Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1024 Thanks!
[Music]
welcome everyone
to the first talk in the morning we are
here to
learn something new about exploring the
fraud and telephony networks the
speakers today
are aurelia francia and mavi shaheen
and they will give you
a little bit of an understanding
of the telephony fraud ecosystem
so that you can learn a bit about what
telephones can do so give a warm hand of
applause to
aurelio and mervy
thank you um good morning everyone happy
to see so many people working up for the
first talk of the day happy to open the
session today
so our goal in this talk is to give you
um first a broad overview of telephony
fraud
right what is telephone default why it
is important how does it work
and then we will dive into a few topics
we're going into more detail
there'll be some new content some things
we promised before but the goal is ready
to give up
an overview right um to dive into some
of the difficulties there some of the
things on how you can analyze how you
can detect
especially where we care about
understanding how does it work
um so i'm a smart knowledgeable of
myself so my name is
i'm an assistant prof in eurekom or
small engineering school in south of
france on the french riviera next to nix
and my speciality is working on obvious
system security as well in telephony
fraud right now you can follow me on
twitter or healthsec and i'm actually
hiring students phd students
engineers feel free to get in touch in
case of needs
so hi everyone my name is madre i have
been
working the last almost five years with
oregan
on telephony road first i started as a
phd and then i did one year of postdoc
and starting from next year actually i
will be i will join the
sap security research that's it
good so telephony fraud um what's really
interesting about telephony fraud is
that
telephony is like the oldest network we
have today it's still running right so
telephone started in 1870s the beginning
of interconnections of phones right
and since then since 150 years we kind
of have backward compatibility
right so it's kind of a big legacy um
another thing interesting for fraud is
that everything is built so
almost every phone call you make even if
you have some that plans or so on there
is some bidding
behind they check how much time you call
which number which destination
and all this is very complicated um and
since the beginning people try to
make some free calls so first for
example to fraud some telephone number
right do social engineering against them
and then today so it's getting quite
complicated
uh there are multiple technologies which
get converged
uh you have voice over ips since like 20
years but no tons of applications
on those are interacting with the
telephone ecosystem right so this is
this is getting complicated with many
different actors involved before you
have these
uh state-owned operators like orange in
french telecom in germany
but since 20 years it's getting like
lots of operators lots of entire
connections and so on
on telephony fraud telephony is not
touching like seven billion people right
so it's really huge
and this generates a massive amount of
data and finding the fraud in there is
not always easy
so let's look at the ecosystem right so
at the beginning you have a phone right
so it may be a long line phone an old
analog line
it could be analog line in a company
with a pbx or
most likely today uh if you're in the
company on the price network it's an
iphone
with an ippbx file
so those phones get connected through
different connection links
to your operator and of course you also
have mobile phones which as well gets
connected through wireless
to your operator network so we don't
care so much about the technical details
of how
this attack action work but moho uh
the calls are rooted across operators
right because if you have
a call from the same operator to the
same operator it stays on the network
but extremely often you go over another
operator because
you you call someone that's in another
country or in another operator so you
have to get some interconnection between
two operators
and then again extremely often you have
to go through
through some transit operators because
you are across multiple countries
or they just don't have a direct link or
for some
random reason price or so on they still
go to a transit
very often you have multiple choices and
sometimes it go through some of the
transits and that's getting complicated
sometimes you have
10 transit operators between the two
colors
so of course as we mentioned your mobile
phones today they are computers
and you have tons of applications
voiceover ip on what is called ott
we'll come back to it on this
allow to interconnect with the telephony
legacy telephony system
that adds some complexity and in the end
if you call
mobile phone from a mobile phone you may
go through all this
right all this complicated network on
transit or you may also go
directly between the two phones over the
ip network
that's extremely frequent today um so in
all this ecosystem
uh now we have some fraud a bit
everywhere so for example you may have
your operator
who's over charging you something this
happens this happens
and then you may have other cases where
your phone gets stolen
um your sim card is abused to generate
some calls to some premium
numbers right and then you get extremely
high charge at the end of the month
and sometimes it's even within a few
hours before your phone line is cut
we'll talk about that in a bit um
in some cases i don't know if it occurs
to you
may have someone calling you from one
country and you receive the call
and then you see the caller id which is
changed so
your friend's calling you from let's say
russia and then you get a uk caller id
and that's a kind of a quad
typically this is done with the same
boxes which get
somewhere into the network to abuse some
sim cards
and this typically change the color id
we will see some examples of that as
well later
another thing that's extremely important
today is um
unwanted calls voice spams
robocalls basically they have robots
that will just spam you
a lot and everyone receives some spam
calls before and we'll talk a bit about
this
too so in the end
there is fraud a bit everywhere in these
networks right and we need to
kind of understand this uh because these
frauds have some consequences right
um these consequences are important
right so in terms of money
there is no good study about it there is
one study
by cfca which states that uh they do it
annually
but overall it's full they claim that
telephony fraud costs like something
like four billion dollars a year
that's significant right but these
numbers are not extremely valuable
but if you just look at the complaints
from users so it's about half a million
users
which complain to the ftc in us about
receiving some spam calls right
half a million per month half a million
complaints per month
there is also telephony level of service
which basically makes
happens to make emergency phone numbers
unavailable
and that can have life threatening
consequences so we rely on the system
for our sodium to work
um and another thing as well is that
more and more uh we rely on the
telephone
uh for um using it as a trusted thought
party as a secure system a secret
mechanism
so that we can use for example
two-factor authentication but we have
seen recently some cases
where two-factor authentication is
abused so you receive a text message on
your phone
to log in to your bank or confirm a bank
transaction
or access your bitcoin wallet um there
have been cases with bitcoin where it's
stolen
hope because people just want to do a
shop or bribe some employees
and they get the phone number attached
to a new sim card which they own and
then they can get the reset password
message and confirmation text message on
the phone right so all these
are actually abused in the wide
so because all this gets quite
complicated um
in fact very often when some people talk
or you
check online you find people talking
about frauds and they name it according
to the technique they say
pab explodes there is no such thing as a
pibx fraud right
pbx can be abused compromised and they
can be used to
make a lot of different frauds so we
actually came up with a definition right
because we're
scientists so we have to come up with
definitions um
trying to help us to understand this
in a proper way so at the beginning we
said that a fraud scheme
is a way to obtain an legitimate benefit
on by using a technique
right and it's important because as i
mentioned techniques can be used
for multiple in multiple frauds in the
end these techniques are possible
because there are weaknesses in the
networks in the systems
and these weaknesses are present because
there are some root causes which have
been there
for a long time and they are hard to fix
so to get a bit more concrete here is an
example with a
callback scam so you all receive these
text messages these calls
very short calls which make your phone
ring
say up there is no message maybe you
call back right so the goal of the
fraudster is to they will call
lots of people and they will generate
lots of
one ring on many phones and they expect
that some people call back and they will
call back but when calling back they
will call back
a premium number on this framework
number will generate some cash
for uh the fraudster so this we can
actually analyze
in this taxonomy so we can define
default scheme as a callback scheme
the benefit of the fraud is to obtain
some revenue share
from these premium numbers then
the technique would be multiple
techniques can be used but
first we've seen that some colored
spoofing can be used
there will be some weaknesses in the
system so basically
you can do colored spoofing because
there is no color id authentication
in these systems in the telephony there
are some things ongoing to fix this but
it's still
going to take a lot of time before it's
completely there
and in the end all these are possible
because you have legacy networks and so
on
right so we came up with this
classification
layers and then we can make this a bit
more complicated and we can
just categorize the different classes of
frauds and put it in there classes of
those classes of techniques and
weaknesses and so on
and way to obtain benefits and then we
can get this to a lot more detail
i don't expect you to look in detail at
this figure we have a paper where we
discuss all this
but we're going to use this as um as a
thread of the talk on we're going to
talk about some specific parts of it
um our mirror is going to start talking
about international revenue shaft road
or irsf
so before explaining how this irsf works
first i need to explain you how
a normal international phone call works
so let's say there's a caller in country
a
he wants to call the colleague in
country b so for this call the caller
will pay
some amount of money to his operator
let's say he pays one dollar
so it's most likely that there is no
direct connection between these two
operators so the call needs to go
through
several transit operators and what
happens is that
each operator like here operator a he
will have a rate sheet showing that for
this
destination he can use several different
transit operators to route the call and
each of them
probably have different qualities and
different prices
of course if he chooses a cheaper
transit operator he will keep
more money for himself but
usually this decision is very
complicated so let's say
operator a choose t3 as the transit
operator again t3 will have multiple
options
let's say choose t4 and finally t4
actually paid the international call
termination fee
to the destination operator and the call
is terminated on the
this stage destination
so what happens in case of international
revenue fraud
is basically there's a fraudster who's
generating calls on behalf of someone
else he can use
stolen sim cards he can compromise the
telephone system he can use mobile
malware etc
and basically at some part of the call
route there is a
transit operator that is a kind of shady
fraudulent operator
and instead of sending this call to the
legitimate destination this operator
can make a deal with the premium rate
service provider
and actually hijack the call and
re-route the call to
the this provider and of course in this
case they don't have to pay any money to
do operator b
instead they can keep this money for
themselves and share between each other
and finally our fruits will also get
some part of the revenue
for each minute of the call that he
generates
so we analyzed this fraud scheme
basically um from the perspective of
these
premium rate service providers so
actually if you go online make a google
search with
the keyword international premium rate
numbers you will see
many many websites that are advertising
those numbers so they
tell you that you can get a phone number
for free
you start generating calls to this phone
number and then
you receive payments via several
different payment methods
and they also give you a lot of support
whatever you need
this is an example of the
money paybacks for instance if you start
if you generate call to this phone
number in belarus you will be
getting 10 cents for one minute of call
so one interesting thing was that those
iprm providers they actually
also have some test interfaces and this
is
necessary because before you start the
actual fraud you need to make sure that
the hijack
works
so you first go to the one the test
interface you make several tests
uh you check if um your call
is hijacked in in this route and if you
will be able to receive payback or not
and actually those test interfaces they
are advertised on social media
in facebook twitter they with the user
accounts
test user accounts and so on so once you
go to one of those interfaces
you will see several phone numbers from
many different countries you can pick
one of those numbers you
make your test call and if the test call
is successful
basically you will see in the website in
real time
if your call the hijack was successful
and if you will be able to get some
money payback from this call or not
so basically what we did was to to crawl
those test portals for about
three years actually and in total we
have been collecting more than
1.3 million uh test numbers and 150k
test call records
so the first interesting thing that we
observed was that actually all the
countries and territories
in the world are affected by this
fraud scheme but some parts
some continents and countries are
affected more
like african countries russia some
islands in
south america and so on
one important thing that to note is that
the test numbers that we collect they
are not actually
they are not used for the actual fraud
scheme so first the fraudster goes
to the test interface makes several
tests to several destinations
and if the test is successful actually
he will obtain another number
that is that will be dedicated to
himself but this number is probably will
be in a similar number range
with the test call that he made and
actually so the fraud actually will
occur on similar numbers to the test
numbers
so example as an example if this is a
test number that you see on the test
interface most probably this number
is hijacked in a range of 100 or 10 000
numbers but we don't actually know the
the actual range of hijack
so in this picture
okay it's a bit complicated so here we
see the
whole number space of two countries
latvia and
cuba so in the y axis you see the first
four digits
all possible uh four digit numbers and
in the x axis you see the
last four digits uh so if you actually
move over the x-axis these are the
consecutive phone numbers
and if you move over the y-axis you can
see
number of allocations in the country by
the type for instance
the blue denotes the mobile
number range so in latvia for example
mobile ranges
start with two while in cuba mobile
ranges stuck with five
so the first thing we observe here is
that the spreadness of
iprans are different in each country in
latvia the
test numbers are more concentrated on
five number ranges
but in cuba they are much more spread
and much more
random looking the second observation we
can make is that
the dots that you see the red dots they
are actually
come from the number ranges that are not
allocated
of by the regulator of this country so
actually normally those numbers that
should not be used
and can should not be called by anyone
but they are still being
abused for this fraud and the last
observation we make is that
you are seeing some vertical lines in
the graphic
and this is because the test numbers are
most of the time selected from the
beginning of these four digit number
ranges
so once they hijack a range probably
they advertise the beginning
some numbers from the beginning of the
range as the test number and maybe they
use the rest
for the actual fraud
okay so another thing that we analyzed
was the behavior of different
providers if they behave the same way or
they are different
so this these are some statistics from
six of the providers
you can see the first two of them are
the most active ones they change
uh numbers very frequently so and
every advertisement duration for a
single number is only for five days
and every new day they advertise almost
two thousand
new phone numbers uh probably they do
this
because um after some time these phone
numbers
start getting blocked by operators so by
changing
the numbers frequently they
make the test calls more successful
but the rest of the providers they
basically
are more static they advertise phone
numbers for
really long durations and they actually
advertise new
few new numbers per day
so another thing we looked at was
to check if two different if one phone
number
is shared between multiple providers or
not
and it turns out that among the more
than one million numbers only 70
000 of them are observed
in more than one provider but
actually if you ignore the last four
digits and if you look for the number
ranges
almost 80 percent of the number ranges
have been shared across
all all the providers
so after making some observations on
these numbers of course we
want to focus on solution so from the
perspective of an
telecom operator an operator only sees
the call that i record that are recorded
in his own infrastructure so this
records include to date the source
number destination number duration some
signaling information
etc so it actually
turns out to be very challenging to
detect irsf
because operators have limited like the
local view
of the call and they actually process a
messy volume
of traffic and phone numbers every day
and sometimes anomaly detection
techniques does not actually work
because
the number of fraudulent calls can
outnumber the legitimate calls
for some of the source numbers also
operator has many different
uses with different behavior for example
an
outbound call center that is making
calls to many remote clients
will not behave the same as some home
users
uh so of course first uh naive approach
to detect rsf would be just to look for
those test numbers and the number ranges
that we collected
but this is not a good solution because
this is incomplete we cannot track
all the iprm providers in real time all
the time
and also this is likely to bring some
false positives
because not all calls to suspicious
numbers
will be produced so
our approach our idea was using these
test numbers in a different way for
instance we
could we compute some irs likelihood for
the destination number
depending on the the distance of this
number to the known
test numbers or we can compute some
again
likelihood score for the destination
country that relates to the ratio of
iprns advertised from this country
and the test call logs observed to this
country
and finally we combined this with some
statistics from the call records like
how many seconds i've passed since the
last call
from the same source number or how
frequently the
source number calls this particular
destination numbers
um so we were lucky to obtain some
call records from an a small european
operator and we were able to evaluate
this approach actually
so the dataset we obtained includes four
different
irsf cases three of them are compromised
telephone systems
used for isf and one of them is a stolen
sim card
again used for isf so in total we have 3
000
fraudulent calls in this data set and
150k
legitimate calls and what we did was
actually by
using the features that i described
before we train the
random forex algorithm to classify the
calls as fraudulent or benign
and actually of course these are
preliminary
results but it turns out that this
approach works better than
just the time the naive approach of just
looking for test numbers
uh so we actually achieved much better
accuracy and much
less false positives but currently we
are
working on a much bigger data set to be
able to
uh evaluate this approach better
okay so the next fraud scheme that we
will talk about is
called interconnect bypass actually it
will be one form of
interconnect by password okay
so um one form of article
so essentially antarctic bypass is um
some flow technique where you will hoot
calls uh in a
normal way right you will get the course
over some roots which is not
the normal or the most likely root or
the most
quality roots and you will do this to
obtain some benefits so this this is a
general way
there are multiple techniques we will
talk in particular about over the top
bypass on some studies we did a few
years ago
so basically what is called over the top
so you probably heard this
a lot before over the top is in a way
the way that telecom operators call
services which run on top of the network
on which compete with their network
services like
telephony or messaging right so there
are tons of applications you recognize
probably most of the
icons there and these are basically
competing with
traditional telecom services and
providing some other services too
it's huge today right like it was sort
of like
billions of users and the thing is these
services they
in general need to make some revenue too
right so they are very cheap or free but
they still have to make some revenue
so typical ways of making a revenue is
advertisement or using selling some
stickers
or games etc and one way that is used
more and more is to actually provide
some interaction with telephony systems
in particular we can think of skype in
or skype out which is very
popular it's been there for years skype
in basically allows you to buy a phone
number
and get people to call this phone number
that would reach your scap
account and would ring on your computer
or anything you want
on skype out is from your skype account
you can call some
international numbers everywhere in the
world so i'm sure many of you already
use these services
and these are perfectly fine but however
there is
what is called ott bypass which we'll
describe in more detail
which is not so fine i'll show you why
um so essentially an ocd bypass call
is occurring over an international call
so like before you see you have a caller
cody another living operator some
transit operator
and some terminating operator and there
is some revenue share
along the way so you pay something to
your generating operator for him to put
your call
to the destination in autistic bypass
case it could be a call generated from a
mobile or
online it doesn't really matter but the
kodi
the number you call is basically a
smartphone
that has this ott application that has a
sim card with a phone number attached
so basically what happens here is that
this
transit operator is going to make an
agreement with the provider of this
service of this ott application
and they will root the calls over the ip
network on the call
that you generate to those this mobile
phone number those
plus 336 in front for example right is
not going to ring
on the normal phone interface but it's
going to ring on these
oct applications so maybe this occurred
to you already before
on this occurs in general over
international communications
so the big advantage of this is that
the transit operator doesn't pay
anything anymore to the terminating
operator
but it pays a lot less to the ott
provider
which makes some revenue and then is
keeping a lot more
a bigger share of the revenue so it's
increasing its revenue on
basically the transit operator and ott
operator are very happy about it
this has some consequences for the
caller which is going to
have some potential quality problems uh
you
pay for something for some quality of
service as an operator but you get
something else
you may pay for premium routing and get
something that's
similar to voip quality right
for the callee it's the same sometimes
you have quality problems the core don't
reach
you don't have the voicemail or the call
forwarding which are working because the
voicemail on the call forwarding are
actually handled by your terminating
operator your mobile operator
and there are some other trouble the
main problem of course is for the
terminating operator
because he's losing a lot of money all
the terminate all the international
calls
a big part of the international course
don't go through his network anymore and
he's not paid anymore for those goals
so to study this we actually made a
small experiment
we actually um took eight
fun phones with some sim cards
that we put in eight european countries
so those phones were actually controlled
over ssh they're basically rooted
android phones so we get them to some
friends
in eight countries and then we generate
calls
to some phones which are in france which
includes sim cards from this operator
on the home country operator is actually
giving us the call data records that
correspond to the calls we generate to
those numbers
so in the end we generated like 15 000
calls
on this small test network we built and
then we do some measurements
so the first surprise is that about 80
percent of the calls
in some cases up to 80 percent of the
calls go over the ltt network
right and this is huge right 80 percent
being hijacked in some cases is is
pretty important
there are six out of the eight countries
where there was some hijack where there
was some
bypass um the most surprising thing in
fact
was that there is multiple fraud schemes
which call it
right and this is quite funny so um
for example we see simboxing on ott
bypass to code
we generate a call from uk from some
phone number a new game
and then uh we have so we first
i would say first we we expect the the
call
to terminate on the sim card on the
phone
here to go over some transit and then we
expect the
the the mobile domination with the same
number as we called right so we expect
to see this number to ring
in fact we see sometimes that the
numbers
they go over same box and then they
don't show up as a
we receive the call we generate but we
don't receive it with a caller id which
is from uk but from russia
right so basically there's a same box in
the middle with a russian sim card
which could be maybe a stolen sim card
or fraudulent sim card and we see about
16 percent of
same box bypass but then we also see
some
plane ott bypass like before like i
mentioned before so there we see just
the
basically what we observe is that the
phone is not
the phone is not ringing on the mobile
network
but we see the ott application to ring
right and then we see the proper
phone number no problem but we have 36
percent of these
to occur and then the most funny part of
it
is that we also see some calls which go
first over the same box
and then they go over the ot bypass
right so in this case
it means you see your phone ringing on
the ott application with the russian
number
right and it's like who's calling me
um and that's that's kind of weird so in
the end we reach this 80 percent fraud
with like all possibilities and that can
get quite confusing for the user
so in the end so we have a paper where
we describe a lot more details on
experiments we
conducted we don't really have time
today but in the end
these frauds can lead to quite severe
financial loss for the operators
there are some core establishment
problems which we measure
on basically you can get your phone to
ring i mean the caller here
your phone ringing for one minute before
your phone actually rings
right and this is problematic because
maybe after one minute you just drop the
call so you never actually elsewhere
you won't have a chance to answer and
then
um there are some quality problems but
in fact if you look at this there is
zero benefit for the user
right so that's i think that's the main
problem um someone's making some benefit
you have some quality problems but no
benefit for the user something's wrong
um okay so with this um i'm going to
let me already talk about some
interesting topics on telephony voice
spam on scams
um so actually i think voice spam is a
bit more particular compared to the
the previous stuff we talked about
because this is something that i think
everyone in this room
experienced at least once in their lives
so what is voice pam we can define
actually a spam call as a any type of
unwanted or
abusive phone call so this has been a
problem since several years and there
are many solutions
um around like caller id blacklist
applications whitelist do not call lists
etc
but none of them are actually working
well we are still receiving a lot of
spam calls
so some people come up with alternative
solutions
for example they say that the permanent
solution would be too predominant to be
deaf or a child or
there are people who actually try to
troll back the
scammers and they spend for example
these guys spend
two two hours talking with a
windows technical support scammer
so of course these are also some type of
some sort of solutions but they are not
very efficient because if you
spend two hours with the scammer you are
also
spending your own time so you waste the
telemarketers time
or spammer's time but you don't you
shouldn't waste your own time
okay so this is then
[Music]
oh
so i you have seen lenny already
so uh lenny the guy that you all
just heard is such a is a kind of a
defensive chat bot that is created to
to defend against the voice spammers so
the creator of
leni is anonymous but it
is actually working surprisingly well it
is working very well
in dealing with various type of uh
spammers and it has growing popularity
online you can
find the youtube page there's a public
deployment of this chatbot basically
that people are forwarding their calls
and
you can find many different call
recordings lenny
of lenny dealing with several type of
spammers
so how this chatbot works
so let's say there's a spammer calling a
user
what the user does is basically either
on his mobile phone or on his landline
phone
he transfers this
call to the toy telephony server that is
hosting lenny he can either create a
conference call or call transfer or
make just make a setup call forwarding
and basically here the user will leave
from
leave the call or just mute himself and
after this point lenny will be
interacting with the spammers
this chatbot is actually made up of just
a set of
pre-recorded voice audio files and the
script that is running those recordings
once the
caller stops speed speaking
so as you see there is no speech
recognition no artificial intelligence
nothing advanced but
this chatbot is working very very well
and
we think that the reason that it works
so well is because of the the
conversational quality of those
recordings
another nice thing about this is that it
actually acts as a high interaction
honey pot for
uh voice spam
so as i said there is a youtube channel
playlist that you can find many
recordings of lenny online
so what we did was actually we choose
200
of those recordings randomly and we made
them transcribed with a commercial
transcription service it corresponds to
almost 2000 minutes of
phone calls then basically of course we
analyzed those
transcriptions in detail uh so the first
thing we
saw was that in these 200 phone calls
there you can find almost 22 different
type of
spams some of these are more on the
legitimate side
i mean according to the regulations of
the corresponding country which is
your united states in this case these
calls are legitimate like political or
fund raising calls
some of them are more like in the gray
area because
for example the telemarketing calls you
are never sure if they
actually get the user consent in a
proper way
and some of the calls are complete scam
calls like the tech support you
just heard there are several vacation
scams
nigerian scams and so on uh but the nice
thing is that
lily is effective against all type of
such spans so of course
we went over in detail to those
transcriptions and we analyzed how
different spammers interact with lenny
so there are several interesting things
here
so first of all i should say that lenny
never terminates the call so he never
says bye
he always keeps talking but
at some point the caller needs to of
course
stop like uh terminate the call
in some way so some of them actually try
to do it
this in a proper way try to say bye but
some of them are
not polite they are good and they just
hang up
so if we for example look at the ratio
of people who hangs up
you can see that the scammers are much
less polite
compared to for example the donation
calls
you can also see that the scammers the
average call duration for scam calls
is much shorter than
the rest of the course because once the
schemer understands that he won't get
any money he just
hangs up the call he doesn't want to
waste too much money
and finally we found that the scammers
use
bad words curse words much more than
the rest of the spammers
okay so i have been saying that lenny is
very effective
why i'm saying this because basically
okay so in this 200 phone calls that we
analyzed
um the average calderation was 10
minutes
actually in over all the the playlists
that
all the recordings available on youtube
the average call duration was 10 minutes
which is quite high and uh during this
10 minutes actually there are
58 in 158 conversation turns between
lenny and the spammers
and actually the spammer hears the
recordings almost
two times so he actually hears the the
repeated
uh recordings but they somehow do not
realize that they are
listening the same thing over again
and the one other interesting thing was
that uh
only five percent of the only in five
percent of the course laney was
explicitly
recognized as a bot or as a recording
so what we did was actually we
collaborated with a social scientist
who is specialized on conversation
analysis topic
and we get a subset of these uh
transcriptions that we get um we
made them like we analyzed them them
further with
some conversation analysis technique
so now i will make you listen actually
the first four terms of
lenny in isolation just to look at it in
more
detail hello
this is lenny second one
sorry i can barely hear you there
yes yes yes oh good yes yes yes
so as you see they they are very simple
very brief
lines but actually they are designed as
possible speech turns
they are they have some details that are
specific to natural speech like the
there are hesitations
self repetitions and some of the terms
initiate a new action for example in the
second turn lenny says i can barely hear
you there which
makes the caller actually repeat his
previous turn
and but some of the turns are responsive
for example the
the all the fourth one good dss
can depending on the context it can mean
acceptance uh like approval
so depending on the context it can mean
several
different types of responses
so this is an example uh
to to show you how these uh
these simple lines work when they are
how well they fit
in in one conversation so he
in this is the type of an example of a
credit card
scam call so as you see the caller
immediately enters the call with the
reason of the call he directly says
why he is calling and then he finishes
his turn with a question
this looks like a question but actually
the the preferred
answer here is a yes so he expects the
colleague to say yes
but actually lenny breaks this floor by
asking
saying that he is not able to hear and
as a result the caller
as you see just partially repeats his
first query and that makes like asks the
question again
and by chance because plain is designed
so well
actually the next answer of lenny is yes
so the conversation continues very well
like
nothing weird happened basically
so lenny is a as i said very simple
looking chatbot with pre-recorded fixed
turns but actually it is really
sophisticated due to the flexibility of
the turns
the close its closeness to nature's
speed
the coherency of the character and the
turns and so because this guy
is an old guy of course he will have
some hearing issues
so it sounds very coherent to the caller
and of also it has a very
good ability to control the conversation
somehow
uh sometimes leading the caller to
adjust to himself
so in conclusion of course this is a
very specialized chatbot it's working it
is working very well in this
narrow context of spam calls but
of course it wouldn't work in different
contexts probably
but we think that use of such chatbots
can be an effective way to
at least to slow down the voice spam
campaigns
okay so
just saying that overall telephony fraud
is likely to remain a significant
problem
uh there are weaknesses that are here
and they are difficult to fix right so i
mentioned for example voice
choleroid authentication there are some
atoms to fix it with protocols like
steer on the ietf protocols but it's
going to take some time
and every time we add a new layer of
technology it's going to bring new
vulnerabilities
fraudsters are quite smart and they have
strong incentives
basically i mentioned in the beginning
that telephony there is a lot of things
which are built
and there is because there is money
there is a
lot of ways to gain some benefit from it
some gain some money out of it so we
hear a lot about uh
surveillance in or hijack of course etc
so there are many
like security problems with diameter or
or things like this or 2g
security and so on but this can also be
abused for um for um
extracting some revenue from this by a
fraudster right so
so these uh these people have strong
incentives and they move very fast and
they typically hidden in some
different countries in the world with
like flexible regulations
in the end it's also interesting to
understand that fighting fraud can be
costly
so telecom operator will not fight fraud
if that's more getting more expensive
than
the actual loss or perceived loss right
and in the end sometimes it's good to be
as good
than the competition right so if you are
worse than competition maybe you need to
do something
but if you're the same as competition
maybe you're fine
okay so with this uh i will thank you
and we'll take questions
so we have uh questions from the
audience
please line up at the mics i see a hand
at microphone 2 please
hi for the talk um i wanted to ask
the calls that get routed through the
apps
um the damage to the end user might be
very minor acceptable uh nearly
uh net positive but what i don't
understand it's
it's very transparent to the end user he
actually realizes
which app he's being called on so there
is a way to track this back and it
should be very evident
i thought when you were putting up the
numbers i was expecting
0.8 2 like hiding it
in the trees that's the forest it looks
like
why don't they massively
intervene intervene stop it so
so um so your question is one so you
expected it
not to be 80 but 0.8 percent yeah so
i think if it depends how you look at it
right if you look at the calls from this
source to this destination
if you have the phone with the
application installed on your registered
on the
ip network then you may have very high
levels but overall in the world traffic
it may be very low
right it may be as well very high for
some termination
so if you have a sim card for a country
where you have
40 cent termination rates right not like
france or
germany where you have like maybe two
cent determination rate with even the
european regulation was very low
but if you have a very high termination
rate there in these countries you may
have a lot more
of this bypass right and the other thing
is yes of course the user will notice it
because it's not going to ring on the
normal and say android dealer interface
but it's going to ring on this
application so you may not notice it if
you
maybe expect this person to call you on
this application or if you don't check
if they
recall from the application or from the
normal mobile it's going to look awkward
if it's
like your grandmother calling from the
long line and that's ringing on this
new fancy application you have but then
it's going to be obvious yes so yes it
is obvious it's easy to detect for the
end user
um actually it's something you can
deactivate if you go search very far in
the settings
which are checked in by default defaults
but the thing as well is that for the
operator it's very hard because the
operator doesn't see the call
determination operator doesn't see the
call at all anymore and that's the
difficulty for the operator itself
okay microphone 4 please
hi thank you for the talk do you have
any stats on
what apps are used for ogt
so yes but all lawyers don't want us to
mention it but if you google
online you will find it easily so no
worries just google for it
you will know okay thank you a question
from the internet the signal angel
yes the internet wants to know with the
callback spam where the route is
hijacked uh who's paid fake for that is
it the provider or the end user
so who's pay if you have the callbacks
come so you get a call
you call back so you as a user you call
this premium number
and then this premium number will be
supposedly registered by the foster
so you pay for the call back and then
the part of a part of this cost of the
call that you pay
would be given back to the to the
fraudster
um if that may be a good answer
okay microphone one piece yeah
what application did you use in your own
study
to get those rates or if you're not
willing to tell it
would be able would we be able to find
it somewhere
how to generate the calls you mean the
test calls
you did a study on the ott bypass with
those percentage rates of like eighty
percent in spain
uh what what application was that
uh okay so can we use to generate the
calls or sales for the test calls
i think he is asking for the application
that is doing the bypass
yes that's what same answer is before
oreo doesn't want us to mention it if
you google it you will find it
multiple applications or
so multiple applications so we know of
one of them so we did all these
experiments on one
application only but we are not sure if
there are more of doing the same thing
basically okay microphone
um five please regarding the sim box
fraud
where are those sim cards coming from
sorry the echo is bad
where are the sim cards coming from and
how do the frauds just avoid
paying for the calls because i would
assume calling
from a sim card would not be cheaper
than routing the call legitimately
so where are the sim cards coming from
basically there are multiple ways
they can use stolen sim cards but this
is i think i would say less likely
there are some countries actually that
that you can obtain
sim cards without like giving your
identity
these kind of things so in those
countries it is much easier to obtain
a large number of sim cards um
and mostly they abuse the sim card like
let's say there's an operator that is
making um
like a promotion that he says okay
calling
from russia let's say to this country
from my network
it will be very cheap for the next few
months let's say so then
they are more likely to abuse this type
of
um like low tariffs and
promotions from the operators there are
sometimes some bugs in the
in the numbering plans so the operator
may actually
they have to have for every destination
or cost right
and sometimes they have some mistakes
right so if they have a mistake in their
numbering plan
and they will charge you if say to call
zimbabwe you will maybe call the same as
germany because they made a
mistake in the in this table where they
put the phone number destination on the
price
so if a foster find this on fines that
he would pay like
say five cents instead of paying 35 he's
going to buy these sim cards buy
20 of them put them in same boxes and
it's going to sell this traffic for
cheaper than the normal rates
i think that was the second part of the
question as well but maybe we omit it
google has google has developed a very
sophisticated chatbot
for phone calls would that be a suitable
lenny 2.0
um yes so i think the thing with the
google's
chatbot is that they have to say that it
is
i mean they have to say that it is a
chat well okay there are so
so probably they could be used for this
as well right but i think they have been
designed for something else
so i think there is already from google
there there is a service that
that actually answers your spam calls
i don't have much knowledge about it but
there is also the chatbot that
makes for example makes reservations for
you
definitely it is a much complicated and
better artificial intelligence
i think it will work well if it is also
combined with
some conversation analysis techniques
the thing as well is that so far
um there are a lot of these let's say
alexia or google home etc
when you talk to them you know you are
talking to a bot right um
if they have a voice that's kind of
synthetic it's fine because you know
you're talking to a boss
if you think of lenny he has a human
voice it's a good actor who's actually
speaking this it's hard to recognize
this voice as fake because it's a real
one right just the conversation is fixed
and it's dumb
uh but azalene is just unswearing turns
he's not
driving the conversation to anything
smart it's working quite well so
maybe if the these bots would become a
lot
better in voice quality um in like this
conversational
organization of the discussion uh then
maybe they could be used as well similar
ways as lenny but so far it's not
yet there exactly i think
i have another question about the ott
um how do they know that the
application the ott application is
actually installed on the
callee's device how do they know that
and
also does this scam require the ott
application to actually be actively
participating in the scam and to be
kind of complicit in it or are they just
like an annoying
bystander in the scan
so the way it's working
is the ott service provider is actually
advertising
uh call termination on the
two operators right then
when they agree on a deal um you will
have the operator who's going to
basically say oh
i receive on my network so my incoming
traffic
for calling determination say i don't
know
so africa right south africa
and then you look at your hits and you
say okay i have uh i have
going through i don't know dutch take on
that much permanent
going to uh orange
orange that much and so on and then you
have many many maybe you have 20
different possible routes and you will
say okay i have also this ott
operator um the thing is you would be
only able to carry over
the call to this operating operator if
on the other hand
we have the phone which is having this
application activated
and if it's running on if you're on the
ip network
for this basically the thing is that on
many ot
applications today you register on the
ott application with your phone number
so first the same phone number for the
actual sim card and for the application
second the the
ott operator is kind of having a heart
beat thing so he knows the phone is
active
on the application is active and can
ring or not
at this point the the the telecom
operator is going to try to root the
call
if if this is already checked let's say
the operator
is going to try to hold the call over
the ott network
if it's working it's ringing and it's
fine
um sometimes it's not going to succeed
so it's going to fall back to another
network
right so it's going to hold the call on
the ot application
only because they have a prior deal with
it for it and it's going to be only if
the application is active and then it's
going to ring maybe
and if it doesn't if it doesn't work it
doesn't connect
then they will fall back to another
another route that's at least over
understanding
how it should work there is also patents
if you want to
read patentees
in the first scam case how do the
fraudulent operators make sure
they get the call and not somebody else
and how
are their lists or efforts to keep lists
of fraudulent operators
um so they actually there is no way to
make sure that you will get uh
the call and that's why the actually
there are there are
there is those test interfaces that they
the fraudsters makes several
calls to several destinations to see one
that is working
uh so most of the time if the if the
operators use
like transit operators which are large
ones like orange for example it has very
big
orange international carriers are very
huge so
and it is very very less likely to
to have fraud in that network but some
if some small or fraudulent transit
operator
is on the the call route then you are
more likely to end up
in the fraudulent road route
yes so i mean they never make sure that
they will get the call they just hope
that
they the call will go over them
basically and if it doesn't work just
test another number in another country
another destination
they would test until they see the
number to appear on this test interface
so they say okay no i know this number
are going to be hijacked or they i can
make some cash out of it and then you
just use this
you get a new number that you will
generate cash on this provider we know
that when they see this number it's you
generated the course yeah
and actually the call routing is very
dynamic so maybe today
there is the high-tech verbs and
tomorrow maybe it won't work because
the operator started to use a different
route
microphone hey do you have any
statistics
on how to say all kinds of
scam being done like um and
who's that do you have any idea about
the people behind those camps
because they know for a fact that in
some countries
uh there is quite popular scam from
prison like prisoners calling and
saying like your daughter got in traffic
accident
you have to pay this and this
yes so in terms of scams i
don't have much idea i mean for
telemarketing for instance there are
many call centers
uh running the telemarketing campaigns
all the time but in terms of scams
i am not really sure who will be behind
because
if you look globally on telephony roads
so you can refer to the cfc study which
is not
maybe perfectly accurate but that gives
an idea on the classify the big frauds
by how much they cost or how much in
fact operators claim they cost to them
so that's why it's not perfectly good
100 accurate nothing would be perfectly
accurate
but you see irsf has a very big one you
see a sim box
as quite big as well on things like this
so i think you can't get very detailed
about this then who are the people doing
this
i think it depends a lot so you have in
fact operators floating each other a lot
apparently you have
people who just like run their small
fake companies on puts in boxes
somewhere on just advertise so you have
one person
companies a lot of telecom operators are
in fact one person company doing this on
the side job having a server
in a telephony server in a place where
you have uh
you have no tax for example on the
that just running under they get some
mixing some legitimate traffic with some
fraud traffic and then they just make
some fusion benefits they're called the
roots
on this kind of things so it's it's a
fairly complex ecosystem and i wouldn't
be able to just point one
kind of people for this
so unfortunately we don't have any more
questions
so let's give a big hand of applause for
our speakers
thank you
[Music]
you