How To Counter SpIT

Transcription

1 Countering SPAM over Internet Telephony (SPIT) Markus Hansen Independent Centre for Privacy Protection Schleswig-Holstein International Symposium Privacy and Security in Internet Telephony / VoIP Berlin IFA

2 Countering SPIT: Motivation Internet Telephony has developed, allows costsaving use of VoIP technology. VoIP will affect audio communication as affected written communication. Unsolicited calls are already annoying PSTN customers. => SPAM over Internet Telephony (SPIT) will become a problem similar to SPAM.

3 Countering SPIT: Motivation SPIT is expected to increase dramatically with cheaper calls. => Privacy protection needed. Laws prohibiting such calls are most often effectless against calls from other countries. => Technical approach needed. Telecommunication is regulated by several laws. Sanctions are up to five years in prison. => Legal compliance needed.

4 Legal Aspects of Filtering SPAM & SPIT Secrecy of Telecommunication (European level): Art. 8 ECHR: Respect for private life and correspondence Secrecy of Telecommunication and SPAM: c.f. Art 29 Data Protection Working Party Opinion 2/2006 on privacy issues related to the provision of screening services (WP118).

5 Art. 29 Group: WP 118 European regulations concerning SPAM filtering derive from the interpretation of Dir. 95/46/EC and Dir. 2002/58/EC in compliance with the ECHR and the corresponding case law of the Court of Human Rights. Other Directives (as e.g., e-privacy) can be relevant as well. Equivalent application to telephone calls as far as no differences derive from the syncronism of the medium.

6 Art. 29 Group: WP 118 Art. 4, 5 Dir. 2002/58/EC: Confidentiality of electronic communication has to be secured (e.g., by technical-organisational means). Personal data processing in the course of filtering viruses can be justified for the purpose of safeguarding the security of applications and services. Personal data processing in the course of filtering spam can be justified for the purpose of safeguarding the security of applications and services under certain requirements.

7 Art. 29 Group: WP 118 Personal data processing in the course of detecting any predetermined content CANNOT be justified for the purpose of safeguarding the security of applications and services. In all cases transparency and adequate user information has to be secured.

8 SPIT-AL: Legal Aspects Secrecy of Telecommunication, e.g. in Germany: Art. 10 GG, 88 TKG, 206 StGB Protecting content of communication and fact that it has taken place (or been unsuccessful). Binding any person involved in providing telecommunication services Control over any SPIT filter therefore has to be in hands of user as one of the communication partners.

9 SPIT-AL: Legal Aspects Telecommunication law (TKG) 88 Secrecy of Telecommunication 148 f. Suppression of Communication (Reject call, Greylisting) VoIP has not yet gone through courts.

10 SPIT-AL: Legal Aspects Privacy Law (aka: Data Protection Law) TKG Different SPIT-AL actions and configuration presets for private citizens, companies oder administrations. (Administrative Law: Right to be heard) Whitelists / Blacklists is processing of personal data => Infrastructure für consent / withdrawel => web interface => Teleservices Law

11 SPIT-AL: Legal Aspects Consequences for Development: Completely user-controlled filtering! Transparency and control of data processing and its consequences. Configuration presets for different types of users. Configuration options fine-grained.

12 The SPIT-AL Project SPIT-AbwehrLösung Public Funding : e-region Plus (Schleswig-Holstein) ERDF European Regional Development Fund Project Partners: TNG The Net Generation AG Internet Service Provider and Telecommunication Company ICPP Independent Centre for Privacy Protection Privacy Protection Authority of Schleswig-Holstein

13 The SPIT-AL Project White Paper download at Prototype Implementation in progress <= Test Run with 1000 users by end of 2006 Open Source Project Public funding, public benefit! Diploma Thesis at Dresden University of Technology

14 SPITting into your Ear Calls from Humans: Call Centres Calls from Automated Devices: Spam Bots Ringtone SPIT: Alert-Info Header Combinations

15 SPIT-AL: Technical Approach SPAM: Header & Content Analysis Content Analysis of Audio Communication: Synchronous Communication, impossible to do before call is established. Technically complex, binding resources. (C.f.: Microsoft V-Priorities. Patents?) Unneccessary once caller and callee talk. Not planned within SPIT-AL.

16 SPIT-AL: Technical Approach Analyze Information about Caller: Caller ID? (Lacking Authenticity with SIP) Origin: PSTN / SIP (Proxy, IP Range)? On Whitelists / Buddylists / Blacklists? Recursive Lists / Web of Trust Statistiscal Analysis (backbone) Analyze Information about Call: E.g.: 6 a.m.? Sorry, Mum. Weighten results, sum up.

17 SPIT-AL: Technical Approach Different Actions according to results: Establish call. (implementation: easy) Busy on first try. (greylisting) Challenge the caller: Please press *42#. (simple voice menu) What is 10 devided by 2? (tricky :-)) Voice Box => asynchronous Announce alternate reachability

18 SPIT-AL: Technical Approach Different Actions according to results: Simulate Callee (c.f. Telecrapper2000) binding your resources! Honeyphones (as in Honeypots, Honeynets) collect and analyse information on SPIT Reject call Implementation: Easy Legal: Suppression of Communication All not in SPIT-AL 'Filtering' not appropriate. Therefore: Reachability Management to counter SPIT

19 INCOMING CALL INCOMING CALL 1 VOICE DATA

20 Conclusions The SPIT problem will increase, countermeasures are needed. Countermeasures have to take effect before caller and callee talk to each other. Reachability management is a possible approach. Can be expanded/integrated into identity management system.

21 Future VoIP needs Security and Privacy Enhancements! E.g. strong end-to-end encryption E.g. end-to-end authentication VoIP could use a lot of other development, too. Thanks for listening! :-) Project: Contact: [email protected]