[cisco-voip] Robo Call DoS

[Ryan Huff]

Is it the same CALLED number? While this is service impacting, if the customer can live without the number for a few hours here is what has worked for me ...

Take the number and run it to an IVR (Unity Connections or UCCX are common Cisco options). The IVR simply plays the SIT (special information tone) for a busy circuit which can be downloaded here: http://www.yourhomenow.com/sit.html and dumps the call.

True robo dialer bots are autonomous and usually listen for SIT; when they hear “circuit busy” (the three bings of death that play at a particular frequency) they usually blacklist the called number on their index so they don’t keep burning cycles and are more effective for the bot owner.

I’ve also used a 30 second sample of Rick Astley’s, “Never gonna give you up” in place of SIT, when I feel like “Rick Rolling” the bot .... a little way to vent frustration on a bot :). Rick rolling isn’t something you can usually do with customer facing numbers though :(; circuit busy SIT is easier to explain away.

You can try legal and carrier options but generally you just want it to stop in the quickest way possible and this has done it for me several times before.

Thanks,

Ryan

On Apr 16, 2018, at 11:42, Bill Talley <btalley at gmail.com<mailto:btalley at gmail.com>> wrote:

I’m sure you’ve already considered this, but I wonder, with everything being back-hauled over IP these days, if their telco would be able to identify the IXC who is handing off the call to them, based on the logs for the original calling party number they blocked, and blacklist that address.  Sure that sounds extreme (voice is more critical them SMTP), but you’re also talking about criminal activity.


Sent from an iOS device with very tiny touchscreen input keys.  Please excude my typtos.

On Apr 16, 2018, at 10:23 AM, Anthony Holloway <avholloway+cisco-voip at gmail.com<mailto:avholloway+cisco-voip at gmail.com>> wrote:

Technically or legally?

How does one stop a DoS attack on a network?  Or on anything for that matter?  Say you were attending a protest, and someone is blowing an air horn in your ear<https://youtu.be/cvAMkDGKelQ?t=80>?  What can you do?

Technically, you could front end the whole thing with a captcha style gate, so you could ask to push a single button, button combination, or solve a simple addition problem resulting in two digits.  granted, just like on the web, a captcha is burdensome to the user, but generally, it's preferable over the site being down, or disrupted.

CUC and UCCX both could handle this task, though it would be easier in UCCX.

On Mon, Apr 16, 2018 at 9:49 AM Matthew Loraditch <MLoraditch at heliontechnologies.com<mailto:MLoraditch at heliontechnologies.com>> wrote:
So this is a curiosity question, we had a prospective client call us who is essentially getting robocalled to oblivion. Some scammer has robo dialers setup and is flooding all of their trunks. He got a ransom, stopped and then started again. He was originally using one number and then when the telco blocked that switching to random sources.
Are there are any legitimate defenses to this sort of thing?

Matthew Loraditch​
Sr. Network Engineer

p: 443.541.1518<tel:443.541.1518>


w: www.heliontechnologies.com<http://www.heliontechnologies.com/>        |      e: MLoraditch at heliontechnologies.com<mailto:MLoraditch at heliontechnologies.com>

[cid:image164818.png at 93BA584B.3B5FAD34]

[Facebook]<https://facebook.com/heliontech>

[Twitter]<https://twitter.com/heliontech>

[LinkedIn]<https://www.linkedin.com/company/helion-technologies>





_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net<mailto:cisco-voip at puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip
_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net<mailto:cisco-voip at puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip
_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net<mailto:cisco-voip at puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20180416/14018eb6/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image164818.png
Type: image/png
Size: 8404 bytes
Desc: image164818.png
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20180416/14018eb6/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image955318.png
Type: image/png
Size: 431 bytes
Desc: image955318.png
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20180416/14018eb6/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image614350.png
Type: image/png
Size: 561 bytes
Desc: image614350.png
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20180416/14018eb6/attachment-0002.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image165691.png
Type: image/png
Size: 444 bytes
Desc: image165691.png
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20180416/14018eb6/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image164818.png
Type: image/png
Size: 8404 bytes
Desc: image164818.png
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20180416/14018eb6/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image955318.png
Type: image/png
Size: 431 bytes
Desc: image955318.png
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20180416/14018eb6/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image614350.png
Type: image/png
Size: 561 bytes
Desc: image614350.png
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20180416/14018eb6/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image165691.png
Type: image/png
Size: 444 bytes
Desc: image165691.png
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20180416/14018eb6/attachment-0007.png>