Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Communications

FBI Vaguely Warns of Asterisk Vishing Vulnerability 57

Posted by kdawson from the do-not-call-back dept.
coondoggie writes in to let us know about a fraud alert issued by the FBI's Internet Crime Complaint Center, warning that an unspecified bug in unspecified versions of Asterisk IP PBX software could allow criminals to generate "thousands of vishing telephone calls to consumers within one hour." PC World checked with Digium, developer of Asterisk, and found some puzzlement as to what bug the FBI had in mind. "In March, researchers at Mu Security reported a bug that could allow an attacker to take control of an Asterisk system. Digium wasn't certain what vulnerability the FBI was referencing in its advisory. However John Todd, the company's Asterisk open-source community director, believes that it was probably this March bug. That vulnerability 'basically allowed you to take over the account of one individual,' he said. ... However, the attack described by the FBI would be extremely hard to pull off, Todd said." Update: 12/09 02:54 GMT by KD : Digium has put out a statement on the IC3 warning (further details), confirming that what the FBI had in mind was an old bug and difficult in the extreme to exploit.
This discussion has been archived. No new comments can be posted.

FBI Vaguely Warns of Asterisk Vishing Vulnerability More

FBI Vaguely Warns of Asterisk Vishing Vulnerability

Comments Filter:

  • Vishing = Voice Phishing (Score:5, Informative)

    by iammani ( 1392285 ) on Saturday December 06, 2008 @03:38PM (#26014971)
    Wouldnt hurt to mention it, in the summary, would it.

    • Re:Vishing = Voice Phishing (Score:4, Funny)

      by mrsteveman1 ( 1010381 ) on Saturday December 06, 2008 @03:54PM (#26015057)

      Oh PHishing! I thought i was just supposed to yell at the fish, but it didn't work =(

      • Re: (Score:1, Funny)

        by Anonymous Coward

        Vhen you vish upon a *...

    • Re:Vishing = Voice Phishing (Score:5, Insightful)

      by ceoyoyo ( 59147 ) on Saturday December 06, 2008 @04:15PM (#26015169)

      Actually, I thought the use of the phrase "vishing telephone calls", while technically redundant, also served to beautifully highlight what a stupid term "vishing" is.

      How exactly is "vishing" different than those idiots who called the other day to tell me I'd won an all expense paid trip to Bermuda, only they needed my credit card information to make the reservations?

      • it's different because those calls aren't trying to steal your credit card info. they're trying to sell you something using, what seems at first glance, an enticing risk-free offer. one is a bait-and-switch tactic, the other is just phishing over the phone. they might both be scams, but the first one is legal and the second one is not.

        i mean, a lot of companies use fine print to lure unsuspecting consumers into really unfavorable contracts. but would you consider that phishing as well? i agree they're both

        • Re:Vishing = Voice Phishing (Score:4, Interesting)

          by cdrguru ( 88047 ) on Saturday December 06, 2008 @05:58PM (#26015713) Homepage

          This problem is that most people of average intelligence and not wealthy are ready and willing to be taken in by almost any sales approach. Trying to outlaw "deceptive marketing" to these people would mean you couldn't sell them a newspaper subscription.

          There are some organizations that go out of their way to mislead people, but most people are very willing to be misled all by themselves and even encourage it. So is it worth trying to explain to someone that if all they want is the Sunday paper that it is actually cheaper to get the whole week's papers because that is how it is sold? Is it really deceptive to give the person what they think they want, regardless that it costs more? Lots of folks would say selling someone what they want when it is more expensive than some alternative is indeed "deceptive". With this in mind, I'd say you would have to get rid of all sales, marketing and advertising to avoid "deceiving" most people of average intelligence.

          • Is it really deceptive to give the person what they think they want, regardless that it costs more?

            Yes.

            Next question, please.

      • Imagine that someone calls you claiming to be your bank/credit card company/etc. AND the caller ID says it is your bank/credit card company/etc.

        • Phunny you should say that ...

          Just yesterday I got a telephone call from the local city-owned electric company. The phone call eventually failed as they were trying to transfer me, and when I called back from my caller-ID display the recording said the number was no longer in service.

          It really was the city-owned electric company, and my point is that forging caller-ID is now both prevalent and acceptable.

          Which blends the line so much that it's becoming harder to tell who's legit and who isn't.

      • Re: (Score:1, Informative)

        by Anonymous Coward

        Ask them to mail you a letter stating the prize and reply in certified mail with a return receipt. If you do not receive what they claim, they will be guilty of a felony - mail fraud.

    • Thanks for that. I was starting to feel old and behind the times because I had to Google it... :)

    • Re: (Score:2)

      by lxs ( 131946 )
      Visher's anthem.

      When you vish upon a star
      Makes no difference who you are
      Anything your heart desires
      Will come to you

    • Vidishing?
      Camishing?
      Pishing?

  • Can you hear me now? (Score:3, Insightful)

    by davidwr ( 791652 ) on Saturday December 06, 2008 @03:39PM (#26014977) Homepage Journal

    Hello? Hello? May I speak to my friend the honorable Mr. JohnSmith@bigcompany.com, President?

    I am Mr. Dramane Yadi, I work in the Accounts/ Operations Department of a Prime banks here in Abidjan Cote D'Ivoire. I actually have an urgent and very confidential business proposal for you. I got your contact from Internet and decided to contact you immediately.
    *CLICK**DIALTONE*
    Hello? Hello? Can you hear me now?

    • Re: (Score:3, Funny)

      by couchslug ( 175151 )

      "I am Mr. Dramane Yadi, I work in the Accounts/ Operations Department of a Prime banks here in Abidjan Cote D'Ivoire. I actually have an urgent and very confidential business proposal for you. I got your contact from Internet and decided to contact you immediately."

      "This is Mr Smith. I would be delighted to do business with you, and you called at the ideal time!
      I have a choice portfolio of mortgage-backed securities and would like to offer you the opportunity...

      *CLICK**DIALTONE*

      • "I am Mr. Dramane Yadi, I work in the Accounts/ Operations Department of a Prime banks here in Abidjan Cote D'Ivoire. I actually have an urgent and very confidential business proposal for you. I got your contact from Internet and decided to contact you immediately."

        "This is Mr Smith. I would be delighted to do business with you, and you called at the ideal time! I have a choice portfolio of mortgage-backed securities and would like to offer you the opportunity...

        *CLICK**DIALTONE*

        A "Real Genius" mome

  • Comment removed (Score:5, Funny)

    by account_deleted ( 4530225 ) on Saturday December 06, 2008 @03:41PM (#26014989)
    Comment removed based on user account deletion

  • "Digium wasn't certain" (Score:4, Insightful)

    by rrohbeck ( 944847 ) on Saturday December 06, 2008 @03:51PM (#26015041)

    ...what vulnerability the FBI was referencing.

    Nice. How many do they have?

  • Vampire dictated? (Score:5, Funny)

    by Rik Sweeney ( 471717 ) on Saturday December 06, 2008 @04:14PM (#26015161) Homepage

    "FBI Vaguely Warns of Asterisk 'Vishing' Vulnerability"

    what's next:

    "FBI Vaguely Warns of People 'Vanting' To Suck Your Blood"

  • Might be this (Score:2, Informative)

    by mlgunner ( 219100 )

    Back in October, one of our servers was compromised using an ssh vulnerability to gain access to the system. What they did was to install Asterisk on our compromised system, and then try to compromise other Asterisk systems on the network. I am not sure as what the actual vulnerability the FBI is talking about, however I do know that they were using asterisk against other PBX systems.

  • That vulnerability 'basically allowed you to take over the account of one individual,' he said. ... However, the attack described by the FBI would be extremely hard to pull off , Todd said.

    Oh it's difficult! (^_^) Good, then it probably wont be exploited.

    Oh... [ic3.gov]

    The recent attacks were conducted by hackers exploiting a security vulnerability in Asterisk software.

  • Because Asterisk is an Open Source project that will really hurt their ability to TAP communications.

    • Because Asterisk is an Open Source project that will really hurt their ability to TAP communications.

      If they wanted to use * to "tap communications", why would they reveal the bug? Anyway, maybe they tap in before it gets to the PBX, like at the phone company?

  • Social engineering is easier than engineering this (Score:5, Interesting)

    by virtualXTC ( 609488 ) on Saturday December 06, 2008 @04:56PM (#26015387) Homepage
    Oddly, about a 1/2 hr before this story was posted I received a similar vishing scam. CallID said +23456, a guy with an American name but Indian-like accent claiming to be from the "United States Federal Grant Program" said that he was going to send me $5000 in grant money. He explained this was because I was a good taxpayer, that I didn't have any felonies, and that I can be given this money for a variety of reasons ranging from family care to school etc.. His accent, and sentence composition totally gave away that he wasn't a US paid telemarketer. Curious about how the scam worked I played along, verifying information about my address that he some how already had. He continued to explain how his company would be transferring money to me as soon as I send back the info they are going to send me. He went on to explain further, then eventually he asked for my bank account info; I deferred him until later, claiming I didn't have it, hung up and called the FBI.

    Oddly, he had such a long story, and the way he extracted info (aside from his accent) seemed pretty reasonable. I could totally see some fool (my mother) assuming that since the incoming number wasn't a normal one, that only possible explanation was that the government could be calling them.

    Strangely, the FBI took my call and I spoke with a detective, however, they were unwilling to work with me to try and catch this guy, because the amount of money he was scamming wasn't high enough; apparently he has to scam $300,000 before they will allocate any resources toward the case!!! It's no wonder there's such a problem with this type of scamming.
    • but... do you have an Asterisk PBX?

    • Re: (Score:3, Interesting)

      by Tanktalus ( 794810 )

      Strangely, the FBI took my call and I spoke with a detective, however, they were unwilling to work with me to try and catch this guy, because the amount of money he was scamming wasn't high enough; apparently he has to scam $300,000 before they will allocate any resources toward the case!!!

      A minimum scam of $300,000 before the FBI gets involved is +1, Informative, right there. Further to that, any pretense that the cops have about "Crime doesn't pay" is busted right there. Not that I believed them prior to this, but, by itself, that pretty much proves itself right there. Assuming a smart criminal (ok, that's a stretch), you could go out, scam $290,000, and fly under the FBI's radar. That's approximately equivalent to $400,000 at approximately a 25% income tax rate (assuming you don't file

      • Re: (Score:2)

        by adolf ( 21054 )

        I find your ideas intriguing, and would like to subscribe to your newsletter.

        What version of Asterisk was that, again?

      • Re: (Score:2, Troll)

        by jlarocco ( 851450 )

        Sounds like crime pays to me...

        Sigh.

        It's $300k before the FBI gets involved. The OP is an idiot, and should have contacted his local police or state bureau of investigation. Believe it or not, not everything is a federal problem. You wouldn't call the FBI if your car was vandalized, or if your neighbors were fighting really loud, so why would you call them for this?

        If the local people get enough calls about it, they'll route it to the FBI when it gets over $300k.

      • Re: (Score:1, Interesting)

        by Anonymous Coward

        it rises on a yearly basis it seems. just 4 years ago it was $50,000, two years ago it was $100,000.

        And even then, that's not necessarily true. I work for a payroll company, we basically handle the direct deposits. Some scammers are very good and manage to take some of the more idiotic sales guys for millions and we still have issues getting feds involved.

        Works something like this, they create a fake company with several other guys who are in on it, rent a building for a few days, put on a show for the sale

    • Re: (Score:2, Interesting)

      by SunSpot505 ( 1356127 )
      We have also been subject to an Asterisk Vishing scam. We are an outbound autodialer, and somebody compromised a testing account that did not have a good password and attempted to use our PBX to pass on their Vishing message. It was for a bank and asking people to verify account information. Seriously??

      We are always on our * console so it was shut down immediately. We called the a$$hole back too and listened to him sweat while driving in traffic. Still, weird stuff... I was considering filing an FBI
  • .. write access to a single file under Asterisk configuration grants you full control of the dialer. A number of hacking techniques, as well as a misconstrued box can lead to this. Moreover, if it happens to be running under Windows, then possibilities are limitless.

  • Digium posted an "official" reply here:
    http://blogs.digium.com/2008/12/06/sip-security-and-asterisk/

    There was a bug in Asterisk that allowed unauthenticated callers to access the guest context, but in order for that to be a threat one would have to configure the dialplan such that guests were able to dial out on whatever PSTN trunk (SIP or analog/digital trunk) was attached to the system. Unlikely a huge threat, and that bug was fixed 9 months ago for 1.2 and 1.4, and doesn't exist for 1.6.

    M

  • Just use FreeSWITCH instead of Asterisk, it's a lot better. Asterisk is worthless and broken software.

  • FBI updates the release and says yes, it's just a re-hash of an old security notice that went out in March.

    http://www.ic3.gov/media/2008/081205-2.aspx

    See the Asterisk [UPDATE] here:

    http://blogs.digium.com/2008/12/06/sip-security-and-asterisk/

Slashdot Top Deals

We are Microsoft. Unix is irrelevant. Openness is futile. Prepare to be assimilated.

Close