with a false sense of security.

Counting the security cost of cheap calls

The decision to move to SIP trunking appears straightforward: reduced costs, greater scalability, improved disaster recovery options and access to the productivity benefits enabled by Unified Communications (UC). But, as ever in the world of technology, the truth about SIP trunking is a little more complex than it may appear at first glance. How much up-front investment is required to migrate from the existing ISDN trunk? How big is the hardware investment? How scalable is the solution? And, critically, is it secure?But is it secure? This issue is too often overlooked by companies wanting to move to SIP. The result is a ticking time bomb for businesses, with threats ranging from denial of service to toll fraud (also known as call jacking); and the liability lies squarely with the business, not the provider, as Paul German of VoipSec explains.

Toll Fraud Detection of VoIP Service Networks in Ubiquitous Computing Environments

Voice over Internet Protocol (VoIP) is an emerging communication service that has advanced in ubiquitous computing environments. Although VoIP is inexpensive and offers additional services, there has been little provision for attacks at the weak points. With the advances of Wireless Sensor Network (WSN) technologies, the risk is increasing. Due to the resource constraints of WSN, attacks have become easier, making protection of the network more difficult. In this work, we attempt to distinguish fraud call attacks as outliers from normal calls on the basis of call detail records. We adopted and applied a Local Outlier Factor (LOF) method on real call data, which include actual fraud call attacks. Our results show the outlier detection method can be effective in detecting fraud calls. Moreover, introducing two additional attributes related to fraud call characteristics enhanced the detection performance.

One-Class Naïve Bayesian Classifier for Toll Fraud Detection

In this paper, a one-class Naïve Bayesian classifier (One-NB) for detecting toll frauds in a VoIP service is proposed. Since toll frauds occur irregularly and their patterns are too diverse to be generalized as one class, conventional binary-class classification is not effective for toll fraud detection. In addition, conventional novelty detection algorithms have struggled with optimizing their parameters to achieve a stable detection performance. In order to resolve the above limitations, the original Naïve Bayesian classifier is modified to handle the novelty detection problem. In addition, a genetic algorithm (GA) is employed to increase efficiency by selecting significant variables. In order to verify the performance of One-NB, comparative experiments using five well-known novelty detectors and three binary classifiers are conducted over real call data records (CDRs) provided by a Korean VoIP service company. The experimental results show that One-NB detects toll frauds more accurately than other novelty detectors and binary classifiers when the toll frauds rates are relatively low. In addition, The performance of One-NB is found to be more stable than the benchmark methods since no parameter optimization is required for One-NB.

위치 정보 서버를 이용한 SIP 위장공격 대응 방안

SIP의 보안 취약점을 이용한 위장공격은 공격자로 하여금 과금 회피, 세션 가로채기를 용이하게 하여 사용자에게 피해를 줄 수 있으므로 이에 대한 대응 방안이 요구된다. 따라서 본 연구에서는 위장공격을 탐지하기 위한 새로운 기법을 제안한다. 등록 서버는 전송된 레지스터 요청 메시지의 헤더 값 중 From 또는 Call-ID값을 포함한 레코드가 위치 정보 서버에 저장되어 있는지 확인한다. 만약 저장된 레코드가 존재하고 그 값이 주기적으로 갱신된다면 등록 서버는 전송된 레지스터 요청 메시지를 위장공격으로 판별하여 요청 메시지를 무시한다. 이 기법은 위장 공격을 방어하기 위해 사용자 인증을 위한 암호화 메커니즘을 추가하는 형태가 아닌 위치 정보 서버에 저장된 정보를 이용하여 보다 안전한 SIP 환경을 쉽게 구축할 수 있다. Impersonation attack, based on vulnerable security of SIP, facilitate a intruder to take malicious actions such as toll fraud and session hijacking. This paper suggests a new technique for a countermeasure. When receiving a register request message, registrar checks whether the value of Form header or the value of Call-ID header is stored in location server or not. If the record containing either of them are stored and periodically updated, we regard that message as impersonation attack and discard it. Since this technique uses the information stored in server instead of adding encryption mechanism for user authentication, it can easily build securer SIP environment.

Voice-over-IP Security: Research and Practice

Consumers and enterprises alike are rapidly adopting voice-over-IP (VoIP) technologies, which offer higher flexibility and more features than traditional telephony infrastructures. They can also potentially lower costs through equipment consolidation and, for the consumer market, new business models. However, VoIP systems also represent high complexity in terms of architecture, protocols, and implementation, with a corresponding increase in the potential for misuse. The author conducted survey of published vulnerabilities in the Common Vulnerabilities and Exposures (CVE) database and in two IETF RFC Internet drafts. These issues ranged from relatively straightforward problems that can lead to server or equipment crashes (denial of service [DoS]) to more serious problems that let adversaries eavesdrop on communications, remotely take over servers or handsets, impersonate users, avoid billing or charge another user (toll fraud), and so on.

Voice over Internet protocol for the orthodontic practice: A sensible switch from plain old telephone service

Voice over Internet protocol (VoIP) is a revolutionary new technology that is causing a stir in the telecommunications industry and threatening the existence of traditional telephone service providers. Based on a simple method of converting analog audio signals into digital data before being transmitted over the Internet, VoIP has gained immense popularity among consumers. The technology is now regarded as an alternative to traditional telephone service for the orthodontic office. When the economics are considered, it is cost-effective, especially for a busy orthodontic practice where the call volumes both in and out are always high. VoIP has the potential to reduce costs, break the barriers between local vs long-distance calling, and make life easier for the office staff. However, deploying VoIP requires a cautious and thought-out process. Users should fully understand the risks and benefits before switching from the public switched telephone network. VoIP customers and service providers are vulnerable to many of the same impersonation-based attacks by those who attempt toll fraud, and identity and information theft. In this article, VoIP is introduced to orthodontic practitioners, who might be unfamiliar with this technology. Internet protocol based private branch exchange systems that are currently marketed as open-source technologies are also reviewed. Additionally, VoIP is compared with the traditional public switched telephone network technology and evaluated for its potential applications in an orthodontic office for both increased efficiency and cost savings.

Ivar Kreuger Reborn: A Swedish/American Accounting Fraud Resurfaces in Italy and India

Accounting fraud has been widely publicized in recent years, especially the large frauds perpetrated at U. S. companies such as Enron and WorldCom, but frauds are not country specific, and similar events have occurred in the past decade in many countries, including Italy and India. What is noticeable about the Italian Parmalat fraud and the Indian UTI fraud is their similarity to the Swedish/American fraud perpetrated for many years by Ivar Kreuger and uncovered in 1932. Although the Kreuger & Toll fraud was discovered following the suicide of Kreuger in March 1932, he, or at least his ideas about accounting and auditing, have been reborn in Italy and India. The Parmalat and UTI cases shared many similarities to that of Kreuger, particularly his view that audits and periodic reporting to shareholders were unnecessary. Whether talking about the Ivar Kreuger of 1932, the Indian UTI episode of the 1990s, or Parmalat of 2004, the story is the same; history repeats itself.

Employing penetration testing as an audit methodology for the security review of VoIP

PurposeThe purpose of this paper is to discuss and amalgamate information security principles, and legal and ethical concerns that surround security testing and components of generic security testing methodologies that can be applied to Voice over Internet Protocol (VoIP), in order to form an audit methodology that specifically addresses the needs of this technology.Design/methodology/approachInformation security principles, legal and ethical concerns are amalgamated that surround security testing and components of generic security testing methodologies that can be applied to VoIP. A simple model is created of a business infrastructure (core network) for the delivery of enterprise VoIP services and the selected tests are applied through a methodically structured action plan.FindingsThe main output of this paper is a, documented in detail, testing plan (audit programme) for the security review of a core VoIP enterprise network infrastructure. Also, a list of recommendations for good testing practice based on the testing experience and derived through the phase of the methodology evaluation stage.Research limitations/implicationsThe methodology in the paper does not extend at the moment to the testing of the business operation issues of VoIP telephony, such as revenue assurance or toll fraud detection.Practical implicationsThis approach facilitates the conduct or security reviews and auditing in a VoIP infrastructure.Originality/valueVoIP requires appropriate security testing before its deployment in a commercial environment. A key factor is the security of the underlying data network. If the business value of adopting VoIP is considered then the potential impact of a related security incident becomes clear. This highlights the need for a coherent security framework that includes means for security reviews, risk assessments, and influencing design and deployment. In this respect, this approach can meet this requirement.

Signature-Based Methods for Data Streams

We have been developing signature-based methods in the telecommunications industry for the past 5 years. In this paper, we describe our work as it evolved due to improvements in technology and our aggressive attitude toward scale. We discuss the types of features that our signatures contain, nuances of how these are updated through time, our treatment of outliers, and the trade-off between time-driven and event-driven processing. We provide a number of examples, all drawn from the application of signatures to toll fraud detection.

Telephony Security

Threats to voice communications fall into three categories: 1. theft of long distance services (toll fraud) 2. business loss due to disclosure of confidential information 3. malicious pranks

Is Security, is Audit, and Control Measures in Telecommunication Toll Fraud

Is Security, is Audit, and Control Measures in Telecommunication Toll Fraud

Toll fraud on french PBX systems

In France it is estimated that PBX trunk fraud (toll fraud) costs companies over $220 million a year. Criminal phreakers figure out how to access PBXs owned by businesses and then sell long-distance calling capacities provided by these systems to the public. In European markets where PSTN to PSTN connections are illegal it has not to date been such an issue. However, for a number of reasons this is likely to change. Jean-Bernard Condat reports.