Robocall Results from a Telephony Honeypot

A group of researchers set up a telephony honeypot and tracked robocall behavior:

NCSU researchers said they ran 66,606 telephone lines between March 2019 and January 2020, during which time they said to have received 1,481,201 unsolicited calls—even if they never made their phone numbers public via any source.

The research team said they usually received an unsolicited call every 8.42 days, but most of the robocall traffic came in sudden surges they called “storms” that happened at regular intervals, suggesting that robocallers operated using a tactic of short-burst and well-organized campaigns.

In total, the NCSU team said it tracked 650 storms over 11 months, with most storms being of the same size.

Research paper. USENIX talk. Slashdot thread.

Tags: , , ,

Posted on August 17, 2020 at 6:22 AM • 27 Comments

Comments

Clive Robinson • August 17, 2020 9:51 AM

@ ALL,

With that number of Robo-Calls how many other “unwanted calls” were there…

Makes me think Telephone number “black listing” may not be enough so maybe “White listing” would be a good idea for some.

In the past with a POTS line that was effectively free as it was bundeled into another service, I’d set up a little more than just an answering machine[1]. It was set to ring after 4 rings, it then paused for 5 seconds before playing the OGM. If people hang up well that was there choice. But I did have the incomming call audio playing on a speaker, so if I recognised the voice or they announced themselves sensibly then I maight pick up. It had two OGM’s the first is played if there was no Caller ID number, the second if there was.

The first OGM informed the caller that calls without valid Caller ID would not be taken three times and then hubg up. The second informed then that the number has been recorded and then asked them to dial the extension number or wait for an operator. It then paused played a fake ring tone and a different female voice[2] asked for the callers name and reason for call and who they wished to speak to.

It kept unwanted callers away for several years, untill I was nolonger getting a free POTS line. However some people did complain… As I told them my hearing is not what it once was so I don’t use the phone…

Whilst I could build such a device for next to nothing, it served a usefull purpose. Most people can not do so, but they can with a little reading and understanding set up an Asterix or similar box to do the same thing. Including setting it up so that if the caller dials the right extension number they get “put through” or “forwarded”.

The more people who do this the less advantageous “Robo-Calling” will be. Because one thing that is sure these “No Junk Calls” pre-prefrence databases do not work at all.

[1] The advantage of having designed digital answering machines in the past abd still having the “engineering prototyoes” and “field test prototypes” it was very easy for me to make a few software and non line side hardware mods (like make the Caller ID number get pushed out over a serial port that had been used for ICE type development purposes).

[2] It’s always sensible to use other peoples voices for these sorts of thing, and “tradition” says “Young but competent sounding femal voices set the best impression”…

renke • August 17, 2020 11:54 AM

The whole robocall thingy baffles my mind. Here in Germany unwanted cold calls are not unheard of but extremely rare (maybe a handful in 10 years on my current land line number).

Is it only the stricter regulation here or are there other reasons that make the problem much more prevalent in the US?

echo • August 17, 2020 12:09 PM

When I had a landline I had to use the “Telephone Preference Service” and it by and large worked. Anyone who did try it on, usually charities, got given the full blown rant about invading my privacy and large fines for none compliance. I was also quite careful with dishing my number out given people were still catching up with the change of regime. I also used my answerphone as a filter and did get these irritating “hang up” calls but this was over a decade or more ago.

Since ditching landline I think I did use TPS on one number but other than this continued with the same regime including insisting all the “do not contact” boxes are ticked just in case one slips though. I rarely if ever get calls I shouldn’t. The mobile I have docked as a deskphone has caller display like all models and I’ve since set the volme to zero. If I don’t recognise the number or its withheld I pretty much never answer it. I rarely if ever get nuisance calls.

I have never had a single nuisance call on my other main phone. I think maybe one wrong number but that is it.

Lately I’ve been telling organisations to email me first. Depending on what it is about I choose whether it’s to be continued via email or phone or Skype or in-person meeting. I almost always now ignore the phone unless it’s personal or they have pre-booked an appointment. Not only do I like peace and quiet but I dislike phones going off at random. No people don’t always listen and want to skip past everything and call me at random but then I simply ignore it. The cops are currently playing silly buggers but because of the sensitivity and nature of the material and the need for “controlled handling” of discussions they’re getting the same treatment until they learn to behave.

When I carry a mobile it’s always set to not ring unless there is a specific reason to leave it on.

All those blabbermouths spending silly money on their phones are keeping my costs down. My phone costs are effectively zero.

Another thing due to regulation and the fact people have got used to it is I no longer have got to play the “I don’t have a landline only a mobile” line. Nobody cares anymore. Yes I do have a SIP number with local landline dialling code but I never use it. Voice calls put through a SIP router don’t fill me with joy.

So that’s my strategy and it works for me.

echo • August 17, 2020 12:16 PM

@renke

The whole robocall thingy baffles my mind. Here in Germany unwanted cold calls are not unheard of but _extremely_ rare (maybe a handful in 10 years on my current land line number).

Is it only the stricter regulation here or are there other reasons that make the problem much more prevalent in the US?

Yes, US privacy and data protection regulation is a horror compared to the EU and UK. They have this punch drunk “Lone Ranger” army of one “freedom” and “sort it out in court” nonsense going on over there. So you have lots of people abuse their first amendment rights. Another thing they have is the person who receives a mobile call pays for the call not the person making the call. A few “clever” lawyers and politicians taking a bung via their campaigns which rely on law skirting robocalls to peddle their election message and there’s no pressure to do anything about it. It’s all very much a disaster of their own making.

V • August 17, 2020 12:29 PM

Would you be willing to spend $0.25 to get your phone company to charge $0.25 to the source phone company? The source phone company would be free to not pay the $0.25 – at the penalty of losing the ability to peer with the network, to absorb the fee, to charge the owner of the robocall outfit, or, in countries with looser law enforcement, to kneecap the robocall owner.

Bonus: this could work against political calls. 🙂

SpaceLifeForm • August 17, 2020 4:00 PM

See nmap of ipv4 address space.

Robocaller marketer: We see this hot issue in the news. Do you want to address this? Only one dollar per call.

Client: Wow, how about two dollars per call? We have lots of money to launder today.

Norio • August 17, 2020 4:32 PM

Yes, US privacy and data protection regulation is a horror compared to the EU and UK.

Yes, it is truly a horror. The other day I noticed that my landline had received a call from what Caller ID displayed as “CenturyLink”. CenturyLink is our regional telecom/ISP. The phone number was not from CenturyLink. One would think that this type of fakery is illegal, but apparently not in the USA.

Lee Hammond • August 17, 2020 6:21 PM

Here in México, nuisance calls are only just starting up, selling…phone service! Telcel/Telmex dominate the market and AT&T bought the third biggest telco, to become the second biggest.

More annoying are recycled phone numbers. I have had my México number about 4 years and I still get calls for Manuel el eléctrico. Some people want to argue when I tell them it’s not his number. I thought about starting an electrical service business, with Manuel as the main man. Then I wonder why he changed his number. There are many extortion calls and most people do not answer unless they recognize the caller.

JonKnowsNothing • August 17, 2020 7:07 PM

In the USA for a long long time, robocalls or direct marketing calls or political activism or charity drives had various levels of “protection” in the public interest.

One of the not-so-public-interest items was the phone tariff paid, before the internet and during net neutrality years. One criteria for the phone systems, RBOCS and other invocations of the phone system monopoly and break ups, was that a call had to complete in order for there to be a charge.

On the CDR (Call Detail Record, yes the one the NSA is so fond of) it has a lot of information about the call and whether it connects or doesn’t. Some places used to just jettison the unconnected CDRs until they realized that the billing systems occasionally under calculated the call status.

So for the phone company to make money the call had to connect. If they blocked the calls they wouldn’t make all that extra loot. Voice Mail may not have connected you to the marketer but made for great wall street earnings.

You can still see this pricing model in specialty areas like US Prison Systems, were tariffs are based on per-minute of call (from cents to dollars). The Prison Phone providers have a monopoly access and while they are supposed to provide legal privacy shields to legal calls, they do not. Lawyers, like US Doctors no longer make house calls, not even to Gitmo(1).

Now, sometimes, occasionally, it might be possible that the phone companies make money even if the call does not connect because of the fights over tariff rules. (FCC tariffs are complicated and telephony vs internet have arcane historical placements in different laws)

While the old POTS lines are mostly gone with the old mechanical switches, I still have a land-line phone because it comes with the internet connection. If I drop either piece the base rate will rise the value of which end I drop. I can’t really afford either and the tariffs on smartphones are not helping. In the not too distant future all 3 “services” will be dropped because I have a choice between eating and not eating.

It won’t matter, I don’t answer any of the phones anyway.

There isn’t anyone left in my cohort that bothers with voice. They use text because we cannot hear that well and I just bumped up the font size for text messages.

  1. Legal Access to clients in Gitmo is difficult physically and via comm-links. Getting legal physical access is rare and the comm-link is notoriously hacked and stacked and bugged by everyone in the US Government and Feeding the 5EY+.

Anders • August 17, 2020 8:02 PM

Maybe i’m too old but this thread brought ToneLoc
wardialer back to my memory.

en.wikipedia.org/wiki/ToneLoc
github.com/steeve/ToneLoc

(and whoever ever used it knows what “Y” note stands for 😉 )

SpaceLifeForm • August 18, 2020 12:54 AM

@ JonKnowsNothing

Talking long distance here…

CDR and SMDR records would normally be tossed if duration was less than 12 seconds (two * 6 seconds).

Billing used to be in increments of 6 seconds.

But, then, someone spotted the money.

So, it became minimum 6 second call attempt. Minimum. If one dialed and hung up immediately, and it only took 3 seconds, it was rounded up to 6 seconds.

That was the charge for call setup. Even if it only took 1 second.

If a connection was made, and hangup occurred within 2 seconds, that is another 6 second increment. Call teardown.

Minimum possible call duration for billing purposes was 12 seconds.

Note that calls (especially unanswered) and hangups are a side channel.

SpaceLifeForm • August 18, 2020 1:11 AM

@ jones

In theory your idea makes sense, but it will not work.

The robocallers are paying flat fee for unlimited calls.

They will figure out immediately that it is not a person.

If you ever answer a robocall, and say ‘hello’, but there is no response, then it is a robocall. Do not say ‘hello’ a second time. Just hang up.

You can short circuit that by saying ‘hola’ for example.

The robocallers are so desperate these days that the caller-id info is self contradictory.

Recent example: Caller-id info said Philadelphia, but with Texas Area Code.

WmG • August 18, 2020 3:06 AM

Caller-id poses philosophical conundrum:
I have twice received calls from my number and my name.

Of course I live in the US.

Peter A. • August 18, 2020 4:11 AM

I still keep the landline, mostly for emergency purposes, but also some family members insist on calling the landline for no apparent reason. Cellular service is flaky sometimes over here because of radio propagation and people’s stupidity. It is a steadily developing area, more homes, more people, more cellular devices, but no more base stations because of ‘not in my backyard’ mindset. If I turn on my old Nokia with ‘diagnostic’ software, I can often see I am getting service from a power plant chimney five miles away. The signal’s fine in the kitchen, but usually dies in the bathroom (ha, ha, good for me, no more web surfing while sitting on the throne – oh, wait, I still have WiFi).

The telcos are legally required to have backup power for 72 hours or so, but what’s the purpose of it if the radio is congested. Wires are not. The landline company rents a shop building (with storefront!) from our condominium; even if they have put one-way mirror foil on the storefront windows, you can see what’s inside when the techs sometimes forget to put the lights off inside 🙂 So I know what equipment they have and I rather trust it will work for these 72 hours if not more, even if they have battery backup only.

The cable TV/ISP rents another building – they even have a diesel generator in the basement and test it weekly. But what concerns me are some Ethernet switches tucked away in cable shafts, I doubt they have backup power… So I trust landline most, cellular less, and IP telephony least.

I have this router/switch/WiFi/PBX in one box, and normally the landline is routed to the DECT handset after some trickery with virtual answering machine, but I have made a simple contraption using a telephone relay, so when power is lost an analog handset is connected directly to the landline, getting power from the switch. I also plan to put some photovoltaics on my balcony – a renovation is due, the railing is going to be replaced, so it is a good opportunity.

vas pup • August 18, 2020 3:19 PM

@Bruce and @ALL:
That is from the article
“Researchers believe this happened because, at the time of the storm, the robocalling operation had been using a technique known ==>as “caller ID spoofing” to hide their real phone numbers and pass as real persons.”

Please take a look at the following link for good and detailed analysis of legal aspects and actions (rather inactions) of Federal Legislators to curb it altogether:

https://www.tmtlawwatch.com/2018/02/legislative-efforts-to-curb-caller-id-spoofing-continue-at-federal-and-state-levels/

In particular:
“At the federal level, caller ID spoofing is governed by the Truth in Caller ID Act of 2009 (codified at 47 U.S.C. § 227(e), with corresponding regulations promulgated at 47 C.F.R. § 64.1604) (the “Act”). Although the Act makes it unlawful, subject to certain exemptions, “to cause any caller identification service to knowingly transmit misleading or inaccurate caller identification,” the Act contains significant limitations. First, it only applies to “any person within the United States,” so spoofed calls initiated outside the United States are not covered.
==>!!!Second, it only applies to calls made “with the intent to defraud, cause harm, or wrongfully obtain anything of value.”

One State added harassing as well for intent.

But, caller ID spoofing should be fought by the fact i.e. actus reus, regardless of mens rea, i.e. intent, because intent is subjective, but facts are objective, but as I stated many times on this respected blog,
until several federal legislators become victims of caller ID spoofing – nothing will change. They act only in reactive mode out of personal pain and suffering. Just my bitter observation.

Jon • August 19, 2020 4:46 AM

@ WmG

Better the USA than on Mars! 😉

(See: Ray Bradbury’s “Night Call, Collect”. “Barton?”)

vas pup • August 19, 2020 4:38 PM

Per tag data collection –

Phones could detect drinking over legal driving limit
https://www.bbc.com/news/technology-53834476

“Smartphones can detect when you’ve had too much to drink by monitoring your walk, a study has found.

American researchers used sensors in smartphones to detect when somebody was over the legal drink-drive limit.

Phones were able to do this with about 90% accuracy when users walked just 10 steps in the study by the University of Pittsburgh.

Scientists hope the discovery can be used to develop device alerts, such as asking people not to drive while drunk.

“We have powerful sensors we carry around with us wherever we go,” lead researcher Brian Suffoletto said. “We need to learn how to use them to best serve public health.”

I guess same sensors could detect mental state as well based on the combined patterns of user behavior: gate, hands movement, etc.

vas pup • August 19, 2020 4:52 PM

How to protect yourself from Asian tiger and bush mosquitoes:

https://www.dw.com/en/how-to-protect-yourself-from-asian-tiger-and-bush-mosquitoes/a-54620786

“Europe is now an unwilling host to invasive mosquitoes that can transmit dangerous diseases. DW looks at how to treat and avoid their bites, how to stem their spread, and the latest scientific research.

Worldwide, there are more than 3,500 mosquito species, of which approximately 50 are also native to Germany. All of them are annoying, but not all are as dangerous as these three immigrated species: the Asian tiger mosquito (Aedes albopictus), the Asian bush mosquito (Aedes japonicus, also called the Japanese bush mosquito) and the Korean bush mosquito (Aedes koreicus).

That is because these invasive mosquito species can transmit more than 20 types of virus, including those that cause dengue fever, chikungunya fever, yellow fever, West Nile fever, and the encephalitis and Zika virus.

The symptoms of these diseases are often initially similar to a flu-like infection, with high fever, headaches, aching limbs and weakness.

==>How do I prevent tiger and bush mosquito bites?

The way tiger mosquitoes eat and mate depends particularly strongly on their sense of smell. Body odor, breath, sweat and
=>perfume attract mosquitoes, especially outdoors. If you have a cool skin from a cold shower and
==>do not use strongly scented shower gels, perfumes and cosmetics, you will probably not be bitten as often.”

Good video inside and other good tips -read the whole article.

MarkH • August 20, 2020 12:53 PM

Recently, I’ve been seeing ads from a paid service (which I guess functions via an app) to filter out “spam” calls.

A bonus feature is that it can supposedly waste the time of an unsolicited (non-robot) caller; the ad implies that this uses a sort of “AI”.

To illustrate, the ad has the voice of a young man saying — not dramatically, but with urgent tempo — “there’s a shark circling my boat!” and the sales caller replying “hit it with a stick.”

I’ve read that there are several such pay-to-shield services competing in the U.S. market.

SpaceLifeForm • August 21, 2020 3:46 AM

@ MarkH

Spot the scam yet?

Robocallers and services to block robocallers?

Sometimes, you just have to hit them on the head.

@ Myliit

Did you notice the shark has dealt with squid?

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.