<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.emailquote, li.emailquote, div.emailquote
{mso-style-name:emailquote;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:1.0pt;
border:none;
padding:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
Mike,<br>
<br>
While interesting I am more concerned about actual denial of service attacks. Like if I hacked a couple hundred elastix pbxs and used their capabilities to hammer a customer's main number during business hours. Even though they have 50 call paths on their sip
trunk it would be saturated easily and reacting takes time. Hours or more? And that assumes a trivial attack without obfuscating the calls in some fashion.<br>
<br>
Matt
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Mike Ray, MBA, CNE, CTE <mike@astrocompanies.com><br>
<b>Sent:</b> Tuesday, May 16, 2017 7:29:49 PM<br>
<b>To:</b> Matthew Yaklin; 'Alex Balashov'<br>
<b>Cc:</b> voiceops@voiceops.org<br>
<b>Subject:</b> RE: [VoiceOps] Mitigating or stopping TDOS attacks - any advice?</font>
<div> </div>
</div>
<div>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hi Matt,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">You may want to look into Nomorobo. We certified with them some time ago, and they have a very interesting way of doing this.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Mike Ray, MBA, CNE, CTE<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Astro Companies, LLC<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">11523 Palm Brush Trail #401<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Lakewood Ranch, FL 34202<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">DIRECT: call or text 941 600-0207<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="http://www.astrocompanies.com"><span style="color:#0563C1">http://www.astrocompanies.com</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> VoiceOps [mailto:voiceops-bounces@voiceops.org]
<b>On Behalf Of </b>Matthew Yaklin<br>
<b>Sent:</b> Tuesday, May 16, 2017 6:22 PM<br>
<b>To:</b> Alex Balashov <abalashov@evaristesys.com><br>
<b>Cc:</b> voiceops@voiceops.org<br>
<b>Subject:</b> Re: [VoiceOps] Mitigating or stopping TDOS attacks - any advice?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><br>
I noticed how you mentioned asterisk and if it could handle that many calls and you seemed skeptical. Probably based on experience. After all these years I thought a single asterisk server could handle more calls in a stable fashion but it appears not. Once
past 500 concurrent calls, depending on hardware and config, things start to get sketchy. It has been a while since I last used asterisk for a VM server or pbx. Those days seem long ago.<br>
<br>
Over the years we have had customers experience TDOS. While we have no current customer experiencing the issue today we wanted to research our options just in case.<br>
<br>
It seems metaswitch has a cloud based robocall blocking feature we just read about. I have to wonder if that hook in the switch could be used for something.<br>
<br>
As others have said though... gathering all this cdr info, analyzing it, and then blocking certain calls while keeping good ones is quite the task to program. And to do it really fast. One can stop trivial attacks that have a pattern but a determined attacker
can be quite crafty.<br>
<br>
Thank you everyone,<br>
<br>
Matt <o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="x_divRplyFwdMsg">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">
<a href="mailto:sasha@evaristesys.com">sasha@evaristesys.com</a> <<a href="mailto:sasha@evaristesys.com">sasha@evaristesys.com</a>> on behalf of Alex Balashov <<a href="mailto:abalashov@evaristesys.com">abalashov@evaristesys.com</a>><br>
<b>Sent:</b> Tuesday, May 16, 2017 5:01:04 PM<br>
<b>To:</b> Matthew Yaklin<br>
<b>Cc:</b> <a href="mailto:voiceops@voiceops.org">voiceops@voiceops.org</a><br>
<b>Subject:</b> Re: [VoiceOps] Mitigating or stopping TDOS attacks - any advice?</span>
<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt">A "voice CAPTCHA" is a viable solution. But it does require<br>
infrastructure commitments on your part, even if, as you say, an<br>
Asterisk box can handle many concurrent calls. If you want to recycle<br>
that across multiple customers, that kind of moat can get mildly<br>
complicated.<br>
<br>
The only concern I would have is from a user experience point of view;<br>
your customer might not want their callers to have to go through a<br>
confusing menu, and it would doubtless be psychologically off-putting.<br>
I don't know what kind of business the customer is, but imagine if you<br>
called your dentist's office and were prompted to enter some sort of<br>
PIN. As a layperson, you might think something is wrong with the phone<br>
system.<br>
<br>
-- <br>
Alex Balashov | Principal | Evariste Systems LLC<br>
<br>
Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) <br>
Web: <a href="http://www.evaristesys.com/">http://www.evaristesys.com/</a>, <a href="http://www.csrpswitch.com/">
http://www.csrpswitch.com/</a><o:p></o:p></span></p>
</div>
</div>
</div>
</body>
</html>