Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

University Researchers Develop New Technology To Trace Fraudulent Voice Calls

Georgia Tech development could help tag 'vishing' calls and separate them from legitimate phone traffic

A team of researchers in the Georgia Tech College of Computing has found a way to tag fraudulent calls with a digital "fingerprint" that could help separate legitimate calls from phone scams.

Voice phishing ("vishing") has become much more prevalent with the advent of cellular and Voice over IP (VoIP) networks, which enable criminals to fake caller ID information and to route calls through multiple networks to avoid detection. But the researchers say each network that carries a call leaves its own telltale imprint on the call itself, and individual phones have their own unique signatures as well.

Funded in part by the National Science Foundation, the Georgia Tech team created a system called "PinDr0p" that can analyze and assemble those call "artifacts" to create a fingerprint -- the first step in determining "call provenance," a term the researchers coined. The work was described in a paper presented earlier this week.

"PinDr0p needs no additional detection infrastructure; all it uses is the sound you hear on the phone. It's a very powerful technique," says Mustaque Ahamad, professor in the School of Computer Science and director of the Georgia Tech Information Security Center (GTISC).

PinDr0p exploits artifacts left on call audio by the voice networks themselves. For example, VoIP calls tend to experience packet loss -- split-second interruptions in audio that are too small for the human ear to detect. Likewise, cellular and public switched telephone networks (PTSNs) leave a distinctive type of noise on calls that pass through them, the researchers say.

Phone calls often pass through multiple VoIP, cellular, and PTSN networks, and call data is either not transferred or transferred without verification across the networks. Using the call audio, PinDr0p employs a series of algorithms to detect and analyze call artifacts, then determines a call's provenance (the path it takes to get to a recipient’s phone) with at least 90 percent accuracy, according to the research.

Patrick Traynor, assistant professor of computer science, says that though the technology is modern, vishing is simply classic wire fraud: Someone gets a call that, based on caller ID information, appears legitimate, and the caller asks the recipient to reveal personal information, such as credit card and PIN details.

PinDr0p is doubly effective for fraud detection, Traynor said, because it relies on call details outside the caller's control. "They're not able to add the kind of noise we're looking for to make them sound like somebody else," he said. "There's no way for a caller to reduce packet loss."

In testing PinDr0p, the researchers analyzed multiple calls made from 16 locations as far flung as Australia, India, United Arab Emirates, the U.K., and France. After creating a fingerprint for calls originating from each location, they were able to correctly identify subsequent calls from the same location 90 percent of the time, according to the research.

With two confirmed fingerprints on a call, the researchers could identify subsequent calls 96.25 percent of the time; with three, it rose to 97.5 percent accuracy. By the time researchers had five positive IDs for a certain call, they could identify future calls from that source 100 percent of the time.

PinDr0p does have its limitations. "Call provenance doesn't translate into an individual’s name or a precise IP address," says Vijay Balasubramaniyan, a Ph.D. student in computer science who presented the PinDr0p paper in Chicago.

The researchers say they are actively working on the next step: using PinDr0p not just to trace call provenance, but to geolocate the origin of the call.

"This is the first step in the direction of creating a truly trustworthy caller ID," Traynor says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/12/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7343
PUBLISHED: 2021-01-18
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.
CVE-2020-28476
PUBLISHED: 2021-01-18
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configura...
CVE-2020-28473
PUBLISHED: 2021-01-18
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with defa...
CVE-2021-25173
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malformed DGN files, which allows attackers to cause a crash, potentially enabling denial of service (crash, exit, or restart).
CVE-2021-25174
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vulnerability exists when reading malformed DGN files. It can allow attackers to cause a crash, potentially enabling denial of service (Crash, Exit, or Restart).