Spam Over Internet Telephony (SPIT) to Come? 194
grub writes "According to this article on NewScientist.com 'Spam and spim - spam by instant messenger -- are about to be joined by "spit" - spam over internet telephony' Yup, spam via VoIP."
Hah! (Score:5, Funny)
Way to go.
Re:Hah! (Score:5, Funny)
Re:Hah! (Score:2)
Re:Hah! (Score:4, Insightful)
I'd love to see a bayesian filter for voice data.
Re:Hah! (Score:2)
Legislation botched, prone to abuse by lawyers, and gutted by amendments sponsored by Association of Direct Marketers. At least that's my bet.
I'd love to see a bayesian filter for voice data.
It's more effective than relying on legislation. My personal bet is on blocklists of known-spamming IDs or IPs, and letters-in-a-picture checks (or hashcash-based limiters)
Re:Hah! (Score:3, Funny)
Sorry, can't help it...
Why so surprised? (Score:5, Insightful)
Re:Why so surprised? (Score:5, Interesting)
I don't think that's how it works. I don't think anyone responds to your typical spam; rather, they harvest working emails and sell those to less-than-scrupulous companies. That's where the real profits are, so it doesn't matter if people respond or not.
I could be wrong though.
Re:Why so surprised? (Score:3, Interesting)
Re:Why so surprised? (Score:3, Insightful)
Re:Why so surprised? (Score:4, Insightful)
Hint to spammers: You don't actually have to send out the spam, just say you do and pocket the money. Everyone will be happier. (Including your clients who mostly get a blackeye and aggrevation out of your services.)
Re:Why so surprised? (Score:4, Informative)
Re:Why so surprised? (Score:2, Interesting)
Basically whitelist everyone you know. If you don't know them they get forwarded to voicemail and you can check their phone number before you listen to their message.
Easy enough to block them. If they have no caller ID information auto-block.
Re:Why so surprised? (Score:2)
Making it a crime to BE scammed is almost funny in my book.
Re: (Score:3, Funny)
SPAM the SPAMMERS (Score:3, Interesting)
I've often wondered what would happen if EVERYONE allocated just 5 minutes per day to "responding" to spam... heck we spend that long deleting the stuff or updating mail filters anyway.
Just pick a couple of spams and:
- View the web site
- If you can find an email address or contact form for the seller, abuse it. (do not use your own email address if possible)
- If you can find a free-call number, ring it - and keep them busy as long as you feel the need to - the company is paying for your call.
- Request
Re:Why so surprised? (Score:2)
I'm just saying that as of now it is prett
No surprise, but let's get some tools (Score:5, Informative)
Many of these techniques can be adapted to VoIP systems. I am surprised that SER [iptel.org] and Asterisk [asterisk.org] do not already support DNSBLs -- even if there is no call for them yet, we will certainly need published lists of abusive hosts or networks within a few years.
The flexibility with which one can express access restrictions is an important part of any system's security. My workplace is just starting a VoIP deployment. I want to be able to say things like:
Re:No surprise, but let's get some tools (Score:2)
(Hint: See RFC 1123)
Re:Why so surprised? (Score:2)
for example there's this italian jackass with a website with a bunch of pictures of him.. and he's running a fucking spambot on ircnet to advertise it. zero profit or anything for him, except maybe some people see pics of him, basically the guy is just being a fucking asshole.
well, haven't been spammed on skype yet
Publicly behead spammers. (Score:4, Funny)
Re:Publicly behead spammers. (Score:4, Funny)
"S33 A sPamner beh3aded! Your credit card here!"
Re:Publicly behead spammers. (Score:2)
please don't spit (Score:1)
Names for tools? (Score:4, Funny)
Personal Telephoney Objectionable Object Immediate Eradication
SPam Eradication Wirelessly
Highly Unwanted Reduction Logic
Re:Names for tools? (Score:2)
Re:Names for tools? (Score:2)
Now Hear This.... (Score:3, Funny)
Re:Now Hear This.... (Score:4, Interesting)
Re:Now Hear This.... (Score:2, Funny)
Pen1s
En1argemen+
p1||5
4
u
{/spam}
{hawking}
Pen One Ess
En One argemen plus
pee One Bar Bar five
four
you
{/hawking}
Though I think spam filters can handle this kind of thing already, the problem comes the message subjects with random none english strings in the title.
What is a cursory glance to us may infact take a number of seconds before realising theres a problem with it.
"Message from your friend wuidfn32rh 32 923hwnefwe"
As somebody once said... (Score:5, Funny)
Its been said but it needs to be said again... (Score:5, Funny)
Re:Its been said but it needs to be said again... (Score:2, Funny)
Goatse!
At least (Score:4, Insightful)
Re:At least (Score:4, Interesting)
Re:At least (Score:3, Insightful)
Hold yer horses there Mr Rose-Colored Glasses: Spamers aren't exactly known for their ethical consuption of paid-for-out-of-pocket bandwidth. I'm sure it would be trivial to turn zombied computers into SPIT-bots.
Re: (Score:3, Insightful)
For the short term (Score:3, Insightful)
Re:At least (Score:2, Funny)
Now look here, I despise the telecom companies as much as you do, but I'm a bit nicer about it.
Screening calls? (Score:4, Informative)
If telemarketers leaving voice mail becomes a problem, I'm sure that's quickly addressed by the service provider (=store no voice mail from abroad or from unknown numbers).
Might not work for much longer (Score:3, Informative)
* Caller ID Falsification Service [slashdot.org]
* Caller ID Spoofing Firm Gets Death Threats [slashdot.org]
I'm sure people can be fooled into answering calls apparently originating from their own phone number...
Woo Hoo Cares (Score:1, Insightful)
Clever acronyms (Score:4, Funny)
SPam Ethernet Wires?
SPam over Low Amplitude Telephony?
SPam Over Older Generation Ethernets?
Something tells me that this is about to get sillier...
Re:Clever acronyms (Score:3, Funny)
Re:Clever acronyms (Score:2)
Re:Clever acronyms (Score:2)
Re:Clever acronyms (Score:2)
Optimistic (Score:4, Insightful)
Hopefully SPIT dosen't go this far... (Score:2, Funny)
Hello?
Hello! We have some wonderful Costa Rican Properties for sale. For more info, please visit wearetryingtoripyouoff.info. Or, if you are lacking in a certian area, you can receive generic drugs from us directly. Just go to the same site. (In a fast, hurried tone) To remove yourself from out call list, please call the following number: 8003287448 Thank you!
Re:Hopefully SPIT dosen't go this far... (Score:3, Insightful)
Besides, it'll all be automated
Good luck (Score:5, Funny)
Re:Good luck (Score:2, Funny)
So one day I got their 800 number and kept calling them from two different lines and putting them on conference. It was a riot listening to the telemonkeys trying to figure who they were talking to.
When they finally figured it out they threatened my with all kinds of shit. I told them that I'd meet them in court anytime.
Re:Good luck (Score:2)
Now, all is needed is an asterisk exchange where any SIP user can send the tele* to so that they'll automatically be connected to each other !
hurray for spit! (Score:2, Interesting)
Then there's SPAT (Score:3, Insightful)
Otherwise known as mortgage brokers and insurance salesmen who call you at dinnertime.
World Changing Development (Score:4, Funny)
Re:World Changing Development (Score:2)
I wish-- I have a cellphone so until they make it legal to telemarket mobile phones I _still_ won't get any calls
:-(
Beep! Beep! Beep! (Score:5, Insightful)
He adds that viruses are also possible with VoIP. A virus sent to phones could be used to launch more spit or to bring together thousands of VoIP systems to launch denial-of-service attacks.
Yeah, right, 'cause we always execute our voice mail messages!
Also, how is spamming voice mail via VoIP any different than just calling everybody up POTS?!? This article sounds more like another company trying to promote their "solution in search of a problem." Here's a hint: if spammers spoof their caller id and figure out how to insert random variations in the outgoing messages, this system isn't going to work anyway!
Re:Beep! Beep! Beep! (Score:2, Insightful)
Because the laws that dictate standard telephony services provided by phone companies do not apply to VoIP.
I can see it now ... (Score:2)
Re:Beep! Beep! Beep! (Score:4, Insightful)
I am not saying it is easy to do, but it is a possibility.
Re:Beep! Beep! Beep! (Score:2)
None of these are true for VoIP currently.
Re:Beep! Beep! Beep! (Score:2)
Re:Beep! Beep! Beep! (Score:2)
And we used to think:
Yeah, right, 'cause we always execute our mail messages!.
Then look what OE brought us.
Or:
Yeah, right, 'cause we always execute our webpages!
IE.
Or:
Yeah, right, 'cause we always execute our scroll bars!
Again, IE.
Or:
Yeah, right, 'cause we always execute jpegs!
Microsoft.
If it's technological and has software behind it, consider it to have a vulnerability. What we think can't happen now may very well happen not
Re:Beep! Beep! Beep! (Score:2)
Yes they do. It's called Windows XP.
http://www.microsoft.com/windowsxp/evaluation/feat ures/communication.mspx [microsoft.com]
Re:Beep! Beep! Beep! (Score:3, Insightful)
Alas, this is not so far-fetched, as the buffer overflow exploits in JPEG decoders illustrates.
Voice will almost certainly not be sent as plain DAC samples, but in some compressed form (MP3, Vorbis, Speex, etc.) requiring decoding in software. If your codec is not bulletproof, then a mailiciously-formed compressed audio stream could conceivably exploit the hole and take over your machine.
Remember that many VoiP clients are running on Wind
It's terrorism it needs to be stopped! (Score:2)
It was overheard that Dick Cheney has said something to the effect that Kerry was soft on spam terrorists...
Story at 11:00...
Re:Beep! Beep! Beep! (Score:2, Interesting)
Disclaimer/Clarifier: I install/configure/troubleshoot VoIP and IP telephony for a living (Cisco's version). I do it all day everyday - this is one of the few slashdot stories I am qualified to post about. So indulge me:
First - almost all residential VoIP customers still are using analog phones. You plug your analog phone into a device that converts analog signal to IP. So you can't fubar an analog phone with a virus or send spam to
Re:Beep! Beep! Beep! (Score:2)
I'd just like to point out that there has been exploits for the phone system since the days of Captain Crunch.
Secondly, there are already exploits for Cisco VOIP phones.
Lastly, the viruses he's talking about would exploit defects in the code by sending malformed RTP packets or SIP headers.
I myself have managed to accidentally crash an IAD by sending a malformed ATM packet with G711 voice data in it, so DOS attacks are even easier.
This a
Question. (Score:5, Insightful)
Read: telemarkerters.
What do they stop at? Nothing.
Not sure... (Score:5, Interesting)
VoIP is end-to-end, so if someone starts "spitting" the network, he can easily be blocked.
Of course, other solutions would be to have white lists for VoIP, but it is weird to think about white lists to telephony, since the idea is that anyone could reach anyone.
I think dubious character companies will try to do it anyway for some time, but with time blocking will keep the problem to manageable levels.
Re:Not sure... (Score:2)
Spit the dog (Score:2)
Phone Spam Legislation (Score:4, Interesting)
Breath People! (Score:5, Insightful)
As for spit, I really don't plan on getting VoIP anytime soon as I'm satisfied by my POTS landline. Do I have to pay taxes on it, yes; so what? We pay taxes on everything, including VoIP indirectly. You might not have taxes on VoIP, yet, but I'll bet there are taxes and surcharges on your Cable/DSL bill. The article itself does not have much content past the rhetorical comments regarding growth and registries. And the moment that I get a virus on my telephone is the moment I dig out an old beige mechanical AT&T phone. Seriously, how many features does your household phone need? Caller ID, sure; Call Waiting, nah, if its important, they'll call back; voicemail, get an answering machine and save $5/mo.; etc.
Take a deep breath people and realize that humans and our respected cultures have existed for thousands of years and by turning your electronic toys, at least for a few minutes, you might find peaceful relaxation or learn something that does not have power requirement.
But what do I know, it seems the Slashdot audience lives behind the glow rather than under the sun, so I may be preaching to the wrong crowd. --Amigori
acronym of the day (Score:3, Funny)
Not to worried.... (Score:5, Interesting)
Cryptographic solutions would probably be the first place to look. For example, suppose my phone will only look at incoming connections which are begun with some certificate signed by the VoIP service provider (Vonage, Skype, whatever). So, in order to be able to call me, your phone first contacts the provider, requests a certificate to connect to me, and the provider gives that to the phone, and then their phone uses that as credentials to get my phone to not ignore it. Then, all the service provider has to do is watch out for excessive numbers of connections coming from one customer.
I wouldn't be surprised in the least if this isn't already built into the VoIP systems. After all, we've been trying for some time now to move email into the domain of cryptographic authentication (SPF is just an intermediate fix) to stop spam. So, we've known for a while that this is "the way to do it right", and we also know from the way e-mail is going that it's a major pain to try to change the system to use it after the system is already in place. So, I'd expect that they might already have this capability.
Re:Not to worried.... (Score:2)
Re:Not to worried.... (Score:2)
Why not have a whitelist based on a web of trust like gpg has? Or does it already exist? I don't use VoIP, so I'm not really sure.
That's half the proof... (Score:2, Funny)
But what about the other half? There's the porn?
Sorry, Don't Buy It! (Score:3, Insightful)
Unfortunately, I don't see how this problem is going to affect me when my ATA only accepts directives from VoicePulse, Vonage, Broadvoice or whoever's switch to which I'm buying service. Worse, it sits behind a router so there's NFW the ATA is going to even see packets that are not "new, established or related" (iptable speak).
Perhaps the author hasn't effectively communicated how this technology works, or maybe the company isn't divulging how it works, or maybe the have a great solution looking for a problem.
As mentioned here many times before, "move along, nothing to see".
Spit? (Score:2)
Telemarketting? (Score:2, Insightful)
Or maybe ALL of the regulations. It all depends on how the corts see it when someone desides to sue over it.
Spammers have said "Spam is just like other forms of marketting" putting on some fake eco-friendly face on spam with domain names like "SaveTrees" etc.
But Spam was never regulated and the other forms of "direct marketting" are.
Voice over IP or Telephony is basicly the Internet answer to the telephone but there are some major diffrences.
He
Re:Telemarketting? (Score:2)
There are rules and regulations as to whom you can call with telemarketting and how you may obtain a phone number. VoIP has no such rules.***
however.. sometimes the existing laws apply, regardless of if you're using a new technology to make the 'call'.
(like with a lot of things.. just because it's "on the internet" doesnt make it legal because there's no law that says specifially "on the internet...")
*Not* exactly, AFAICT (Score:2)
But I really, really don't see how services like Vonage, Packet8, Broadvoice, Broadvox, Primus/Lingo, etc. can fall victim to this type of thing, because they are inherently different from the FWD and Skype-alikes in that you pay for the service, have tie-ins to the POTS network, and are assigned a real POTS-addressable phone number. T
Death by spam (Score:2)
They know they can hide only from the least informed people. I check the news every day hoping those bastards get what's coming to them.
Disturbing the Peace? (Score:3, Interesting)
Any attorneys care to comment?
Combine Them (Score:2)
Spam Harnessing Internet Technology (SHIT).
Um, hello, SPOIT? (Score:2)
Has anyone here ever bought..... (Score:2)
GJC
Re:Has anyone here ever bought..... (Score:2)
GJC
Re: SPIT vs SWALLOW (Score:2, Funny)
Sure you can! (Score:2)
Re:Don't give 'em any ideas (Score:2)
Re:Don't give 'em any ideas (Score:2)
Re:Whatever (Score:2)
I almost got a degree in Marketing before I realized I wasn't qualified, I have a consience!
Re:Whatever (Score:2)
How well has that worked with blocking SPAM?
Not very well, at least not for long.
Re:Whatever (Score:2)
Re:Anybody Blind? (Score:2)
Spam is already a contraction of Spiced Ham (Hormell). SHIT seems to be as an acronym here as any.
Re:is it a problem at all? (Score:2)