Preventing VoIP Spam

As VoIP networks proliferate, the threat of voice-based spam clogging them becomes more and more real.

Looking at the nuisance created by e-mail spam,will history repeat itself here also?

Spam on VoIP is called SPIT (SPam

over Internet Telephony).Everyone

gets spam,especially if he/she has an

e-mail address.While we’re still fighting email

spam, it’s threatening us on VoIP too.

Spam is quite possible over voice circuits,

especially the VoIP ones, and it can be just

as menacing as that over e-mail. And the

reason for this is because it uses the same

TCP/IP for transport.

In fact, the annual cost to companies

around the world for just fighting spam

was as high as Rs 45 Bn in 2003 and this is

expected to rise to Rs 765 Bn this year.

Besides huge financial loss, companies

also have to put up with loss of productivity

and increased costs of support on their

IT desks. Since the IT desk would need to

intervene in tracking and blocking such

spam on your coporate networks.This cost

will only go up once spam becomes prevalent

over VoIP if not controlled in time.

Let’s look at this threat a little more closely.

How would it work?

Voice based spam has already become

common today, although limited to PSTN

networks.Remember the calls that offer a

new credit card, or ask you to renew your

car insurance, or offer a bank loan? It’s all

spam,and they come at the worst possible

time —like when you’re in an important

meeting. While we have enough of this

spam, imagine if all that forwards, chain

mail and jokes you get over e-mail also

started coming to you over the phone.With

VoIP, it’s quite possible, because it’s using

the same standard TCP/IP network as the

data traffic. It’s just that the termination

point for your regular spam is a mail client,

while for voice it’s a VoIP phone or softphone

(software VoIP phones).

Moreover, voice spamming over VoIP

is easier than traditional PSTN networks,

because now you can just store a standard

voice message on a server somewhere,and

keep forwarding it to different VoIP extensions

from time to time.Or perhaps a voice

message comes hidden inside a trojan as

an e-mail attachment and starts spreading

over your VoIP network – because they

share the same network.You would lose a

lot of time and money simply tracking

them.

There are other reasons why VoIP

spam is more dangerous than voice spam

over PSTN networks.For instance,current

methods of spamming on your PSTN network

are very costly and risky. Simply

speaking,no one would bother to call up to

spam you, from US or Canada, or even

from a far away city in the same country –

the costs are far too prohibitive. Plus, your

call is traceable using tools available with

both the PSTN provider as well as law-enforcement

agencies, quickly. This makes

the proposition attractive only for telemarketers

in your local vicinity. In many

countries including India, PSTN and cellular

spam is even illegal. But the same

does not hold true when you talk about

VoIP, because now the call can originate

from anywhere on the globe and even if

they talk for an hour the cost to the spammer

is a mere fraction of the same call

through a PSTN line.And even if you manage

to track down the spammer,you would

still need to use international bureaucratic

channels before you could do something

about it.

Is prevention possible?

One of the biggest challenges in dealing

with voice spam is that it is next to impossible

to get automated software to analyze

and filter out voice data in real time

unlike with text data. Accents, languages

and purpose behind a voice-message are

far more complicated to decode (for software)

than it is to guess the purpose of a

text message.

However, some of the techniques developed

to combat e-mail spam can be applied

to VoIP as well—such as the

DomainKeys, Sender ID (New Techniques

to Fight Spam , page 20, PCQuest, November

2004,) and IBM’s recent FairUCE technologies.

These techniques work by

comparing the sender of the message with

lists of people who can or cannot send

such a message and then deciding if it was

spam or not. Since VoIP data travels over

TCP/IP packets (just like e-mail),the same

techniques can be easily adapted to combat

voice spam as well. People in the

US/UK would be able to use their DNC (Do

Not Call) registries to rid themselves of

this menace early.

Prevention techniques

How exactly do you police voice traffic?

One way would be to have a limitation on

the number of voice connections that a

certain voice gateway is allowed to make in

a given time interval (say, a day). Similar

techniques are already in vogue for Internet usage, where an ISP would place a

bandwidth limit on your account. This

would at least limit the amount of spam,

though not eliminate it.

IP Filtering

Like we said earlier, a VoIP connection

mandates a valid Internet connection and

hence an IP address. Filtering of this IP

address using well-known black or white

lists could alleviate the problem.But if the

caller is on a connection with a non-static

IP address, this becomes ineffective as

well.

Authentication

VoIP protocols and specifications like

the H.323 (including its.450.x extensions)

and SIP have been designed to support

authentication mechanisms that demand

that the sender of messages authenticate

and authorize themselves before they

send a message.Making it mandatory for

spammers to identify themselves would

work the same way with voice messaging

as it does with e-mail today .

Unlike with e-mail where the sender

need not be online when the recipient

reads the message,VoIP senders must be

online while the call is in progress. This

makes it easy to use filtering techniques

against them.

One last viable method is

challenge/response authorization. In this

case when someone rings your VoIP

phone, the software at your end could require

a series of inputs (like a numeric

password) to be entered.Only on valid authorization,

the call would be allowed to

complete.

Unlike with e-mail where automated

messages from ‘no-reply’ dead-boxes

(where the sender’s e-mail ID is faked to

eliminate replies) would never see the

challenge messages and, thus, cannot respond

to them, a VoIP call remains active

till disconnected and so this could catch

out spammers big time.However,for business

users or regular users of voice messaging,

this may soon become an irritant,

causing them to abandon the service

altogether.

Therefore, in the short-term, we predict

blacklists and IP-filtering methods

from e-mail spam fighting to jump in to

keep our voice networks clean.Later, challenge/

response and other complicated

mechanisms may find their way in, depending

on how effective the existing

methods prove to be,to keep humans from

talking to humans.