Russian offices attacked by telephone fraudsters from "one third

[НСК-СБ]

The 20th of October

A new scheme of telephone fraud has begun to work in Russia, consisting of calls to foreign premium numbers: both cellular subscribers and corporate users of IP-telephony suffer from them. In the event of an attack on corporate users, gerv telephone exchanges are cracked using botnets.

Sipnet’s leading specialist, German Myzovsky, spoke about the new phone fraud scheme. Its essence is the creation by foreign operators of premium telephone numbers, similar in format to ordinary ones. Since calls to premium numbers are several times more expensive than regular ones, the rules of the International Telecommunication Union require you to block access to them from abroad. But in this case, the operators do not do this.

There are special affiliate networks that collect this kind of "hidden" premium numbers around the world. Then the “affiliate programs” attract scammers who organize calls to such numbers from the phones of subscribers against their will. Typically, the premium numbers are answering machines for which money is charged to the subscriber. Most of the money thus earned is transferred by Russian operators to foreign ones, they are shared with “affiliates”, and they, in turn, are directly with fraudsters.

Previously, in order to organize a call from a subscriber to a premium number, virus programs and trojans were written that, when they got to the computer, they started calling through a modem. But now scammers have got a simpler and wider path, says Myzovsky: with the help of botnets they scan open corporate telephone exchanges (manufactures, in particular, Asterisk, Cisco and Panasonic) and connect to them to make calls abroad.

Connections are possible in two ways. In the first case, Myzovsky explains, a password is selected to access the telephone exchange, the value of which often does not change compared to the default one (for example, the username and password are “admin: admin”). The second method is possible only in the case of IP-telephony stations: again, by default, they accept incoming calls without authorization. By calling the station and picking up its internal numbering plan, the fraudster can route his call abroad.

According to Myzovsky, on average, one Sipnet client is hacked per hour using the above scheme. Since premium numbers are usually registered in third world countries - Afghanistan, Angola, Sierra Leone, Somalia, etc. - the operator is trying to track the surge in customer traffic in such exotic destinations and warn them about it. The company has to send up to 10 such letters a day. Sipnet generally closes some areas by default, but this is not always possible, since among countries with premium numbers there are European countries (Andorra, Bulgaria, Liechtenstein, Luxembourg, Slovakia, the Czech Republic) and post-Soviet republics (Armenia, Belarus, Latvia, Lithuania, Moldova , Estonia).

Cellular users also suffer from foreign telephone scammers. As Sergey Khrenov, the head of the MegaFon fraud guarantee and fraud management department, said, there were cases when subscribers received calls from foreign premium numbers, the connection was not established, and the subscribers called back, “getting” to the expensive listening to answering machines

News source: safe.cnews.ru

 

[Евгений СБ]

Thank.

 

[Детективное агентство Симферополь]

Thank you Andrey! You shoot interesting articles just like with a gun

 

[@InfoPoisk]

Thanks, interesting.

 

[Игорь Коракс]

Thanks Andrew, for the prompt information.

 

[Частный детектив. Тайный советник. Омск.]

Thank you, Andrey. Very new and interesting.

 

[Частный детектив Нижний Новгород]

Thanks Andrew, an interesting article.

 

[Детективное агентство Тула]

Informative.

 

[Частный детектив. Панда. Краснодар.]

Thank.

 

[Частный детектив Севастополь ОДБ]

Now the main thing is not to undermine yourself on this mine:?