02:28 PM
Connect Directly

Hacking The TDoS Attack

Rising telephony denial-of-service (TDoS) attacks are not quite as prevalent as a DDoS, but they can be just as deadly

When an ICU nurse refused to pay scammers who insisted she owed money for a payday loan, they unleashed a robo-dial flood of hundreds of calls per hour that ultimately shut down the phone system of the hospital's intensive care unit. In another case, supporters of a popular company that received a negative rating from a major financial firm voiced their displeasure by crowdsourcing phone calls to the firm in an attempt to block its trading and other functions -- and they organized it via a Facebook Event post.

These real-world cases of telephony denial-of-service (TDoS) attacks in the past year didn't get the publicity that distributed denial-of-service (DDoS) attacks did, but security experts say these types of attacks have been on the rise in the past couple of years and can be just as damaging as a DDoS.

"Personally, I believe that it's a more invasive approach to target a company's [or] individual's primary means of communication. Just like DDoS attacks, based on my observations, they tend to abuse the infrastructure of legitimate services, Skype, ICQ, major U.S-based carriers, and relevant SIP providers," cybercrime researcher Dancho Danchev said in an interview via email.

TDoS attacks -- which earlier this year were becoming prevalent enough that the U.S. Department of Homeland Security issued an alert about a threat of TDoS attacks on public sector entities in an attempt to extort money -- are typically similar in motivation and goals as DDoS attacks that flood networks, websites or other servers with massive volumes of traffic meant to bring an organization's data structure to its knees. Call centers are the most popular TDoS targets -- they're easy to contact and flood with calls -- and, increasingly, there are more tools readily available tools for launching these attacks on any organization or individual's location.

Danchev says he started noticing a major increase in TDoS-for-hire services about a year-and-a-half ago, and he sees new vendors emerging regularly. "Since the attacks are requested on demand/for hire, virtually anyone can be targeted based on the preferences of the customer," he says.

Mark Collier, CTO and vice president of engineering for SecureLogix, a TDoS mitigation vendor, says TDoS tools are readily available, especially ones that exploit VoIP. "One major reason it's getting worse is that attackers have access to VoIP, so if they want to flood a major bank with tens of thousands of calls, they can get free Asterisk PBX software. There's inexpensive SIP access," he says.

Arbor Networks says it has seen an increase in TDoS attacks that use Session Initiation Protocol (SIP) traffic to flood VoIP systems. In a recent 24-hour period, Curt Wilson, a research analyst with Arbor, spotted global SIP message-flooding traffic accounting for 31 percent of the total scan traffic found via monitoring with Arbor's ATLAS intrusion detection system.

[There are now more than five phone fraud calls placed per minute, and the volume of these scams increased by 29% in the first half of this year. See Phone Fraud Up 30 Percent.]

Wilson says a SIP flood TDoS attack requires the same mitigation tactics as a DDoS. The most common response to a DDoS attack is to redirect and scrub traffic, as well as block offending sources of the traffic. In the case of the targeted financial firm that ultimately became a customer of SecureLogix, its call center traffic was five times its usual levels at the target time of 11 a.m. Eastern on the Monday morning of the planned attack. SecureLogix employed a multilayer call-blocking ruleset that killed the malicious calls and allowed legitimate calls inbound.

In the case of the ICU nurse, the scammers were all about extortion against payday loan customers. They kept harassing the nurse -- who had previously paid off the loan with the real lender -- with phone calls threatening her credit rating. The volume of automated calls targeting the ICU shut down its phone system such that the ICU's doctors and nurses couldn't make or receive calls. And the attacks continued to threaten other areas in the hospital from the same scammers and other groups, according to SecureLogix, which was commissioned as the hospital group's vendor after the ICU incident.

Just like some DDoS efforts, there are both sophisticated and do-it-yourselfer TDoS attackers. Danchev says he can distinguish between TDoS attacks by sophisticated groups with their own tools and the ones who use DIY tools.

Still, TDoS today isn't on the radar screen for organizations the way DDoS is. "The threat's not taken seriously because organizations want data to present in order to get the necessary budget to implement solutions that would prevent such an attack from taking place within their organizations' boundaries," Danchev says. "Since there's lack of such data/statistics on just how widespread is the problem -- which is something having to do with the fact that since day one TDoS has been largely popular in Russia/Eastern Europe -- it would inevitably put these organizations in a catch-up mode in the long term."

Arbor's Wilson says he sees more DDoS services in the cybercrime underground markets offering TDoS services as well. Most of these ads appear on Russian forums, he says, with some ads appearing in English as well.

TDoS has come a long way from the original attacks against consumers three years ago that flooded them with traffic so no one could verify the fraudulent bank account withdrawals from the victims' accounts. "Over time they began flooding contact centers, different enterprises and 911 centers for purposes of extortion," SecureLogix Collier says.

Meanwhile, the main office of a major U.S. retailer -- and a customer of SecureLogix -- was recently hit with thousands of calls during a period of hours. The calls were about 30 seconds long with an audio recording aimed at tying up circuits while keeping the call alive, SecureLogix discovered. The reason for the attack remains unknown, but SecureLogix officials say the motive was most likely to prevent inbound phone calls.

"TDoS has exploded and is going prime time," says David Heard, vice president of product marketing management for SecureLogix, but it hasn't received much attention, he notes. "TDoS needs a poster child as breakout issue to draw mainstream attention," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-05-27
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time windo...

Published: 2015-05-27
include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that trig...

Published: 2015-05-27
Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to t...

Published: 2015-05-27
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrate...

Published: 2015-05-27
The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?