Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/30/2013
02:28 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Hacking The TDoS Attack

Rising telephony denial-of-service (TDoS) attacks are not quite as prevalent as a DDoS, but they can be just as deadly

When an ICU nurse refused to pay scammers who insisted she owed money for a payday loan, they unleashed a robo-dial flood of hundreds of calls per hour that ultimately shut down the phone system of the hospital's intensive care unit. In another case, supporters of a popular company that received a negative rating from a major financial firm voiced their displeasure by crowdsourcing phone calls to the firm in an attempt to block its trading and other functions -- and they organized it via a Facebook Event post.

These real-world cases of telephony denial-of-service (TDoS) attacks in the past year didn't get the publicity that distributed denial-of-service (DDoS) attacks did, but security experts say these types of attacks have been on the rise in the past couple of years and can be just as damaging as a DDoS.

"Personally, I believe that it's a more invasive approach to target a company's [or] individual's primary means of communication. Just like DDoS attacks, based on my observations, they tend to abuse the infrastructure of legitimate services, Skype, ICQ, major U.S-based carriers, and relevant SIP providers," cybercrime researcher Dancho Danchev said in an interview via email.

TDoS attacks -- which earlier this year were becoming prevalent enough that the U.S. Department of Homeland Security issued an alert about a threat of TDoS attacks on public sector entities in an attempt to extort money -- are typically similar in motivation and goals as DDoS attacks that flood networks, websites or other servers with massive volumes of traffic meant to bring an organization's data structure to its knees. Call centers are the most popular TDoS targets -- they're easy to contact and flood with calls -- and, increasingly, there are more tools readily available tools for launching these attacks on any organization or individual's location.

Danchev says he started noticing a major increase in TDoS-for-hire services about a year-and-a-half ago, and he sees new vendors emerging regularly. "Since the attacks are requested on demand/for hire, virtually anyone can be targeted based on the preferences of the customer," he says.

Mark Collier, CTO and vice president of engineering for SecureLogix, a TDoS mitigation vendor, says TDoS tools are readily available, especially ones that exploit VoIP. "One major reason it's getting worse is that attackers have access to VoIP, so if they want to flood a major bank with tens of thousands of calls, they can get free Asterisk PBX software. There's inexpensive SIP access," he says.

Arbor Networks says it has seen an increase in TDoS attacks that use Session Initiation Protocol (SIP) traffic to flood VoIP systems. In a recent 24-hour period, Curt Wilson, a research analyst with Arbor, spotted global SIP message-flooding traffic accounting for 31 percent of the total scan traffic found via monitoring with Arbor's ATLAS intrusion detection system.

[There are now more than five phone fraud calls placed per minute, and the volume of these scams increased by 29% in the first half of this year. See Phone Fraud Up 30 Percent.]

Wilson says a SIP flood TDoS attack requires the same mitigation tactics as a DDoS. The most common response to a DDoS attack is to redirect and scrub traffic, as well as block offending sources of the traffic. In the case of the targeted financial firm that ultimately became a customer of SecureLogix, its call center traffic was five times its usual levels at the target time of 11 a.m. Eastern on the Monday morning of the planned attack. SecureLogix employed a multilayer call-blocking ruleset that killed the malicious calls and allowed legitimate calls inbound.

In the case of the ICU nurse, the scammers were all about extortion against payday loan customers. They kept harassing the nurse -- who had previously paid off the loan with the real lender -- with phone calls threatening her credit rating. The volume of automated calls targeting the ICU shut down its phone system such that the ICU's doctors and nurses couldn't make or receive calls. And the attacks continued to threaten other areas in the hospital from the same scammers and other groups, according to SecureLogix, which was commissioned as the hospital group's vendor after the ICU incident.

Just like some DDoS efforts, there are both sophisticated and do-it-yourselfer TDoS attackers. Danchev says he can distinguish between TDoS attacks by sophisticated groups with their own tools and the ones who use DIY tools.

Still, TDoS today isn't on the radar screen for organizations the way DDoS is. "The threat's not taken seriously because organizations want data to present in order to get the necessary budget to implement solutions that would prevent such an attack from taking place within their organizations' boundaries," Danchev says. "Since there's lack of such data/statistics on just how widespread is the problem -- which is something having to do with the fact that since day one TDoS has been largely popular in Russia/Eastern Europe -- it would inevitably put these organizations in a catch-up mode in the long term."

Arbor's Wilson says he sees more DDoS services in the cybercrime underground markets offering TDoS services as well. Most of these ads appear on Russian forums, he says, with some ads appearing in English as well.

TDoS has come a long way from the original attacks against consumers three years ago that flooded them with traffic so no one could verify the fraudulent bank account withdrawals from the victims' accounts. "Over time they began flooding contact centers, different enterprises and 911 centers for purposes of extortion," SecureLogix Collier says.

Meanwhile, the main office of a major U.S. retailer -- and a customer of SecureLogix -- was recently hit with thousands of calls during a period of hours. The calls were about 30 seconds long with an audio recording aimed at tying up circuits while keeping the call alive, SecureLogix discovered. The reason for the attack remains unknown, but SecureLogix officials say the motive was most likely to prevent inbound phone calls.

"TDoS has exploded and is going prime time," says David Heard, vice president of product marketing management for SecureLogix, but it hasn't received much attention, he notes. "TDoS needs a poster child as breakout issue to draw mainstream attention," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
New FISMA Report Shows Progress, Gaps in Federal Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/21/2019
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15531
PUBLISHED: 2019-08-23
GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTOR_dvi_extract_method in plugins/dvi_extractor.c.
CVE-2019-10746
PUBLISHED: 2019-08-23
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
CVE-2019-10747
PUBLISHED: 2019-08-23
set-value is vulnerable to Prototype Pollution in versions before 2.0.1 and version 3.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.
CVE-2019-10750
PUBLISHED: 2019-08-23
deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.
CVE-2019-10751
PUBLISHED: 2019-08-23
All versions of the HTTPie package are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.