<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>We had two customers get hit simultaneously last summer with almost the same thing. In both cases the customers entire DID ranges were hit by an auto dialer that basically iterated through and did password guessing attempts and then once it compromised a voicemail account it set a call forward to an international pay per minute informational line through the portal. The dialer would then call back in and initiate as many calls as allowed to the compromised DID, racking up as many charges as possible. We picked it up fairly quickly and so were able to minimize losses but the whole incident did lead to a gaggle of administrative and operational changes.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I had RTP captures for all the attack calls so I was able to pinpoint exactly how the compromise ran – I initially thought it had been done through the customer web portal till I saw all the unusual log activity. All the calls were using spoofed CLID, Florida State Patrol in on case - a hospital I think in the other, so I can only imagine that they originated from a compromised system somewhere out there.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>In addition to blocking the offending numbers make sure you track down the exact attack methodology they used and close up the hole. In our case that meant disabling the ability for customers to set call forwarding through the voice portal. You may find voice portal call origination or even a compromised SIP account to be the culprit, whatever it is don’t rely on blocking numbers to stop it because it is too easy to spoof CLID.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> voiceops-bounces@voiceops.org [mailto:voiceops-bounces@voiceops.org] <b>On Behalf Of </b>Colin<br><b>Sent:</b> Sunday, October 31, 2010 10:02 PM<br><b>To:</b> voiceops@voiceops.org<br><b>Subject:</b> [VoiceOps] Fraud<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>Has anyone ever run into this international fraud before or have any idea who runs it?<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>The various numbers(blocks of numbers) in various countries being called all answered by an IVR with the following message. <o:p></o:p></p></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><i>"Thank you for calling dial to win application, where you can win fabulous prizes every week. The long you hold the line the bigger is your chance to win. For every minute you hold the line you will collect one lucky hit. The more lucky hits the bigger chance to win. Now we will generate a unique pin code for you, your unique pin code is</i><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><i>Xxxxxxxxxx</i><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><i>Please note down you have collected one lucky hit for this one minute so please hold on and you will get a lucky hit for every minutes. This is a international lottery running successfully in 50 countries of the world. Please hold the line to get next lucky hit and continues……………………”</i><o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Any leads are appreciated. We've blocked all the offending numbers of course. <br><br>Sent from my iPhone.<o:p></o:p></p></div></div></body></html>