«

Hi there


A bit of Analog style log processing;
http://www.sput.nl/asterisk/#req
Of you strip leading stuff like '00' and '011', you end up with numbers
like 442035199055 and 442035199098. And most of the originating IP
addresses are US.
So why are Americans so keen on free calls to the UK (esp London)?


Regards,
Rob
--
Wim T. Schippers for president
http://nl.wikipedia.org/wiki/Bestand..._Drienerlo.jpg

Hi there


alexd wrote:

> Perhaps the numbers they're attempting to contact are under their control,
> in order to verify that they've found a vulnerable system [I see something
> similar in Apache logs from various web servers I look after]. And perhaps
> throwaway UK DDIs are easier to get hold of than anything else.

Wikipedia on DDI;
http://en.wikipedia.org/wiki/Direct_Dial-In#Sellers
"UK Geographic DID numbers can be obtained for free, terminated over SIP
and also generate a revenue for inbound traffic."
That's almost a pink contract.


Regards,
Rob
--
Wim T. Schippers for president
http://nl.wikipedia.org/wiki/Bestand..._Drienerlo.jpg

On 26/10/2011 17:40, Rob van der Putten wrote:
> Hi there
>
>
> alexd wrote:
>
>> Perhaps the numbers they're attempting to contact are under their
>> control,
>> in order to verify that they've found a vulnerable system [I see
>> something
>> similar in Apache logs from various web servers I look after]. And
>> perhaps
>> throwaway UK DDIs are easier to get hold of than anything else.
>
> Wikipedia on DDI;
> http://en.wikipedia.org/wiki/Direct_Dial-In#Sellers
> "UK Geographic DID numbers can be obtained for free, terminated over SIP
> and also generate a revenue for inbound traffic."
> That's almost a pink contract.
>
>
> Regards,
> Rob

I'm not sure how you can generate revenue by getting people to dial your
UK *geographic* number, although I take your point that UK geo and NGNs
seem to be more widely available than any other country.


--

Graham.

%Profound_observation%

Rob van der Putten <> wrote in <4ea73720$0$1307$ >:

> A bit of Analog style log processing;
> http://www.sput.nl/asterisk/#req
> Of you strip leading stuff like '00' and '011', you end up with numbers
> like 442035199055 and 442035199098.

I had a look at the attempts I logged on an asterisk server and while I did
notice the attempts to reach UK numbers in a likewise pattern I can't find
any attempts to reach the exact same numbers.

Either there are a lot of attackers trying this or they select a UK number,
give it a few tries and drop it immediately.

For added fun I answer those calls, play a random 'this number is not in
service' recording from somewhere around the world .. and I record the
incoming and outgoing audio. Sofar this got me a recording of a lot of
noise: http://idefix.net/~koos/newsitem.cgi/1311000729

Koos

--
Koos van den Hout, PGP keyid DSS/1024 0xF0D7C263 via keyservers
IPv6: Think ::/0, act ::1.
http://idefix.net/ Are you ready to switch to IPv6?

On 07/11/2011 09:21, Koos van den Hout wrote:
> Rob van der Putten<> wrote in<4ea73720$0$1307$4all. nl>:
>
>> A bit of Analog style log processing;
>> http://www.sput.nl/asterisk/#req
>> Of you strip leading stuff like '00' and '011', you end up with numbers
>> like 442035199055 and 442035199098.
>
> I had a look at the attempts I logged on an asterisk server and while I did
> notice the attempts to reach UK numbers in a likewise pattern I can't find
> any attempts to reach the exact same numbers.
>
> Either there are a lot of attackers trying this or they select a UK number,
> give it a few tries and drop it immediately.
>
> For added fun I answer those calls, play a random 'this number is not in
> service' recording from somewhere around the world .. and I record the
> incoming and outgoing audio. Sofar this got me a recording of a lot of
> noise: http://idefix.net/~koos/newsitem.cgi/1311000729
>
> Koos
>
It occurred to me some time ago how that would be a good tactic for
insurance company's and the like to use.
While the would be claimant is waiting for the call to be answered,
(ringing tone rather than music-on-hold might work best), the call is
recorded and reviewed later for evidence of fabricating a false story.


--

Graham.

%Profound_observation%

On 07/11/2011 10:38, Andy Burns wrote:
> Koos van den Hout wrote:
>
>> Either there are a lot of attackers trying this or they select a UK
>> number,
>> give it a few tries and drop it immediately.
>>
>> For added fun I answer those calls, play a random 'this number is not in
>> service' recording from somewhere around the world .. and I record the
>> incoming and outgoing audio. Sofar this got me a recording of a lot of
>> noise: http://idefix.net/~koos/newsitem.cgi/1311000729
>
> I just play them a blast of tri-tone followed by Alisson saying "Weasels
> have eaten our phone system", I suppose recording their reactions to
> that might be mildly interesting ...

You are all welcome to use the famous "Grampa Stack" recording I have
put here.



--

Graham.

%Profound_observation%