In what looks like a highly developed piece of irony, hackers have proven that Voice over internet Telephony (VoIP) accounts are prone to the nuisance of voice spam - by attacking the university where the co-author of the protocol that VoIP runs on is professor of computer science.
Henning Schulzrinne, co-author of the session initiation protocol (SIP) that is used by all the major VoIP services except Skype, believes the attack (which left unsolicited marketing messages on multiple phone extensions at Columbia University) might have been targeted at him, but could also have been a result of the institution not having a stringent firewall policy in place. Either way, he - like many in the computer and internet security industries - now believes VoIP is the next big target for spammers.
Tempting medium
"It's just too attractive for them to pass up," he says. "Spam filters are getting so good now that it's rarer for spam to actually be read, it's nearly always filtered out and most people know to ignore it if it isn't. The phone, though, is something you instinctively pick [up] and you would always go to pick up messages. It's a very tempting new medium for spammers, particularly if they can find a way of building up the huge networks necessary to automatically distribute voice spam as they have done with email spam."
Although "spit" (SPam over Internet Telephony) attacks are very rare compared to the everyday nuisance of email spam, Yuval Ben-Itzhak, chief technology officer at computer security company Finjan, has discovered three spit attacks this year which showed VoIP spammers are thinking along the same lines as email spammers. One promoted a fitness protein drink, the second tried to lure users on to a site filled with malware and a third was a "pump and dump" scam intended to inflate the share price of a small American company.
David Endler, director of security research at TippingPoint, reports that both of the accounts he has opened with a popular VoIP provider have received multiple Spit attacks, even though the numbers are unpublished.
"It's definitely happening, I'm just surprised we're not seeing a lot more of it," he says. "It's going to become a nuisance because the voice files are a lot larger than email spam, so they're going to strain and slow down networks and when it's a case of a phone ringing, instead of an email just popping in to your email inbox, it's just so annoying because it can be at any time of the day. Even though spit is designed to leave itself as a voicemail message, it's still going to be annoying if your voicemail box gets filled up with junk."
Endler warns that the darker, more threatening side of this kind of spam will come when voice phishing - called "vishing" - takes off.
"The real problem with VoIP is that it's very easy to take a name as your identity which appears with a call, or to put up a number on a screen that isn't actually the number that the call's being made from," he says. "This lends itself perfectly to vishing, which we've already started to see, and I'm genuinely surprised we haven't seen more. People generally trust the phone, so if they get a voicemail from their bank saying they need to call in, they will, and they're used to telling an agent some security details or tapping in a passcode on the phone to prove who they are. As soon as they've done that they've given a hacker their identity."
This is the direction Jean Paul Ballerini, senior technology solutions artchitect at IBM, believes spammers will go because it is more likely to lead to money for them.
"We've already seen a vishing campaign in America, where VoIP has a far higher penetration, where someone was pretending to be from the Bank of America," he says. "If people called back the number, as the voicemail instructed, the likelihood was they were going to give away their security details. I think this is going to be the most prevalent form of spit because it will catch people out. I don't see people phoning up someone to buy counterfeit Viagra, or something similar, because the phone is too personal. That type of spam, I think, only works with email because it's so impersonal and so people aren't embarrassed by clicking on a link."
However, the one major tool the spammers are missing so far is the equivalent of a botnet - a network of malware-infected PCs which email spammers use send millions of messages anonymously.
However, Paul Wood, senior analyst at computer security company MessageLabs, believes this is only a matter of time. "When you look at the recent effort that is being put in to spreading trojans in Skype, mainly through its instant messenger client, it's pretty obvious what the hackers are trying to do," he says. "If they can get enough logins they then have access to each person's buddy list, and so you start to get to a point where spammers could have the volume and those voice spams will appear to come from friends."
This is certainly the opinion at Secure Computing which keeps "an eye on the enemy" in chatrooms where hackers boast of latest developments. Its principal research scientist, Dimitri Alperovitch, warns that spit is the latest hot topic among hackers who appear to be on the verge of moving on from small proof-of-concept attacks in to mass campaigns more akin to the scale of email spam.
"There's already someone claiming to have reverse-engineered Skype to allow multiple messages to be placed in voice mail inboxes," he warns. "This is how hackers popularise what they can do so people can make offers to buy or rent the capability from them. From what's out there it seems an inevitability that spit is almost certainly going to be the next big thing for spammers."
Theoretical threat?
Providers of VoIP services, both for PC calls and for landline connections, are publicly claiming there is no problem with spit in the UK and so the public need not worry. Colin Duffy, chief executive of Voipfone, claims that any problems are "largely a theoretical threat". Likewise, Hugh Roberts, a senior strategist at Patni, a VoIP consultancy, sums up the discussion about spit as "a storm in a teacup".
However, the news this week of Skype and 3 partnering to offer a mobile phone with Skype telephony and IM facilities was preceded by an ominous warning by IBM's Ballerini, who believes spit will only be a problem when there are sufficient users: hence hackers are just waiting for VoIP to be launched on mobiles.
"The hackers need VoIP to get a lot more users to make it worth their while, and ideally they need it to become available on mobile phones because there are already several viruses that spread by Bluetooth," he says.
"With email better protected, it just needs enough people to be prone to attack and the hackers will move to VoIP. It's just a matter of time."