Hacking The TDoS Attack

Rising telephony denial-of-service (TDoS) attacks are not quite as prevalent as a DDoS, but they can be just as deadly

When an ICU nurse refused to pay scammers who insisted she owed money for a payday loan, they unleashed a robo-dial flood of hundreds of calls per hour that ultimately shut down the phone system of the hospitals intensive care unit. In another case, supporters of a popular company that received a negative rating from a major financial firm voiced their displeasure by crowdsourcing phone calls to the firm in an attempt to block its trading and other functions -- and they organized it via a Facebook Event post.
These real-world cases of telephony denial-of-service (TDoS) attacks in the past year didnt get the publicity that distributed denial-of-service (DDoS) attacks did, but security experts say these types of attacks have been on the rise in the past couple of years and can be just as damaging as a DDoS.
Personally, I believe that its a more invasive approach to target a companys [or] individuals primary means of communication. Just like DDoS attacks, based on my observations, they tend to abuse the infrastructure of legitimate services, Skype, ICQ, major U.S-based carriers, and relevant SIP providers, cybercrime researcher Dancho Danchev said in an interview via email.
TDoS attacks -- which earlier this year were becoming prevalent enough that the U.S. Department of Homeland Security issued an alert about a threat of TDoS attacks on public sector entities in an attempt to extort money -- are typically similar in motivation and goals as DDoS attacks that flood networks, websites or other servers with massive volumes of traffic meant to bring an organizations data structure to its knees. Call centers are the most popular TDoS targets -- theyre easy to contact and flood with calls -- and, increasingly, there are more tools readily available tools for launching these attacks on any organization or individuals location.
Danchev says he started noticing a major increase in TDoS-for-hire services about a year-and-a-half ago, and he sees new vendors emerging regularly. Since the attacks are requested on demand/for hire, virtually anyone can be targeted based on the preferences of the customer, he says.
Mark Collier, CTO and vice president of engineering for SecureLogix, a TDoS mitigation vendor, says TDoS tools are readily available, especially ones that exploit VoIP. One major reason its getting worse is that attackers have access to VoIP, so if they want to flood a major bank with tens of thousands of calls, they can get free Asterisk PBX software. Theres inexpensive SIP access, he says.
Arbor Networks says it has seen an increase in TDoS attacks that use Session Initiation Protocol (SIP) traffic to flood VoIP systems. In a recent 24-hour period, Curt Wilson, a research analyst with Arbor, spotted global SIP message-flooding traffic accounting for 31 percent of the total scan traffic found via monitoring with Arbors ATLAS intrusion detection system.
[There are now more than five phone fraud calls placed per minute, and the volume of these scams increased by 29% in the first half of this year. See
Phone Fraud Up 30 Percent
.]
Wilson says a SIP flood TDoS attack requires the same mitigation tactics as a DDoS. The most common response to a DDoS attack is to redirect and scrub traffic, as well as block offending sources of the traffic. In the case of the targeted financial firm that ultimately became a customer of SecureLogix, its call center traffic was five times its usual levels at the target time of 11 a.m. Eastern on the Monday morning of the planned attack. SecureLogix employed a multilayer call-blocking ruleset that killed the malicious calls and allowed legitimate calls inbound.
In the case of the ICU nurse, the scammers were all about extortion against payday loan customers. They kept harassing the nurse -- who had previously paid off the loan with the real lender -- with phone calls threatening her credit rating. The volume of automated calls targeting the ICU shut down its phone system such that the ICUs doctors and nurses couldnt make or receive calls. And the attacks continued to threaten other areas in the hospital from the same scammers and other groups, according to SecureLogix, which was commissioned as the hospital groups vendor after the ICU incident.
Just like some DDoS efforts, there are both sophisticated and do-it-yourselfer TDoS attackers. Danchev says he can distinguish between TDoS attacks by sophisticated groups with their own tools and the ones who use DIY tools.
Still, TDoS today isnt on the radar screen for organizations the way DDoS is. The threats not taken seriously because organizations want data to present in order to get the necessary budget to implement solutions that would prevent such an attack from taking place within their organizations boundaries, Danchev says. Since theres lack of such data/statistics on just how widespread is the problem -- which is something having to do with the fact that since day one TDoS has been largely popular in Russia/Eastern Europe -- it would inevitably put these organizations in a catch-up mode in the long term.
Arbors Wilson says he sees more DDoS services in the cybercrime underground markets offering TDoS services as well. Most of these ads appear on Russian forums, he says, with some ads appearing in English as well.
TDoS has come a long way from the original attacks against consumers three years ago that flooded them with traffic so no one could verify the fraudulent bank account withdrawals from the victims accounts. Over time they began flooding contact centers, different enterprises and 911 centers for purposes of extortion, SecureLogix Collier says.
Meanwhile, the main office of a major U.S. retailer -- and a customer of SecureLogix -- was recently hit with thousands of calls during a period of hours. The calls were about 30 seconds long with an audio recording aimed at tying up circuits while keeping the call alive, SecureLogix discovered. The reason for the attack remains unknown, but SecureLogix officials say the motive was most likely to prevent inbound phone calls.
TDoS has exploded and is going prime time, says David Heard, vice president of product marketing management for SecureLogix, but it hasnt received much attention, he notes. TDoS needs a poster child as breakout issue to draw mainstream attention, he says.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Hacking The TDoS Attack