TWC: Medium: Collaborative: Exposing and Mitigating Cross-Channel Attacks that Exploit the Convergence of Telephony and the Internet

技术的快速进步现在使人们能够从随身携带的智能电话设备同时访问电话和互联网服务。虽然电话与互联网的这种融合带来了许多好处，但它也使网络犯罪分子能够开发越来越复杂的攻击，将电话和互联网渠道的联合收割机资源结合起来。例如，含有互联网链接的文本消息可以将毫无戒心的用户引导到恶意网站，廉价或免费的语音服务可以用来进行电话欺诈活动，呼叫者身份欺骗和自动拨号服务可以用来拨打电话，发动难以检测和跟踪的大规模攻击。这类攻击通常长时间未被发现，从而破坏了传统上与电话渠道相关的更高级别的信任。该项目探索了一种地面实况驱动的方法，以研究和理解利用互联网和电话渠道的跨渠道攻击。一个关键目标是暴露跨渠道攻击中使用的战术和基础设施与广泛观察和研究的仅互联网威胁的任何重叠。本研究使用了几种跨渠道滥用的数据来源，包括众包情报和电话蜜罐数据。目前可获得的滥用电话信息大多没有结构，其准确性或完整性也不得而知。研究人员正在挖掘滥用信息的多种来源，并引入新的方法来更好地了解，检测和跟踪通过电话和互联网渠道进行的攻击。还研究了将这些渠道中的每个渠道的威胁情报关联起来以提高防御能力的有效性。通过研究促进跨渠道攻击的恶意基础设施的属性，该项目将使研究人员和运营社区能够提高态势感知能力，并开发减轻和防御这类新威胁的技术。

Rapid advances in technology now enable simultaneous access to both telephony and Internet services from smart phone devices that people carry with them at all times. Although this convergence of telephony with the Internet offers many benefits, it also provides cyber criminals the ability to develop increasingly sophisticated attacks that combine resources from both the telephony and Internet channels. For instance, text messages containing Internet links can direct unsuspecting users to malicious websites, inexpensive or free voice services can be used to carry out phone fraud campaigns, and caller-ID spoofing and autodialing services can be used to make calls to launch large-scale attacks that are difficult to detect and trace. Such attacks often remain undetected for long periods of time, thus undermining the higher level of trust that has traditionally been associated with the telephony channel.This project explores a ground-truth driven approach to study and understand cross-channel attacks that make use of both the Internet and telephony channels. A key goal is to expose any overlap in tactics and infrastructure used in cross-channel attacks with the extensively observed and studied Internet-only threats. Several data sources of cross-channel abuse are used in this study, including crowd-sourced intelligence and telephone-honeypot data. Much of the currently available telephony abuse information is unstructured and its accuracy or completeness is not known. The researchers are mining multiple sources of abuse information and introduce new methods to better understand, detect, and track attacks that are carried out across the telephony and Internet channels. The effectiveness of correlating threat intelligence available from each of these channels to improve defenses for both is also investigated. By studying the properties of the malicious infrastructure that facilitates cross-channel attacks, this project will enable both researchers and operational communities to gain increased situational awareness and develop techniques for mitigating and defending against this new class of threats.