<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Is this idea corny?</p>
<p><br>
</p>
<p></p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
Perhaps a solution could be like they do for web pages to prove you are human.</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
<br>
</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
Direct all the customer's incoming calls to an asterisk box. The asterisk box plays a recording asking for them to type in a digit string that is random for each call.</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
If the person types in the right string.. allow the call. If the wrong string is entered.. drop the call.</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
<br>
</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
A beefy asterisk box can handle many calls. Probably more the the switch's incoming trunks if the hardware is up to it.</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
<br>
</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
Just use this when needed and after the TDOS fades away.. disable it. </p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
<br>
</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
Just an idea... probably has several holes in it.</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
<br>
</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
---</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
<br>
</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
I also saw this while googling. Not enough info on the web page for me to even guess if the solution really works.</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
<br>
</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
<a href="https://securelogix.com/threats/telephony-denial-of-service-tdos-attacks/" class="x_OWAAutoLink" id="LPlnk603209">https://securelogix.com/threats/telephony-denial-of-service-tdos-attacks/</a> . I think it uses Splunk on the back end.</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
<br>
</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:16px">
Matt<br>
<br>
</p>
<br>
<p></p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> VoiceOps <voiceops-bounces@voiceops.org> on behalf of Alex Balashov <abalashov@evaristesys.com><br>
<b>Sent:</b> Monday, May 15, 2017 1:15:38 PM<br>
<b>To:</b> voiceops@voiceops.org<br>
<b>Subject:</b> Re: [VoiceOps] Mitigating or stopping TDOS attacks - any advice?</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On Mon, May 15, 2017 at 01:09:01PM -0400, Ivan Kovacevic wrote:<br>
<br>
> I think putting this à “block the offending traffic pattern” into practice<br>
> is the crux of the issue. Maybe I am short-sighted or don’t give AI<br>
> sufficient credit, but I think identifying the offending traffic pattern is<br>
> not going to be easy (or maybe possible at all).<br>
> <br>
> Anyone initiating a TDOS attack can manipulate the call pattern and caller<br>
> ID easy enough to make it look like ‘normal’ traffic.<br>
<br>
I suppose it depends on how many concurrent channels/call paths the<br>
customer has. Given a very small number, almost any amount of calls can<br>
tie them up.<br>
<br>
But, in general, it's not a DoS attack if it doesn't ... DoS. :-) If<br>
the attackers slow down the call setup rate enough that it doesn't meet<br>
frequency-based DoS detection, chances are it's not a very impactful<br>
attack. Of course, there is a grey area; everything is vague to a degree<br>
we do not realise until we try to make it precise (with apologies to<br>
Bertrand Russell).<br>
<br>
-- Alex<br>
<br>
-- <br>
Alex Balashov | Principal | Evariste Systems LLC<br>
<br>
Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) <br>
Web: <a href="http://www.evaristesys.com/">http://www.evaristesys.com/</a>, <a href="http://www.csrpswitch.com/">
http://www.csrpswitch.com/</a><br>
_______________________________________________<br>
VoiceOps mailing list<br>
VoiceOps@voiceops.org<br>
<a href="https://puck.nether.net/mailman/listinfo/voiceops">https://puck.nether.net/mailman/listinfo/voiceops</a><br>
</div>
</span></font>
</body>
</html>