[VoiceOps] Robocall mitigation SCAM!

[Mark Lindsey]

Good tips, Mary Lou! 

Do you think there's potentially any good intentions behind the advice to leave the traffic up?

In the cybersecurity space, authorities will say that if your network has been compromised, you shouldn't immediately shutdown the hacked systems. For example, just this past September, this Joint Cybersecurity Advisory (AA20-245A) from the US and a few other governments...
https://us-cert.cisa.gov/sites/default/files/publications/AA20-245A-Joint_CSA-Technical_Approaches_to_Uncovering_Malicious_Activity_508.pdf

Under actions to avoid: 
"Mitigating the affected systems before responders can protect and recover data 
 - This can cause the loss of volatile data such as memory and other host-based artifacts.
 - The adversary may notice and change their tactics, techniques, and procedures."



Mark R Lindsey, SMTS | +1-229-316-0013 | mark at ecg.co | https://ecg.co/lindsey/ <https://ecg.co/lindsey/>






> On May 26, 2021, at 3:38 PM, Mary Lou Carey <marylou at backuptelecom.com> wrote:
> 
> I just heard through the grapevine that several companies have been shut down and/or threatened with the confiscation of their equipment for passing Robocall traffic. The companies that this happened to all claimed someone contacted them and told them to keep the TN/traffic up so they could help catch the offenders. Unfortunately, whoever is advising carriers to keep the traffic up is not on the up and up. The ITG and large carriers came in and shut them down because they continued to pass traffic that was identified as robocalls.
> 
> If someone contacts your company about a trace back and advises you to keep the TNs / traffic up, DO NOT LEAVE IT UP! Document everything and turn down the Robocall traffic as soon as possible! Then send both the ITG and large carrier involved the account number and CDRs for the calls in question.
> 
> Be safe out there.....it's getting crazy!
> 
> MARY LOU CAREY
> BackUP Telecom Consulting
> Office: 615-791-9969
> Cell: 615-796-1111
> _______________________________________________
> VoiceOps mailing list
> VoiceOps at voiceops.org
> https://puck.nether.net/mailman/listinfo/voiceops

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/voiceops/attachments/20210526/294e2c57/attachment.htm>