Re:A distributed peer to peer list of bad actor IP addresses...
by mabbo on Saturday February 05, 2022 @10:10AM
(#30221789)
IRSF is a fascinating topic.
As it was explained to me (anyone feel free to correct me if I'm wrong), a shady/criminal organization takes control of a piece of the phone network. They pick a range a phone numbers for a country that is usually expensive to call, maybe a range of numbers that doesn't actually exist in that country, and they use the phone network to "advertise" a slightly cheaper route to connect phone calls to those numbers. Instead if it costing $1, it costs $0.80.
When someone makes a call to those numbers, they charge the cheaper rate, and then don't actually connect them to a real phone. Every time a call is made, they just get money.
The "S" is for "shared". They offer other organizations "for every call you generate to this range of numbers, we give you a cut". Let's call it 20 cents.
Now picture how many organizations are vulnerable to this. Every "call me back when a customer service rep is available". Every "call me to let me type in a code to verify I'm human". Every "leave a number our sales team can reach you at". They're all being attacked by these sorts of things constantly.
The cost to get a bot to trick the system into making a phone call is much smaller than the revenue generated. As long as that is true, the attacker wins.
As it was explained to me (anyone feel free to correct me if I'm wrong), a shady/criminal organization takes control of a piece of the phone network. They pick a range a phone numbers for a country that is usually expensive to call, maybe a range of numbers that doesn't actually exist in that country, and they use the phone network to "advertise" a slightly cheaper route to connect phone calls to those numbers. Instead if it costing $1, it costs $0.80.
When someone makes a call to those numbers, they charge the cheaper rate, and then don't actually connect them to a real phone. Every time a call is made, they just get money.
The "S" is for "shared". They offer other organizations "for every call you generate to this range of numbers, we give you a cut". Let's call it 20 cents.
Now picture how many organizations are vulnerable to this. Every "call me back when a customer service rep is available". Every "call me to let me type in a code to verify I'm human". Every "leave a number our sales team can reach you at". They're all being attacked by these sorts of things constantly.
The cost to get a bot to trick the system into making a phone call is much smaller than the revenue generated. As long as that is true, the attacker wins.