I’ve said before that I’m a big (not a fat reference) fan of Michael Graves’ blog. Continuing his promotion of the wicked cool and useful†, Mr. Graves recently wrote about Schmooze Communications’ PBXact system.

It’s a GREAT read and I leave you with this: Magic Button. (read the article)

Related links:

• e4 Technologies
• Michael Graves on SOHO VoIP

†Yes… Wicked cool and useful. If it doesn’t meet the criteria for both, it doesn’t make his blog.

Last year, the Senate passed the Truth in Caller ID Act of 2009 (S. 30 passed unanimously) and this year, the House moved forward on their own version. Of course, moving at the speed of government, the House passed the Truth in Caller ID Act of 2010.

Truth in Caller ID Act of 2009 – Amends the Communications Act of 1934 to make it unlawful for any person in the United States, in connection with any telecommunication service or VOIP (voice over Internet protocol) service, to cause any caller identification service to transmit misleading or inaccurate caller identification information (“spoofing”) with the intent to defraud or cause harm. Prohibits construing these provisions to prevent blocking caller identification or to authorize or prohibit law enforcement or U.S. intelligence agency activities.

Interestingly, the bill provides the FCC authority to “to collect fees from the telecommunications industry sufficient to offset the cost of its regulatory program” — a cost which is estimated at $1 million dollars per year. The only exception to the proposed law appears to be for Law Enforcement purposes, however even the CBO points out that domestic violence shelters (attempting to protect the identity of spouses) may be affected by the new regulation.

Of course, as Schoolhouse Rock taught us, the next step is for the House and Senate to resolve any differences. After that, it’s up to the President to decide if this bill becomes law. After all,  it’s a long, long journey to the capital city. Today, it’s just a bill.

Additional Reading / Links of Interest

• Schoolhouse Rock: I’m Just a Bill (Schoolhouse Rock)
• S. 30:Truth in Caller ID Act of 2009 (govtrack.us)
• HR 1258, Truth in Caller ID Act of 2010 (Congressional Budget Office)
• HR 1258, Truth in Caller ID Act (Library of Congress)
• Grammar Girl: Affect Versus Effect (Grammar Girl)

Comcast Outage?

We’ve been hearing complaints of Comcast service issues in both Nashville and Atlanta. Although the company’s network status page shows everything to be ok, reports from users indicate a severe problem affecting home, business, and voice service.

Frank Eliason posted through his @ComcastCares twitter feed the following message at 10:30am EST:

We are aware of internet and phone trouble in and around Nashville. Engineers are on it. more info soon

At this time there is no information from Comcast regarding the nature of the problem, the impacted services, or the expected resolution. As of 12:30pm the Comcast Network Health page still states “No Known Issues.” On the other hand, Comcast users report otherwise:

Search of #comcast on Twitter at 12:15pm

And…

Search of comcast outage on twitter at 12:15pm

Requests to Comcast for information have not been returned.

Additional Reading:

• Affect vs. Effect
• Comcast Network Health

This year marks the second decennial census since widespread use of the internet began in the 1990′s. The bulk of census activity takes place during the time when people are traditionally preparing taxes and vying for an infusion of cash  from their tax return.  The evil peoples of the interwebs will be out in force to take advantage of  the under-informed.

Keep these simple rules in mind:

• No one from the IRS or the Census bureau will ever email you about your taxes or the Census. Ever.
• No one from the IRS or the Census bureau will call you and ask for your address, social security number, and bank account information. Ever.
• No one from the IRS or the Census bureau will ask for money, a donation, passwords, or pin numbers over the phone or via email. Ever.

If you get a phone call from the IRS and do not feel comfortable with the questions they ask to identify you, the real IRS is always willing to accept a callback. Their phone number is 1-800-829-1040 (800-TAX-1040). Doing this callback will (almost) always ensure you are talking to the IRS.

This is a good rule of thumb for any unsolicited phone call. If the questioning or “verification process” makes you feel uncomfortable or involves revealing sensitive information such as a mother’s maiden name, social security number, driver’s license number, bank information, or credit information, get a callback name and number. Anyone can spoof an outgoing phone number, so caller id is no protection here. In the case of official agencies, it’s fairly easy to verify the listed phone number before making the callback, and legitimate businesses will never try to goad you into giving information.

If you are struggling with confrontation, all legitimate businesses will also be willing to conduct business via mail. Specifically in cases of debt collection or IRS matters, request the correspondence be provided via US mail instead of the telephone. Legitimate agencies will comply with this request, anyone who doesn’t you can safely hang up on.

Further Reading:
Census on Scams
IRS on Scams

When my little girl went from being a benign, unmoving lump of sleeping, drooling baby to a terroristic unplugging, biting, chewing, eating, swallowing, gagging, breaking, pulling, tugging beast of a toddler, my home decor changed. When we moved into our excessive 4 bed / 2.5 bath home in 2007, we had dreams. We had a guest room, and a Disney room, and my home office taking up about 25% of the under A/C space. When the beast began terrorizing our home, we retreated into a fallback position and isolated her to the safest room in the house, my former office. I was relegated to the Disney room. It’s purple. Very purple.

When moving between old office and new, as is my tradition in packing, I crammed everything into boxes with the knowledge that should I come to need an item, I would go searching through the boxes piled in the “supply closet” of my new “office”. In almost two years, I have not touched these boxes. Today was a day of reckoning when I was reminded of an important rule: Don’t use old Cat 5 and other copper cables.

There are people who will disagree with me, and I accept their disagreement with the knowledge they are wrong. Cat 5 (ie. network cable)  and copper coax cable (ie. cable tv cable) costs between $0.25 and $1 per foot. On a new VoIP phone, you need anywhere from 3 to 25 ft. of Cat 5 depending on the location of your phone / adapter in relation to your router and with the assumption that you are not using a wireless solution.

Many homes, like mine, have an accumulation of old cables, and when you get a new ATA (analog telephone adapter, aka. that veyeop thingy) that inexplicably comes without one, you go to the pile, untangle the least confined cable, and hook it up. Time and time again I have gone through ten and twenty minute troubleshooting sessions with people (and, in true ‘Dr. heal thyself’ fashion, spent hours myself) only to find that a strange or intermittent problem with connectivity, registration, or voice quality was remedied by putting on a fresh Cat 5 cable.

In fifteen years of working with networking setups, one in ten intermittent or quality issues end up being plain old bad cables (remember from previous posts, 50% are unplug or partially unplugged cables). Just in my five years of VoIP experience, I can’t count the number of times voice quality issues have been wiped out completely by getting fresh cables with good connectors. Considering the cost is < $15 for almost any project, save yourself the time and hassle. Throw away the old Cat 5 and coax cables, buy fresh ones for the new install, and you are eliminating a huge point of failure for years to come.

Dan York wrote a fantastic post today over at Disruptive Technology…

Humorous video – in how many movies is the “No Signal” theme over-used?

Its Friday, so here’s a bit of humor… I admit that I had not really paid attention to how incredibly over-used the “my cellphone has no signal” theme has been in recent movies until I saw this video. Keep watching, though, because after the “no signal” theme, it does go into other amusingly over-used themes like dropping mobile phones in water, ripping them apart, burning them, etc…

Kudos to someone named Rich Juzwiak for apparently editing together pieces of 66 movies!

Posted from: http://www.disruptivetelephony.com/2009/09/humorous-video—in-how-many-movies-is-the-no-signal-theme-over-used.html

Note: You can play or download the MP3 audio of the “Telemarketer Torture” calls towards the end of the article.

When I first started working with VoIP, I began to hate telephony, and any and all things telephone related. This bothered me on many levels. You see, as a kid, I loved telephones. Growing up in the “big city,” pay phones seemed to be on every corner. Family stories talk about walking several blocks extra, just to avoid me seeing and wanting to play with a phone. But, as usual, I digress…

When I worked with an unnamed switch (let’s just say it rhymed with Broadmoft), I hated working with VoIP. I knew there had to be a better way and started playing with Asterisk. Soon, my memories of playing with phones started coming back and my love rekindled. Now, I look forward to working with phone systems, only because I truly feel that the use of a phone can only be limited by your imagination. And with companies like Twilio, Adhearsion, and Digium, the community of telephone developers seems only to grow.

With that long winded introduction, let’s discuss today’s topic — telemarketer torture. I, like every other person I know, receives the random yet continual undesired telemarketer call (yes, I’m on the DND databases and let’s not get into that). Thanks to Asterisk, I can send my telemarketers to a little place I call the Annoyatron.

Now, many developers and users implement their own version of Telemarketer Torture. Some like using IVR’s. Some like endless ringing. Personally, I like to keep them on the line for a long time. You see, since I add numbers to the Annoyatron after they call me, by the time they reach the Annoyatron they have already called and wasted my time at least once before. So, instead of just having them hang up and move on to the next home, I like to see if I can keep them talking for a while. My Goal? At least 2 minutes.

I use Asterisk’s “WaitForSilence” command to keep my torture conversational. When there’s a pause, the Annoyatron will play a file. While the telemarketer speaks, the Annoyatron will patiently wait. You put it all together, and wala — the Annoyatron Telemarketer Torture.

Today, I received unwanted calls regarding long distance to India. I added the number to the Annoyatron and well, the results of their continued calls no longer annoy me. Here are two examples:

Listen to Call 1:
Download audio file (annoyatron.mp3)
(or you can download the MP3)

Listen to Call 2:
Download audio file (annoyatron2.mp3)
(or you can download this MP3, too)

Ok, so here’s an example of how you would write the dialplan in Asterisk:

[annoyatron]
exten => s,1,Answer()
exten => s,n,Wait(2)
exten => s,n,Playback(annoy/annoy-hello)
exten => s,n,WaitForSilence(2200)
;...
; record a file for "your side" of the conversation
; wait for silence, and then play it
; lather rinse repeat
;...
exten => s,n,Hangup()

Simple, no? Just one of the reasons Asterisk allowed me to enjoy working with telephones. Awwww.

We’d love to hear about your fun examples with Asterisk. And you know, Leif Madsen is requesting some ideas for Asterisk Recipes himself.

Asterisk is free, open source software provided under the GNU General Public License (GPL). Asterisk is the most popular open source software available, with the Asterisk Community being the top influencer in VoIP.

Why free? It’s just how Digium rolls. They really take that GPL open source to heart.

Residential VoIP - No Operators

Some say the media sensationalizes our economic woes for their personal gain. Others say the media accurately portrays the extreme financial burdens we find ourselves facing. And some people say, “Hey. I don’t care about anything, I always have and always will try to save money.” With today’s world becoming increasingly digital, VoIP (digital telephone) seems like a naturally good idea.

Clearly, we at VoIP Tech Chat advocate VoIP. We love it. We love it so much, we made a website called VoIP Tech Chat. And we actually now and then have chats and write articles on VoIP (ok, that last part was a little sarcastically since both Patrick and Fred seem to have been too busy to actually talk or write lately… but anyway…).

Residential Telephone Service and VoIP

If you can read this, you probably live somewhere. Or you’re a robot… which would be AWESOME since we are desperately trying to increase our robotic readership, but seriously, most people in our “audience” live somewhere and have residential phone service. Well, we should say most people used to have residential phone service.

Ten years ago, Mobile Phones were a novelty. Today, they are viewed as a necessity. In the United States, more people have wireless phone service than have traditional landline (POTS) telephone service. And, even with higher drop rates, lower voice quality, and service availability issues, 1/3rd of the current US population live in “wireless only” households (interestingly a very small percentage live in a landline only household, with the group represented mostly by persons “well over” retirement age).

There are some disadvantages to the Wireless Only approach, including emergency calling (aka 911), coverage, name listing in directories, and cost. If you are a “heavy” talker, your wireless phone bill can be very costly depending on your usage. The advantages include calling features (such as caller id and voicemail), having your phone with you at all times, and (interestingly enough) the ability to make emergency calls away from the house.

But wait… isn’t this VoIP Tech Chat? Yes Virgina… let’s continue. VoIP generally provides advanced (and included) calling features, “unlimited” local/long distance calling, inexpensive international rates, and all at a price less than your traditional POTS landline service. The negatives with VoIP? VoIP 911 service does not compare to landline usage. Although most VoIP providers implement an e911 service, the reliability of VoIP for emergency calls does not compare to a landline. A landline simply provides better 911 service, period. (we actually wrote a pretty decent article about VoIP and 911 back in the day… )

Landline POTS telephone service remains the most reliable telephone service available. The consistently maintain five-nine (99.999%) availability and provide the best access to emergency service (911). POTS service also comes with a limited feature set (by default) and hefty price tag.

Let’s compare VoIP, Traditional Telephone, and Wireless

Verizon Unlimited Local service starts at $24.95 per month. If you wanted Caller ID, Voicemail, and Call Waiting (with Caller ID) your bill jumps up to $51.90 — which is absolutely ridiculous, considering this price is the pre-tax rate.

Vonage offers an “unlimited” Local and Long Distance service for $24.95 monthly which includes more than 25 features (such as Caller ID, Call Waiting, and Voicemail). VoIP.com offers the same package for $19.95 (or more than $30 less a month than Verizon). Now, the “unlimited” voice on VoIP providers tends to be around 5,000 minutes a month or so. If you go over it, expect a notice.

Cellular Service ranges anywhere from $30 – $130 monthly per phone depending on the options you choose. By the time you reach the high end, you’re generally getting unlimited minutes and data (mobile web, email, etc.).

For a typical household, VoIP remains a very cost-effective telephone solution; although you must remember that without good (and we mean good), high-speed Internet, your VoIP will be unusable. Many local phone companies offer a “dial tone only” line for less than $15.00 monthly. With the use of VoIP and a dial-tone only landline, you can still save more than $150.00 yearly while providing your family a reliable method of calling during emergencies and power outages.

As Billy Joel would say, it comes down to reality, and that’s fine with me. If you need to tighten the belt, VoIP can help. However if you can get by without having high speed Internet and don’t mind using the mobile phone all the time, you may be fine with becoming a “wireless only” household. Or you may not care about money whatsoever and decide to have all three maxed out.

Either way, when you do realize the benefit of VoIP and embrace the force, we’re here to help.

Cory Andrews posted a great “tech tip” on the VoIP Insider blog detailing how to convert a Cisco SCCP phone to SIP.

Whether you’re a Cisco fan that finally realizes Asterisk can provide better PBX services (at a lower cost) or just someone who happens to have a bunch of Cisco Skinny VoIP telephones laying around, converting the firmware to SIP can make the Cisco phone compatible with many VoIP systems.

But, don’t take my word for it… go to the VoIP Insider and read Cory’s tech tip. Give it a shot and tell us what you think.

John Todd (with Digium) sent a great email on SIP Security. Although written towards the Asterisk audience, this email provides a very good guideline towards increasing your VoIP SIP Security. It’s a must read and reprinted here for your easy viewing.

In case any of you were wondering why there has been a fairly notable upswing in the attacks happening on SIP endpoints, the answer is “script kiddies.”  In the last few months, a number of new tools have made it easy for knuckle-draggers to attack and defraud SIP endpoints, Asterisk-based systems included.  There are easily-available tools that scan networks looking for SIP hosts, and then scan hosts looking for valid extensions, and then scan valid extensions looking for passwords.  You can take steps, NOW, to eliminate many of these problems.  I think the community is interested in coming up with an integrated Asterisk-based solution that is much wider in scope for dynamic protection (community-shared blacklists is the current thinking) but that doesn’t mean you should wait for some new tool to defend your systems.  You can IMMEDIATELY take fairly common-sense measures to protect your Asterisk server from the bulk of the scans and attacks that are on the increase. The methods and tools for protection already exists – just apply them, and you’ll be able to sleep more soundly at night.

Seven Easy Steps to Better SIP Security on Asterisk:

1) Don’t accept SIP authentication requests from all IP addresses. Use the “permit=” and “deny=” lines in sip.conf to only allow a reasonable subset of IP addresess to reach each listed extension/user in your sip.conf file.  Even if you accept inbound calls from “anywhere” (via [default]) don’t let those users reach authenticated elements!

2) Set “alwaysauthreject=yes” in your sip.conf file.  This option has been around for a while (since 1.2?) but the default is “no”, which allows extension information leakage.  Setting this to “yes” will reject bad authentication requests on valid usernames with the same rejection information as with invalid usernames, denying remote attackers the ability to detect existing extensions with brute-force guessing attacks.

3) Use STRONG passwords for SIP entities.  This is probably the most important step you can take.  Don’t just concatenate two words together and suffix it with “1″ – if you’ve seen how sophisticated the tools are that guess passwords, you’d understand that trivial obfuscation like that is a minor hinderance to a modern CPU.  Use symbols, numbers, and a mix of upper and lowercase letters at least 12 digits long.

4) Block your AMI manager ports.  Use “permit=” and “deny=” lines in manager.conf to reduce inbound connections to known hosts only.  Use strong passwords here, again at least 12 characters with a complex mix of symbols, numbers, and letters.

5) Allow only one or two calls at a time per SIP entity, where possible.  At the worst, limiting your exposure to toll fraud is a wise thing to do.  This also limits your exposure when legitimate password holders on your system lose control of their passphrase – writing it on the bottom of the SIP phone, for instance, which I’ve seen.

6) Make your SIP usernames different than your extensions.  While it is convenient to have extension “1234″ map to SIP entry “1234″ which is also SIP user “1234″, this is an easy target for attackers to guess SIP authentication names.  Use the MAC address of the device, or some sort of combination of a common phrase + extension MD5 hash (example: from a shell prompt, try “md5 -s ThePassword5000″)

7) Ensure your [default] context is secure.  Don’t allow unauthenticated callers to reach any contexts that allow toll calls. Permit only a limited number of active calls through your default context (use the “GROUP” function as a counter.)  Prohibit unauthenticated calls entirely (if you don’t want them) by setting “allowguest=no” in the [general] part of sip.conf.

These 7 basics will protect most people, but there are certainly other steps you can take that are more complex and reactive.  Here is a fail2ban recipe ( http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk ) which might allow you to ban endpoints based on volume of requests.

If you’d like to see an example of the tools that you’re up against, see this demo video (http://enablesecurity.com/products/enablesecurity-voippack-sipautohack-demo/) of an automated attack tool that does scan, guess, and crack methods via a click-and-drool interface.

In summary: basic security measures will protect you against the vast majority of SIP-based brute-force attacks.  Most of the SIP attackers are fools with tools – they are opportunists who see an easy way to defraud people who have not considered the costs of insecure methods. Asterisk has some methods to prevent the most obvious attacks from succeeding at the network level, but the most effective method of protection are the administrative issues of password robustness and username obscurity.

JT

Check out John Todd’s blog post at Digium.

About Digium

Digium, Inc., the Asterisk Company, created, owns and is the innovative force behind Asterisk, the most widely used open source telephony software. Since its founding in 1999, Digium has become the open source alternative to proprietary communication providers, with offerings that cost as much as 80 percent less. Digium offers Asterisk software free to the open source community and offers Asterisk Business Edition and Switchvox IP PBX Software to power a broad family of products for small, medium and large businesses. The company’s product line includes a wide range of hardware to enable resellers and customers to implement turnkey solutions or to design their own voice over IP (VoIP) systems. More information is available at www.digium.com.