abalashov at evaristesys.com
Mon Feb 24 16:41:51 EST 2014
I've said it before and I'll say it again:
We stopped 95-98% of the losses on this sort of thing for a large
customer who was losing thousands of dollars per day on it, by
implementing the following approach:
Every trunk group gets a 'high-cost channel limit', which is the X
number of simultaneous calls that they are allowed to make to
destinations that cost over $Y/min. The limit was typically something
like $0.10, so as to exclude domestic US traffic, but certainly catch
Somalia and Globalstar. Both X and Y are configurable on a per-trunk
group basis, so customers who have a legitimate need for 50 concurrent
calls to Dakar can do that. For most typical domestic users, the limit
was set to something like $0.10 and 2 channels.
When this limit was tripped, typically due to a compromised PBX with
some extension password of 1234, the following things happen:
(1) All existing calls are terminated;
(2) An alert e-mail is sent out to the customer and to the NOC;
(3) Customer is downgraded to a termination rate plan that only allows
for domestic calling. That way, they're not totally cut off from calling
and, in all but the most unusual scenarios, not exceptionally angry.
There is no reason to cut them off entirely. That's a false dichotomy.
Downgrade them to a restricted calling plan.
The thinking was that (a) there's only so much exposure that two
simultaneous calls to rural Chad can create; (2) almost any typical
attack pattern relies on lighting up as many calls as possible in the
shortest period of time, since they know they'll get cut off soon. So,
almost any exploit is going to trip the wire, and do so quickly.
These assumptions proved correct, and the losses virtually disappeared.
Today, this fraud protection feature is integrated into the trunking
platform that we sell. In our experience, it works very well.
Alex Balashov - Principal
Evariste Systems LLC
235 E Ponce de Leon Ave
Decatur, GA 30030
Web: http://www.evaristesys.com/, http://www.alexbalashov.com/
More information about the VoiceOps