The purpose of this CXTech Week 35 2022 newsletter is to highlight, with commentary, some of the news stories in CXTech this week. What is CXTech? The C stands for Connectivity, Communications, Collaboration, Conversation, Customer; X for Experience because that’s what matters; and Tech because the focus is enablers.
You can sign up here to receive the CXTech News and Analysis by email. Please forward this on if you think someone should join the list. And please let me know any CXTech news I should include.
Covered this week:
- An open letter to mobile operators about the need for SMS cybersecurity #2
- RTCSec August Newsletter from Sandro of Enable Security
- Maxis and U Mobile say no to DNB stake offer.
- TADHack Memories: Couples
- New TADSummit Session: Supercharging CPaaS Growth & Margins with Identity and Authentication
- Amount streamlines onboarding and verification using Telesign
- FCC Proposes $116M Fine Against Traffic Pumping Robocall Scheme
- People, Gossip, and Frivolous Stuff
An open letter to mobile operators about the need for SMS cybersecurity #2
A to the point letter from Paul Walsh to telcos to get their act together on SMS Security. We’ve been tracking Paul’s work here for several years including CXTech Week 46 2021 and the recent tests Paul ran in CXTech Week 19 2022.
TLDR; please integrate a cybersecurity solution that’s built for SMS. Everything you have tried so far, has failed to protect your customers. It’s time to try a new approach.
Also check out Paul’s phishing predictions from 2021, most came true in 2022
RTCSec August Newsletter from Sandro of Enable Security
A must read for anyone in the RTC business. This month’s edition includes:
- Our news about the Enable Security Attack Platform and Gasoline v2
- Buffer overflow in Realtek’s SIP ALG affecting many many routers (CVE-2022-27255)
- More router exploitation leading to SIP credentials leakage (Arris / CVE-2022-31793)
- TLS ALPN identifier for SIP
- SELinux policies and Kamailio/OpenSIPS
I track the latest developments around RTC Security, but every month Sandro highlight important news I missed, such as:
- Arris Routers are used by various ISPs as their customer premises equipment solution. The vendor patched a number of vulnerabilities, one of which was a path traversal issue in the web interface tracked as CVE-2022-31793.
- Since these routers often have phone calling/VoIP functionality, the path traversal vulnerability gives easy access to the SIP configuration files on the router. This includes SIP credentials – which means, stolen SIP accounts for toll fraud.
- Discord and Element desktop clients run on top of Electron, and both have had vulnerability details published in the past month. The research was presented at Defcon by Max Garrett formerly of Cure53 and Aaditya Purani.
Maxis and U Mobile say no to DNB stake offer.
Back in 2021 I highlighted some of the Interesting developments in Malaysia with the article, Keep an Eye on Malaysia.
The Malaysian government announced plans to own the fifth generation (5G) spectrum and build the country’s only 5G network instead of leaving it to the telecommunications operators.
Think of it as a Mobile NBN, National Broadband Network. Other countries have raised this idea on 5G as well, but the Malaysian government seems to have ‘bitten the bullet’.
In the latest twist Maxis and U Mobile say no to DNB stake offer. They’ll keep on negotiating, and their reason is being a minority stakeholder has little benefit. But its a shared resource. Negotiations continue, this seems to be a fundamental sticking point.
TADHack Memories: Couples
2014: We have Arjun Kamath and Ella Kaila-Kamath with Super Streamer that uses WebRTC to broadcast video, and won the Nexmo (now Vonage) prize. https://lnkd.in/gv-4i8zA
2015: Seleen & Lee with Rent Reminder https://lnkd.in/dZA5sca6
And from 2017 a couple with a prodigious list of hacks at TADHack Lily Madar and Steven Goodwin. Here I highlight: A node library for Apifonica; and Rome – “Reach me anywhere” – A way of contacting someone, in a variety of ways, depending on the time of day. https://lnkd.in/dHJdQjef
We’ve had many other couples hack together over the years. I think if you can hack together, then you’ll find living together easy!
Thank you to Radisys Corporation, STROLID, Inc – Strong Process. Solid Results., and jambonz for making #TADHack Global 2022 possible.
New TADSummit Session: Supercharging CPaaS Growth & Margins with Identity and Authentication
Thank you to Aditya Khurjekar, GM Prove Protocol for contributing this excellent presentation.
- Mobile networks were designed for communication, yet commerce is driving most of the demand for mobile connectivity today
- The growth segments in today’s digital economy benefit from CPaaS APIs for Identity verification, authentication, proofs & claims
- Commerce-enabling CPaaS APIs rely on the intrinsic security of mobile network and devices
- Deterministic (rather than probabilistic) authentication drastically reduces fraud, hence increases margins
- The secure element in mobile devices has been under-utilized by carriers
- FIDO standard presents a horizontal application opportunity for hardware based (deterministic) authentication
- Authenticated ID verification is key to secure yet seamless digital onboarding, leading to financial inclusion & consumer protection
- The needs of the new crypto-based (web3) economy can also be satisfied with smart CPaaS offerings that preserve anonymity/pseudonymity
- The imminent ubiquity of eSIMs is timely to fight fraud in the increasingly sophisticated digital & crypto-enabled economy
- It’s time for a purpose-built global payments network.=
Amount streamlines onboarding and verification using Telesign
As the banking industry shifts away from a predominately branch-centric model, customers’ ability to transact with their bank online is crucial. I’ve not deposited checks at my local branch for several years. But online banking transactions are a risk for fraud.
Banks are challenged with finding the right tools to combat fraud and mitigate risk. While keeping the online banking experience easy. Amount, a financial technology provider, provides additional security layers into its tech stack to mitigate risk without adding friction by providing an initial identity check based on consumers’ mobile number using Telesign.
FCC Proposes $116M Fine Against Traffic Pumping Robocall Scheme
The FCC proposed a $116M against Thomas Dorsher and several of his companies including ChariTel Inc., over allegations that they made almost 10 million robocalls, illegal under the Telephone Consumer Protection Act. The pre-recorded calls, part of a “traffic pumping scheme,” reportedly targeted businesses, and ironically, warned them of the dangers of illegal robocalls.
In CXTech Week 12 2021 we covered the FCC fining Texas-based telemarketers John Spiller and Jakob Mears $225 million after finding that their companies placed roughly 1 billion spam robocalls over a period of less than five months in early 2019.
Back in 2019 the FCC “fined” robocallers $208 million since 2015 but collected only $6,790. It’s unclear how much, if any, John Spiller and Jakob Mears have paid of the $225 million. Actions not words matter, the FCC needs to enforce its words, and include extensive jail time, not just big numbers that are never collected.
People, Gossip, and Frivolous Stuff
Jim Rice is now VP of NA at Vantiq. I’ve known Jim since his time at Layer7, API management, that was sold to CA, which was sold to Broadcom.
Ronald Green is now a Senior Sales Manager at Tata Communications. We met while he was at SubSpace.
Adam Parken is back from Europe and is now Marketing Communications at Kimley-Horn, a planning and design consulting firm. We first met over a decade ago when he was with Tekelec.
Christophe Coutelle is now Marketing Director at EXFO; test, monitoring and analytics for the telecoms industry. I’ve known Chris since his time at Orange, and through his time at Huawei, during its heydays, where he lived in Shenzhen with his family.
Lorraine Fahy is now CMO at Prommt. I’ve known Lorraine since her time at Openmind Networks, where I gave a keynote at the customer event, which included the Litany of Excuses, see below for explanation.
Thomas St Onge is now Head of Business Development at Earnix. We first met during his time at Mashery.
Mateusz Michniowski is now Senior Client Manager at NTT. I’ve known Mateusz since his time at SmartTel Plus.
Branko Milovanovic is now Solutions Engineer at Telesign.
Raimund Sperling is now Head of Product Operations at Bauer Xcel Media Deutschland KG
Thank you to Danielle Royston for getting a kick out of my 2010 Litany of Excuses Stifling Communication Innovation.
You can sign up here to receive the CXTech News and Analysis by email.