Telecommuncation problems? Steven Branigan District Manager, Corporate Computer and Network Security
Telecommuncation problems? Steven Branigan District Manager, Corporate Computer and Network Security 2 march 1999 We make the things that make communications work.™ © Lucent Technologies -- All rights reserved It can’t be that difficult! Just a bunch of LATAs Courtesy of US WATS from the fcc.gov web page We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Telephony issues Frauds wireless coin landline Recent exploits We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Let’s start with General Billing Coin phone: pay as you go. Prepaid: pay in advance. Calling credit: credit Residence/business line: credit We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Traditional frauds I make the call, you pay the bill Clip on fraud. Cordless phone fraud. Calling card fraud Boxes. (red, blue…) Cloning Subscriber fraud We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Coin phone coin phone Network controlled pay phones. Customer owned payphones Pay as you go, and you know exactly how much the call costs. Carrier is selected by the coin phone. Of course the red box was a common coin fraud. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Of interest Incoming payphones in certain LATAs must allow incoming calls. The calling party controls the connection until a timeout in the US. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Calling card Can be used from a residential or coin phone. In this cases, the user has no idea how much the call costs. Calling cards and pins are compromised frequently. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Exploit #1 Insider at a telco gained access to an SS7 network element Crafted SS7 messages that issues C.C. queries to SS7 database. Automated process rotated calling card number, kept the pin constant. Avoiding fraud detection mechanisms. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Exploit #2 A potential payphone user would hear a ringing payphone at a busy location. The user would pickup and hangup. Then the user would place a calling card call, and the calling card was compromised. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Exploit #2 Hypothetical Payphone located in Chicago. Fraudster located in NYC. Fraudster calls payphone in Chicago. When the call is answered, the fraudster plays dialtone (from NYC) into the payphone. Person in chicago believes the dialtone is from chicago, and places a calling card call. The NYC fraudster completes the call, and collects the calling card number. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved What about toll free calls Calls to specific number may be toll free. In this call model, the party called actually pays for the call. Currently, 800, 888 and 877 are toll free numbers in the US We make the things that make communications work.™ © Lucent Technologies -- All rights reserved An old toll-free case The “stolen” 800 number. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved It could happen to anyone… It started with a book on Internet security being recovered on a drug raid… We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Using a tapped phone line for profit. A phone line was tapped that was used for credit card validations. The rest, as we say, is history. (and people worry about using their credit card on the Internet?) We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Investigative tools Dialed Number Recorder (DNR) Trap & trace Wiretap Billing records Caller id? We make the things that make communications work.™ © Lucent Technologies -- All rights reserved CO Switch Line history block < op:ilhb,dn=7329491999; PF S570-15073350 95-11-12 15:45:15 075603 MTCE M OP ILHB DN=7329491999 DATE=11/12 TIME=15:42 LICDN=7326241024 MULT_CALL=YES PRIV_INC=NO TRACE=NO IDP=YES SCREENING=NP ADDR_TYPE=NATL NUM_PLAN=ISDN UNIQ=YES CNPR_INC=NOP We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Trap and Trace Example output < op:clid; PF S570-15073350 95-11-12 15:45:22 075605 TRCE XXX M OP CLID LIST CONTAINS 2 NUMBERS SECTION 1 OF 1 5550101 7329491999 We make the things that make communications work.™ © Lucent Technologies -- All rights reserved The CCS/SS7 network SCP SCP SCP STP STP CO/SSP CO/SSP trunks We make the things that make communications work.™ © Lucent Technologies -- All rights reserved CCS/SS7 network Issues SS7 messages obtainable (think pins) Remote maintenance of switches Remote maintenance of databases Many telephone lines rely on a single system We make the things that make communications work.™ © Lucent Technologies -- All rights reserved PBX A great target for the call sell operation. In order to save money, some corporations allow for dial-out capability in their PBX. A user can call into the PBX using a toll free number, than call any number in the world. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Cellular Hello, you’re on the air! Wireless telephone communication. Phone number doesn’t determine physical location! Conversation broadcast within cell. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Cellular tracking? We make the things that make communications work.™ © Lucent Technologies -- All rights reserved The future Local number portability. Voice/video over the Internet. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Local number portability A user will be able to keep their phone number forever, (as long as they are in the US) This will remove geographical issues from wire-line telephone numbers just as it has been removed from cellular. 10 digit dialing will become much more common. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Area code splits dividing a specific area code into two area codes. Increases the available telephone numbers in the network Two mechanisms, geographical splits or overlays. Makes the concept of a long distance call more confusing. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Geographic split Neighboring call can still be dialed with only 7 digits. NJ’s 908/732 area code split is an example of a geographic split. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved Area code overlay Requires that all calls are dialed with 10 digits. NYC’s 212 area code split is an example of an area code split overlay. We make the things that make communications work.™ © Lucent Technologies -- All rights reserved
© Copyright 2024