TWC: Small: Securing the New Converged Telephony Landscape

由于技术进步以及法律和法规的变化，使几乎普遍的语音通信成为可能的电话系统经历了戏剧性的变化。虽然这些变化提供了许多好处，包括低成本呼叫和更丰富的功能，但它们也引入了新的漏洞，可能会严重破坏人们对通过电话渠道进行的交易的信任。事实上，电话中的来电者模拟和社交工程越来越多地被用来实施欺诈和窃取在线账户接管的凭据。该项目专注于有助于保护新兴电话环境免受这些和其他新兴威胁的研究。为了更好地了解安全威胁，该项目首先探索了使用电话蜜罐来表征有害和恶意呼叫的来源和性质以及这些呼叫所利用的漏洞的可行性。基于对这些威胁和漏洞的了解，研究了新的技术来打击和缓解基于电话的攻击。例如，为了解决呼叫元数据操纵，研究嵌入到呼叫音频本身中的特征，这些特征可能被用来以更稳健的方式建立呼叫源。该项目还试图了解跨渠道恶意活动，即攻击者利用网络和电话渠道设计和发动复杂的攻击。电话在过去一直是一个值得信赖的渠道，该项目探索了在语音通信将越来越多地与我们的其他在线活动相结合的情况下，未来如何能够实现值得信赖的沟通。

The telephony system, which enabled near universal voice communication, has undergone a dramatic change due to technological advances and legal and regulatory changes. Although these changes offer many benefits, including low cost calling and richer functionality, they have introduced new vulnerabilities that can seriously undermine the trust people have in transactions conducted over the telephony channel. In fact, caller impersonation and social engineering over the phone are increasingly being used to commit fraud and steal credentials for online account takeovers. This project focuses on research that can help secure the emerging telephony landscape against these and other emerging threats. To better understand security threats, the project first explores the feasibility of using a telephony honeypot for characterizing the sources and nature of unwanted and malicious calls, and the vulnerabilities exploited by these calls. Based on an understanding of these threats and vulnerabilities, new techniques are investigated to combat and mitigate telephony based attacks. For example, to address call metadata manipulation, features embedded into the call audio itself are investigated, which can potentially be used to establish the source of a call in a more robust manner. The project also seeks to understand cross channel malicious activity in which attackers utilize both the web and telephony channels to devise and mount sophisticated attacks. Telephony has been a trusted channel in the past and the project explores how trustworthy communication can be enabled in the future when voice communication will increasingly be integrated with our other online activities.