sirocyl

sirocyl

@sirocyl

noted computer gremlinizer

  • they/any

working on a @styx-os.

 

laptop.
                                                                                                     

"accidentally-vengeful telco nerd"
—Tom Scott

platform sec researcher, OS dev, systems architect, composer; Other (please specify). vintage computer/electronics nut.

I am open to tag suggestions - if there is something you want me to tag on my posts, leave a comment. <3

log inask
take a look at
this cool bug I found 🪲
sirocyl
@sirocyl

I broke IKEA.

from some PBX in a LACK rack, I'd assume. - Voicemail recording of the delivery service call (Transcript in post)
Voicemail recording of the delivery service call (Transcript in post)
from some PBX in a LACK rack, I'd assume.
00:00

(or, well, one of their delivery services.)

🔊 Just a fair warning - there are some perhaps annoying glitch sounds in the attached recording. The volumes are normalized to limit loud spikes, as they were a lot worse in person. 😅

See also, the sequel: I broke Google TTS.

so, my phone service has a rather clever anti-spam tactic, which works like this:

  • I receive a phone call from an unknown number, and it goes through screening when I answer it. It rings until the fifth ring, the voicemail greeting plays out, then I've got 30 seconds to judge if it's a spam robocall or if it's genuine
  • If it's okay, I press 1, and it interrupts the ring/voicemail sequence and I answer the call like usual.
  • If it's spam, I press ### (the # key by itself normally opens my PBX menu, so it doesn't go through) and hang up immediately.

Pressing ### and hanging up, will shove the call to voicemail, then launch a "DTMF bomb", which is a rapid sequence of over a hundred tones of DTMF keysmash, even including some of the "ABCD" keys. This has blown up spammers' cheapass PBXes, especially ones with poor security and too much trust given to the DTMF decoder on the call server.

So, when IKEA called from a random 1-877 number to confirm my furniture shipment worth $1200 (that's the equivalent of :sixty: blåhaj!), the only thing it said is "To continue in English, please press 1."... and I had no idea who it was, immediately thought it was spam, and did the ### gesture. Oops.

What follows is a transcript of the call in the recording above.

"To continue in English, please press 1️⃣."
[extremely rapid DTMF spam string]
"Your delivery is scheduled for Tuesday. Five. [A burst of digital static plays out here for about a quarter of a second.] $DeliveryDate between the hours of 2pm and 6pm.
If an adult will not be available within the timeframe provided, or you have any other conflicts, please contact us at
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
Message repeat. ⚠️. Your delivery is scheduled for-" [total system breakdown occurs here... followed by dead line noise.] ............. [blerp] ............. [blerp] ............. [blerp] ............. [blerp]

... I should've just bought :sixty: blåhaj, instead.

(Names, businesses, times, dates and phone numbers may be changed or redacted in order to protect the privacy of those involved.)

You must log in to comment.

in reply to @sirocyl's post:

sirocyl
@sirocyl

I shared it with a few people who Know Telephone before I posted it here, and their theory is that what we're hearing at the end is the audio path going open-circuit when the PC crashed.
It probably blue-screened, and we're hearing the EM interference from the CPU or I/O controller hub as Windows writes a minidump, then begins waiting for a debugger to attach (the blerps at the end being scans for connected serial port, PCI, network or 1394 debug hardware)

login to reply
mog
@mog

wait, so, since this is likely a buffer overflow, it's running on Windows XP, and the regular audio output is used for telephony (as suggested by the audible XP error sound)... specially crafted DTMF could gain code execution and rickroll everyone called by the system

login to reply
franktcatte
@franktcatte

from personal experience, what was on the other end was likely a Nortel Call Pilot, which runs on Windows Server 2003 Embedded iirc. I think that's even the default voice. I'd say I'm surprised one of those was still in service in 2020 but given my aforementioned personal experience, I'm really not.

login to reply
sirocyl
@sirocyl

just checked for myself; one of those results appears to be "congratulations! you're on a list", the website.

to be clear to the person or persons at whichever three-letter agency is tasked with the unenviable job of reading this, the post above has absolutely nothing to do with explosives or devices thereof, or firearms

login to reply
tit
@tit

really want to try this on my buildings intercom now. even though I already know the codes that I shouldn't know, I wonder if capturing the "all good, open the gates" signal is possible or if it's just a full digital box (boring!)

login to reply
chamomile
@chamomile

Not sure if that's what's happening here but a lot of these automated systems will talk right over your voicemail/call screening prompt so the actual voicemail recording only catches the end of their spiel. It's very annoying.

login to reply
sirocyl
@sirocyl

I don't have a prompt. If it was talking, it was talking while the phone was still ringing out. The whole mess would've been recorded as soon as the call is answered by the screening script.
That plus the fact that it lands directly on "To continue in English", rather than in the middle of a phrase, makes me think that is its first phrase, there's no "Hello, this is an automated message, concerning your IKEA delivery." or similar.
No "Hello, my name is Inigo Montoya, you killed my father" - straight to "Prepare to die."

login to reply
Panazel
@Panazel

Okay but this "DTMF bomb" or whatever and how it really screws up that voice recording call...Holy geez is that some surreal audio right there.

You could probably put it into some trippy indie game like OFF or Omori or Hypnospace or something else with surrealist/dream elements and it wouldn't totally be outta place. Whew~

login to reply
greytdepression
@greytdepression

i've just looked up dtmf because of this chost and,,,, is that how telephones work?? like,, when you pick up your phone it's just a line to your service provider or whatever and then your phone plays the little song and your service provider is like "ah, they want to call that person" 😶

login to reply
-pegasus
@-pegasus

for a traditional telephone system where it's a copper wire from your house to the cabinet, carrying audio and 48v power, yes

each key makes a separate tone so it always knows which one you press

rotary phones used a different method where they would rapidly disconnect and reconnect to cause pulses, the number of which matched the number on the dial you had span.

the hook that you put the phone down on also worked by disconnecting the phone, so if you had really good rhythm you could dial numbers by tapping it out on that

login to reply
Pinned Tags