GoKawiilknock-knock.net
Citigroup, Idaho, and Build-A-Bear Launched a Coordinated Attack on Me
A multinational bank, a US state, and a custom teddy-bear workshop all unwittingly joined the same phone-fraud botnet. Here's how to check whether one of your own machines got caught in the same honeypot.
On August 1st, Citigroup, the State of Idaho, and Build-A-Bear launched a coordinated attack on me. They weren't alone. Lockheed Martin joined in, along with the Spanish National Police, the Los Angeles Superior Court, SoftBank, Argentina's state oil company, a Swiss canton, a UK hedge fund, two universities, a hospital, and three additional international banks. A partial list of these organizations is at the bottom of this post.
Over the next 27 hours, in four distinct waves, all of them tried to use my VoIP (SIP) server to place phone calls on my dime. This is a scam called International Revenue Share Fraud (IRSF). The idea is simple: the attacker gets your phone system to dial an international premium-rate number that they secretly own, and they pocket a cut of every minute. It's the phone version of an open mail relay, and my server was being probed as the open relay.
Here's what makes "coordinated" more than a figure of speech. Every one of these networks tried to dial the same phone number, and they spoofed the same small set of fake caller IDs: the same handful that surfaced, in the same waves, on servers I run in Los Angeles, New York, and Tokyo. Unrelated infected machines don't independently choose the same disguises, target, and timing. These bots were all taking orders from the same place.
Obviously none of this was sanctioned by Citigroup, Idaho, or Build-A-Bear. What almost certainly happened is more mundane. An employee clicked a bad link, or brought an infected laptop onto the network, and a bot quietly went to work. That bot is now sitting inside a corporate or government network, dialing out to a fraud ring, and it presumably has access to whatever else is on that network.
No harm was done to me. My SIP server is one of a set of honeypots that has now recorded over 11.5 million protocol attacks, and it logs exactly what each attacker was trying to do. But if I were Citigroup, or the State of Idaho, or Build-A-Bear, I'd be less concerned about showing up in this dataset, and more concerned about having a rogue machine on my network.
Check your own network
The good news is that it is trivial to find these rogue machines. Here is a free and easy API that lets you look up whether any recorded attacks came from your network, providing open access to some of the honeypot's historic data. You can check a whole ASN, a set of CIDR ranges, or a single IP, with no signup and no API key.
... continue reading