Global Workshop

What are the Other Top Industry Fraud Types?

Cliff Jordan and

Travis Russell

2

Global Workshop

Topics

Challenges Statistics Premium Rate Service (PRS)

Fraud By-Pass SMS Fraud and Related Issues Scams

3

Global Workshop Fraud Management Challenge

Fraud Cases* 50% External 50% Internal

Fraud High Volatility Changing Technology Changing Techniques

Continuously Changing Characteristics One-Time Organized Event ‘Menu’ Approach to Committing Fraud

*IDC March 2003

4

Global Workshop

Wireless Fraud Spectrum By Type

Dealer

7%

Subscription

34%

Prepay

5%

Roaming

13%

Social Engineering

2% SMS

5%I nterconnect

7% Credit Card

3%

I nternal

6%

Other

5%

PRS

13%

5

Global Workshop

Premium Rate Service (PRS)*

Commissions to PRS Owner is Based on Total Minutes of Use Minus Cost of Service

National Identified by Unique NXX/exchange. e.g., 9xx

International PSTN (Public Switched Telephone Number) International Locations, Usually with High

Settlement Rates. Legitimate Except …..

Caller Does Not Pay or There is Misrepresentation

* also called “Revenue Sharing Fraud”

6

Global Workshop

Large Scale Mobile Operator 15 Handsets Calling Non-stop to 500 PRS

Numbers No Charge To Calls Less Then 2 Seconds Duration of each Call is 1 Second Over 24,000 Calls per Handset, per Day. Potential Losses were Over $5 M

Case Study - Technical PRS

500 PRS Numbers (Fraudsters)

Mobile Network

FMSCalling Mobile Stations

(Fraudsters)

7

Global Workshop

Prepaid Fraud

Main Risks: Recharge With Stolen Credit Cards

This is a CNP Transaction, and the Operator is Liable

Large Amount of Chargebacks can Cause the Service Provider to Be Fined

Stolen Prepaid Cards Fake Prepaid Cards Recharge With Stolen/forged Vouchers False Recharges Using Internal Fraud

Can Involve Employees and Dealers Configuration Changes: HLR vs. Billing

8

Global Workshop

By-Pass Methods

Methods Discussed are: Interconnect Settlement Fraud

(Carrier Fraud) Bypass via Illegal Landing Call-Back

9

Global Workshop

Local Exchange

Called Parties

Callers

Remote International Network

Interconnect Exchange

National Call

Interconnect Exchange

A-number A-number ManipulationManipulation

National callwith

Manipulation of the

A-number

““Interconnect Settlement Interconnect Settlement FraudFraud””

The Fraud: An international long The Fraud: An international long distance call appears as national distance call appears as national and is financially “settled” as if it and is financially “settled” as if it were a national call at a cheaper were a national call at a cheaper rate.rate.

Unethical Carrier Network

Victim Carrier Network

International Gateway

By-Pass Methods

10

Global Workshop

By-Pass Methods

Interconnect Settlement Fraud: Benefits to Fraudster (Unethical

Carrier): Inexpensive Termination Costs

Local Call Rates instead of International Call Rates

11

Global Workshop

Victim’s Network

Remote International

Network

Service Platform(Calling cards, pre-

paid)

Callers

Local call

Local Exchang

e

Called Parties

Local Exchang

e

PBX

““By-PassBy-Pass via Illegal Landingvia Illegal Landing””

The Fraud: An unlicensed carrier The Fraud: An unlicensed carrier terminates international long distance terminates international long distance calls as local calls by-passing the legal calls as local calls by-passing the legal route.route.

Illegal Call

Routing! Internet

By-Pass Methods

12

Global Workshop

By-Pass Methods

By-Pass via Illegal Landing:

Benefits to Fraudster (unlicensed carrier): Inexpensive Termination Costs

Local Call Rates instead of Intl Call Rates Tax Avoidance

Many countries charge taxes for inbound Intl calls. The unlicensed carrier does not report calls and therefore does not pay taxes.

Use of VoIP is less expensive than satellite usage.

13

Global Workshop By-Pass By-Pass MethodsMethods

Victim’s Network

Rest of World

Call-Back Country

Legal Call Routing!

““By-PassBy-Pass via Call-Backvia Call-Back””

14

Global Workshop By-Pass By-Pass MethodsMethods

Victim’s Network

Rest of World

Call-Back Country

PBX

““By-PassBy-Pass via Call-Backvia Call-Back””

Step 1: A caller sends “Initiation Message” to PBX in CallStep 1: A caller sends “Initiation Message” to PBX in Call --Back Country via: uncompleted call to specific DNR Back Country via: uncompleted call to specific DNR or SMS message or EMAIL or Internetor SMS message or EMAIL or Internet

Initiation Message

15

Global Workshop By-Pass By-Pass MethodsMethods

Victim’s Network

Rest of World

Call-Back Country

PBX

““By-PassBy-Pass via Call-Backvia Call-Back””Step 1: A caller sends “Initiation Message” to PBX in CallStep 1: A caller sends “Initiation Message” to PBX in Call --

Back Country via: uncompleted call to specific DNR Back Country via: uncompleted call to specific DNR or SMS message or EMAIL or Internetor SMS message or EMAIL or Internet

Step 2: PBX makes call to the caller.Step 2: PBX makes call to the caller.

Step 3: Caller signals via DTMF the destination numberStep 3: Caller signals via DTMF the destination number

011-44-23456789

16

Global Workshop By-Pass MethodsBy-Pass Methods

Victim’s Network

Rest of World

Call-Back Country

PBX

““By-PassBy-Pass via Call-Backvia Call-Back””

Step 4: PBX opens a second line and calls the destination Step 4: PBX opens a second line and calls the destination number.number.

Step 5: PBX conferences the two calls togetherStep 5: PBX conferences the two calls together..

Step 6: Caller Pays Call-Back company in Call-Back Step 6: Caller Pays Call-Back company in Call-Back Country!Country!

011-44-23456789

44-23456789

17

Global Workshop

By-Pass Methods

By-Pass via Call-Back:

Benefits to Fraudster (Call-Back Company):

Worldwide Penetration without Network Costs

Tax Avoidance Clients do not have to pay LOCAL

taxes for their Long Distance service.

Global Workshop

Managing SMS

19

Global Workshop What is SMS?

Short Messaging Service (SMS)

Very popular, mostly outside U.S.A.

Gaining popularity in North America among younger generation

Recognized communications method of choice for criminal activities (including terrorists)

SS7 is the bearer path for SMS 3G/4G Messaging may include

video, audio, text, or voice

20

Global Workshop

What is SMS?

SMS is also the vehicle for delivering content

Subscriber dials a “short code” that is assigned within a carrier’s network to a content provider

The short code is sent via signaling network (i.e., SS7) through the network to a portal for the content provider

Content is then delivered via IP or some other technology to the carrier for final delivery to the subscriber

Global Workshop

How does SMS work?

22

Global Workshop

RA

NR

AN

RA

NR

AN MSC

MSC

MSC

MSC

STP

STP

SMS-c

HLR

Mobile Originated Phase

Mobile originated SMS

Transported via SS7 to the SMSc

23

Global Workshop

RA

NR

AN

RA

NR

AN MSC

MSC

MSC

MSC

STP

STP

SMS-c

HLR

Mobile Terminate Phase

Destination may be another subscriber or an application

SMSc responsible for routing to destination

Queries HLR to find subscriber

Global Workshop

Why is SMS an issue?

25

Global Workshop

Why is SMS an issue?

Impacts signaling network Peak SMS periods result in excess SMSC capacity Flood attacks are simple to initiate using SMS,

especially via the Web Impacts the signaling network, resulting in service

disruptions Smaller networks may be more at risk than larger

networks due to lack of security investment in the signaling network

Impacts Revenue! Prepaid SMS is trickiest due to limitations on SMSc

platforms Some Prepaid charging is sometimes done after the

message is delivered Fraudsters have already identified issues with

platforms and are exploiting

26

Global Workshop

SMPPApplication

100%

MO

MTRouting

SMS-C

85%

10%5%

90%

SMPPGateway

MOMO

RoutingRouting

MO and Routing

components got

overloaded

STP

TargetMSC

ServingMSC

Other Carrier

Issue: Message Center Overload

IP

27

Global Workshop

Inte

nsit

y

Time

Engineered for 5

SMS-C

MO

Mobile-to-Mobile traffic

MO

MTRouting

SMS-CVoting

Voting VotingMT

Carrier to carrier

Mobile-to-Application Voting traffic

Issue: Bursty Traffic Impacts Network

28

Global Workshop

RA

NR

AN

RA

NR

AN MSC

MSC

MSC

MSC

STP

STP

SMS-C

HLR

Result Excess SMSC Capacity

SMPP AppVoting

SMPP AppRing tone

SMPPGateway

RA

NR

AN

RA

NR

AN MSC

MSC

MSC

MSC

STP

STP

SMS-C

HLR

OtherWirelessCarrier

SMS-C

SMS-C

SMS-C =Utilized

SMS-C =Not Utilized

SMS-C

……

…

IP SMPPHub

Carrier

29

Global Workshop

PrepaidPlatform

100%

MO

MTRouting

SMS-C

85%

90%

SMPPGateway

PrepaidChecks

PrepaidChecks

Can’t keep up with volume of prepaid

queries

STP

TargetMSC

ServingMSC

Other Carrier

Issue: SMS Prepaid Overload

IP

Global Workshop

What do I look for?

31

Global Workshop

SMS Fraud Cases SMS flooding

A massive load of messages to one or several destinations Usually SPAM

Flooding the network will cause congestion in the signaling network resulting in service disruptions

SMS Messages are large and consume valuable SS7 resources SMS faking

SCCP or MAP addresses are manipulated Invalid or taken from a real existing message

Originated from the international SS7 network and terminated to a mobile network

SMS spoofing SMS MO manipulated A-MSISDN (real or invalid) Coming into the home network from a foreign VLR (real or

invalid SCCP Address) Method used for sending floods of SPAM messages

Global Workshop

How do I solve it?

33

Global Workshop

Addressing SMS issues Impacts signaling network

Peak SMS periods result in excess SMSC capacity SMG MO-FDA Offload

Flood attacks are simple to initiate using SMS IAS SMS Suite coupled with GSM MAP Screening

Impacts the signaling network, resulting in service disruptions Smaller networks more at risk than larger networks due to

investment in the signaling network Impacts Revenue!

Prepaid SMS is trickiest due to limitations on the SMSc platforms

SMG Real Time Prepaid Rating Engine Fraudsters have already identified issues with platforms and

are exploiting GSM MAP Screening stops or redirects SMS

34

Global Workshop

IAS SMS Suite - SMS Flooding

Automatically search for the top 10 SMS originators every 5 minutes Generate alarm when the % of SMS traffic reaches a predetermined

threshold Stop the Flooding with GSM MAP Screening in the Eagle (SMS Firewall)

CdPA, CgPA and Op Code Screening 1000 individual and 1000 ranged entries

35

Global Workshop

IAS SMS Suite - SMS SPAM

Looking for SMS originating from a source other than a mobile phone

Assumption can be made that if the origination is an ISDN device (identified via the signaling data) and there is a high volume of SMS from the same source, then the content is SPAM

Stop or Redirect the SMS SPAM with GSM MAP Screening the Eagle (SMS Firewall)

36

Global Workshop

SMS Spoofing

Number of SMS submitted from subscriber abroad per Roaming partner

Real time traffic measurement Alarm generation on traffic increase

Comparison of the number of Location Updating received and the number of SMS Submitted

From PLMN subscribers abroad per Roaming partner Real time compared traffic measurement Alarm generation on focused traffic increase

Measure the number of invalid MSISDN who submit a SMS to the SMS-C for a specific period

Real time traffic measurement of abnormal load of request or reject

Alarm generation on spoofing attack condition Redirect Spoofing to an off board platform with GSM MAP

Screening Redirect

37

Global Workshop

SMS Summary

SMS will increase Impact is already being realized by major operators Effect is not limited to wireless; wireline operators

can also be effected Visibility to the traffic from the network is

critical The visibility must come from monitoring tools that

have access to the network signaling data Switch-based and node-based records are no good

for these types of real-time studies Proactively address SMS issues in the

network

38

Global Workshop

Scams

BlueTooth Hacking / BlueSnarfing Spoofing Pharming Phishing / Wi-Phishing Spam / SPIM / SPIT Trojans Get Rich Quick (With Little Effort)

39

Global Workshop

Bluetooth Hacking Facts

Devices in Non-discoverable or Hidden Modes Are Vulnerable

Pairing is Not Required to Exploit Vulnerabilities

Vulnerabilities are Well Known. Information Available Widely on the Web

Multiple Tools Available Publicly to Exploit Known Vulnerabilities

40

Global Workshop

BlueSnarfing

Mobile Phone Bluetooth Attacks Reading/Writing Phone books

Entries Reading SMS Stored on the Device Sending (Premium) SMS Message Setting Call Forward (Predefined

Number) e.g., +49 1337 XXXX Initiating Phone Call (Predefined

Number) e.g., 0900 284 8283

41

Global Workshop

Spoofing

Fraudster Uses a CLI/Caller-ID Device to “spoof” the Legitimate Customer’s Telephone Number or Business

Result: Social Engineering at its Best Fools the Customers into Thinking that

the Call Originated from a Bank and they may Divulge Personal Information

Impact Emergency Services

42

Global Workshop

Pharming

Site Appears to be Legitimate Internet Users are Forcibly

Redirected to Sites Chosen by the Hacker.

Result: Divulge Personal Information Incur Added Costs

43

Global Workshop

Phishing / Wi-Phishing

Phishing – Means of Enticing People to Provide Personal Information (email, website, or other)

Using a Wireless Enabled Laptop or Access Point to get Data from or Introduce Malicious Code to Wireless Enabled Laptops.

44

Global Workshop

SPAM/SPIM / SPIT

SPAM - Unsolicited, and usually unwanted, commercial e-mail

SPIM – Unsolicited Instant Messages

SPIT – SPAM over the Internet Result:

Annoying Can be Used for Denial of Service

Attack

45

Global Workshop

Trojans

New Variation for Mobile Phones Distributed via file-sharing or IRC

Trojan Tries to Install a Corrupted File onto the Infected phone, Causing it to Fail with the Next Reboot

Damages the Application Manager, Preventing new Programs from being Installed and stopping the Trojan from being uninstalled.

46

Global Workshop

Get Rich Quick With Little Effort

Lottery Winners Political Refugees Inheritance

If it sounds too good to be true, it is! Ask yourself, “Did you buy a lottery

ticket?”

47

Global WorkshopWhy Do Some Experts Estimate That Fraud May Grow?

Business Trend Fraud ImpactNew Technologies New Venues to Commit Known Fraud

New Products New Types of Fraud

Increase ARPU Increased Loss

More Content Providers

Low-margin Products With Significant Out-of-pocket Expense = Larger Fraud ImpactMerchant Fraud

Great Content More Lucrative Content to Resell

M-Payment & E-wallet Products

Financial Fraud

Seamless, Global Service

More Roaming Issues

Separation of Network and Service Providers

Less Control on Service Usage

Global Workshop

What Types of Fraud are You Seeing?

?

49

Global Workshop Presentation Contribution Credits

Travis Russell, Tekelec Bob Delaney, Tekelec Tal Eisner, ECtel Clemmie Scott, AT&T Carlos Lowie, Belgacom