VoIP Fraud
Hemant Singh Sengar · 2014
In today's IP telephony world, VoIP service providers and their customers are experiencing a common and rising trend of an attack where hackers compromise legitimate telephone subscriber accounts either from service provider networks, or from one of their customer sites. Once a user account has been compromised, it is used for launching various types of fraudulent activities. Ironically, both users (whose accounts are compromised) and their service providers remain oblivious of any such ongoing fraudulent activities. Generally, such attacks are detected after the fact when damage is already done, either during the call detail records analysis, customer complaints, or billing disputes. From VoIP service provider's perspective, we ask a fundamental question: Why does it remain an elusive goal to detect if a call is originating from a compromised user account? The answer to this question and a feasible solution could be proved as an essential security tool to prevent various VoIP attacks that plague IP telephony world. To this end, we introduce a new dimension to VoIP security, namely device authorization along with already existing and widely deployed user authentication. The device authorization scheme exploits two unique aspects of calling devices: 1) analog-to-digital conversion process of audio signal; and 2) implementation of SIP timers. By passive and remote observation of signaling and media streams, we establish a relationship between the two and make sure that an authenticated telephone subscriber is using an authorized device to originate calls.