Great service since 1981 | TeleDynamics distributes wholesale telecom equipment & supplies to qualified dealers and installers only

Become a Dealer Now

Great service since 1981

TeleDynamics Think Tank

How to protect against TDoS attacks

Posted by Daniel Noworatzky on Jul 15, 2020 10:53:00 AM

TDoS concept: lots of telephone receivers behind a padlocked circuitry

Telephony denial of service (TDoS) is a type of cyberattack that can be used to disable telephony systems. Similar in concept to a typical data network DoS (denial of service), its purpose is to deny users access to a particular telephony service. In this article, we discuss how TDoS attacks are conducted and what measures you and your telco can take to protect your systems.

What is a DoS attack?

The goal of a DoS attack is to make a system unavailable to its legitimate users by temporarily or permanently disrupting its services. This is typically done by overwhelming the system with a swarm of fake machine-generated requests for system resources, thus incapacitating the system from responding to the requests of legitimate users. In the case of a web server, for example, tens of thousands of fake HTTP requests can be sent to the server, from hundreds or thousands of computers on the internet. This results in the web server’s resources (memory, CPU cycles, network bandwidth) becoming too overwhelmed to respond to genuine requests for content, rendering the service unavailable to users.

To use a brick-and-mortar analogy, a DoS attack would be like a group of people who have no intention of purchasing anything crowding around the entry door of a shop, making it difficult or impossible for legitimate customers to enter, resulting in a disruption of trade.

What is a TDoS attack?

A TDoS attack is a DoS attack on a telephony system. Unlike attacks on network servers, the primary resource targeted by TDoS schemes is the voice channels themselves. For example, an enterprise telephony network has a finite number of voice channels to the PSTN. If all of those channels are engaged, no additional calls can be routed, either in or out. TDoS attackers find ingenious ways of creating bogus calls that can quickly saturate PSTN connections.

TDoS attackers and their targets

TDoS targets can be enterprise telephone systems, contact centers, or even the telcos themselves. 911 emergency services have also been targeted. There have been examples of attackers using TDoS to either advance a particular political agenda, or to exact revenge against a specific company or group of people. Sometimes TDoS is used as leverage for extortion, where attacks will continue unless a ransom is paid. There are also documented cases where a TDoS occurred unintentionally, as is the case in 1981 when the song 867-5309/Jenny was released and became a hit, prompting callers all over the U.S. to call the number asking for Jenny.

TDoS techniques

The most common way telephone systems are attacked involve the saturation of the voice channels. For contact centers, enterprise networks, and emergency services, this can be done in various ways:

  • Machine dialers – Also known as robo-dialers, these are machines connected to the PSTN that can generate multiple calls to particular numbers, saturating telephone lines. They can either take the form of an older stand-alone device connected directly to a phone line, or in the form of a program in a computer, which takes advantage of VoIP, making robo-dialers generally inexpensive and readily automated to perform their attacks.
  • Caller ID spoofing – Using machine dialers, calls can be made simultaneously to thousands of telephone numbers, all with a fake or spoofed caller ID – specifically, the caller ID of the victim. These calls are immediately hung up when they are answered, or if the call is not answered after a certain amount of time. When these thousands of subscribers see the caller ID, some will attempt to call back, causing a temporary saturation of calls on the victim’s telephone system.
  • Brute force – Attackers simply hire telemarketers or even just anyone, to make calls to a particular number at a specific time to intentionally overwhelm their systems. 


How VoIP and conventional telephone networks differ when it comes to TDoS

Both conventional and VoIP telephone networks are vulnerable to TDoS attacks. However, they are affected by them in different ways:

  • Traditional telephony systems
    • These are comprised of a fixed number of voice channels provided over either analog lines or ISDN PRI trunks. Once these are saturated, communication in and out of the system is essentially disabled.
    • Since there is no other type of network connectivity, traditional PBXs are not subject to other types of network attacks.
  • VoIP telephony systems
    • These use SIP trunks for their connection to the PSTN. Although configured with a specific number of voice paths, the number of these paths is not fixed and can be dynamically changed. This provides a greater level of protection, as described below.
    • Such systems are typically connected to an IP network and thus may be vulnerable to traditional DoS and other data network attacks, if insufficiently protected.


How to protect systems against TDoS

Regardless of what kind of system you have, the first line of defense is the telco. It is responsible for having systems in place that will detect TDoS attempts and protect your network from them. Establish an effective partnership with your telco and find out more about what kind of protection services it provides.

Telco protection features can include:

  • The blocking of known malicious caller IDs.
  • Enabling algorithms on SIP trunks that can recognize TDoS events and dynamically block calls, while temporarily increasing the number of available voice paths, ensuring at least partial service for legitimate users during an attack.
  • Cooperation with authorities by disclosing caller IDs and call routing information within the telco’s network to discover, halt, and prosecute TDoS attackers.

Because no mitigation techniques can be 100% effective, some additional preparation tasks you should execute include:

Recommended actions to take during a TDoS attack include:

  • Limit the number of internal phones that the attack is targeting, focusing on hunt groups, busy-no-answer forwarding, and voicemail termination.
  • Use social media and other channels to advertise an alternative number to call in the event that the main number is under attack.
  • Determine if the calls may be coming from a legitimate source whose systems have been compromised for use in the TDoS attack.
  • Remember that TDoS attacks are illegal and subject to prosecution with serious repercussions. Get the authorities involved as soon as possible.


Conclusion

TDoS attacks can be a scary prospect, especially for enterprises whose primary source of income depends heavily on telephony service. Being prepared for such attacks can go a long way towards mitigating and resolving them, as well as finding the perpetrators.


You may also like: 

Common Wi-Fi security threats and how to mitigate them

How to hack-proof your VoIP network

For a safe new year, you need more than a firewall

 

 

Topics: Business Telephone System, Network Security, Business Continuity

Add a Comment:

Welcome to our Think Tank

In this blog you'll read our thoughts on business telephone systems. While a lot has changed in telecom since TeleDynamics was founded in 1981, we remain as committed as ever to delivering the best customer service in the industry.

If you would like elaboration on a specific topic, please let us know in the comments section.

Happy reading and thanks for stopping by!

Receive New Articles by Email

BiBA-2017-silver-midres.jpg

Recent Posts

click here to download our step-by-step guide to using Wireshark for troubleshooting VoIP
Grandstream HT Gateway spec comparison table download
New Call-to-action
Download TeleDynamics' Guide to Media Gateways
Grandstream GWN7610 Product Review