The Role of SBCs in Preventing Telecom Fraud
•
0 likes•7 views
The news regularly reports incidents of various fraud schemes that are perpetuated via the telecommunications network. A few months ago, a series of DDOS attacks impacted a major SIP service provider, overwhelming their network and blocking legitimate traffic. Meanwhile, illegal robocalls continue to take advantage of the elderly.
Recommended
Recommended
More Related Content
Similar to The Role of SBCs in Preventing Telecom Fraud
Similar to The Role of SBCs in Preventing Telecom Fraud (20)
More from TelcoBridges Inc.
More from TelcoBridges Inc. (20)
Recently uploaded
Recently uploaded (20)
The Role of SBCs in Preventing Telecom Fraud
- 1. The Role of SBCs in Fraud Prevention Alan D. Percy, CMO alan.percy@telcobridges.com April 2022 1
- 2. 2 Agenda • Who is TelcoBridges? • Where do we see Fraud? • What is an SBC? • Fraud protection use cases for SBCs • Where to learn more? A D N E G A
- 3. TelcoBridges Today • Manufacturer of VoIP gateways and session border controller software for telecom carriers • Privately held • Founded in 2002 • Employees: ~40 • Headquarters: Boucherville, Canada • Hardware & software R&D as well as production of its products in Montreal • Sales/Marketing/Support: Boucherville, Buffalo, Hong Kong, Italy, Turkey, Colombia, Vietnam • 24/7 technical support Confidential TelcoBridges HQ 138 de la Barre Boucherville, QC Canada
- 4. Who Buys our Products? • Global carrier network solutions • OEM Supplier to TEMS • Enterprise Confidential
- 5. 5 Where Does Fraud Occur? • Extortion • DOS / DDOS / TDOS Attacks • Registration floods • Illegal Robocalls • Impersonation / Identity Theft • Unauthorized Brand Usage • Wire Fraud • Theft of Services
- 6. What is a Session Border Controller? Network Border SBC • Anywhere two SIP networks intersect • Software-based “Network Function” • Deployed in: • Appliances, Virtualized, or Cloud SIP SIP Service Provider Network Service Provider Network
- 7. Routing Engine Media Media Engine SIP Session s B2BUA UAS UAC Private LAN 192.168.0.X Public WAN 34.0.0.1 Session Border Controller SIP Applicatio ns Session Border Controller Architecture Firewall
- 8. 8 Seven Fraud Protection Cases 1. Block DOS/DDOS/TDOS attacks (extortion) 2. Illegal Robocall Detection/Blocking 3. Reputation Analytics/Blocking 4. STIR/SHAKEN Verification 5. Brand Impersonation Protection 6. Lawful Intercept & Selective Call Recording 7. Call Detail Record (CDR) Analytics
- 9. Real Attacks – Real Impact DDoS attack cost Bandwidth.com nearly $12 million • Bandwidth CEO David Morken confirmed that it was suffering from outages … dealing with a DDoS attack. • “… the company estimates that the impact of the DDoS attack may reduce CPaaS revenue for the full year of 2021 by an amount between $9 million and $12 million, …" 9
- 10. DOS/DDOS/Intrusion Prevention Network Border Service Provider Network Detects and deflects DOS/DDOS/TDOS and Registration Floods Real-Time Internet
- 11. TDOS Attacks • Major car dealership chain in Florida • Phone lines were flooded with calls, tying up their lines and people • Most had mal-formed numbers • Blocking mal-formed numbers allowed good calls to get through 11
- 12. Mal-formed Number Screening 12 SIP Interconnect Carrier(s) Service Provider Is Calling # a valid format? (NPA) NXX-XXXX Subscriber Real-Time SoftSwitch
- 13. Robocalls - Neighbor Spoofing • Offender makes calls using a similar telephone number to the called party • Increases answer rate • Often uses in-active numbers • Hard to prevent with black-lists or simple pattern matching • “Snowshoeing” • Abuse and move on 13
- 14. Reputation Analytics 14 SIP Interconnect Carrier(s) Service Provider / Enterprise Subscriber Reputation Analytics Call from: (212) 555-1212 Score Real-Time SoftSwitch
- 15. STIR/SHAKEN STIR/SHAKEN Authentication Service SIP SIP Originating Service Provider Transit STIR/SHAKEN Verification Service Terminating Service Provider Token Token Verification Status (verstat) Calling from: (212) 555-1212 Call from: (212) 555-1212 Real-Time SoftSwitch SoftSwitch
- 16. Brand Impersonation • Calls that appear to be from legitimate businesses • Banks, financial institutions, auto companies, and hotel chains • Attempting to get victim to provide personal or account information • Goal: access to accounts 16
- 17. Brand Impersonation Protection 17 SIP Contact Center Enterprise Subscriber Agent Calling Mobile Carrier(s) Bank of Akron Bank of Akron Calling This is “legit” Real-Time
- 18. Lawful Intercept • “Wire tap” • Terrorism, financial crimes, conspiracy, insurrection • Requested by Law Enforcement • Requires court order • Record either: • Call traffic/meta data • Actual voice calls 18
- 19. Lawful Intercept/Recording 19 SIP Interconnect Carrier(s) Service Provider Subscriber Law Enforcement “Record any call to/from (212) 555-1212” Call Details or Audio Recording ETSI 201 671 v3-1-1 Real-Time SoftSwitch
- 20. Telecom Service Provider “Supervision” • TRACED Act makes ignoring illegal traffic a crime • Offending service providers are being charged/convicted • Court and plaintiff agree to a “consent decree” • Appoints a third-party to monitor call traffic • Essentially a “Telecom ankle monitor” 20
- 21. Call Detail Records 21 SIP Interconnect Carrier(s) Service Provider Subscriber Call Detail Records (CDR) Law Enforcement CDR Analytics Non-Real-Time SoftSwitch
- 23. 23 Real-world Story • VoIP service provider • Credit check all good • Issues numbers – “A” attestation • Two weeks – numbers get blocked • Identity was stolen • Payment bounced • Offender tried again!
- 24. Video Library on YouTube • ProSBC Training Modules • Recorded webinars • How-to Tutorials • Customer interviews • Frequently Asked Questions • Recorded podcasts • And more… 24 youtube.com/telcobridges
- 25. Enabling the Migration to Cloud Communications 25 apercy@telcobridges.com www.telcobridges.com Youtube.com/telcobridges Q/A