(or, well, one of their delivery services.)
🔊 Just a fair warning - there are some perhaps annoying glitch sounds in the attached recording. The volumes are normalized to limit loud spikes, as they were a lot worse in person. 😅
See also, the sequel: I broke Google TTS.
so, my phone service has a rather clever anti-spam tactic, which works like this:
- I receive a phone call from an unknown number, and it goes through screening when I answer it. It rings until the fifth ring, the voicemail greeting plays out, then I've got 30 seconds to judge if it's a spam robocall or if it's genuine
- If it's okay, I press 1, and it interrupts the ring/voicemail sequence and I answer the call like usual.
- If it's spam, I press ### (the # key by itself normally opens my PBX menu, so it doesn't go through) and hang up immediately.
Pressing ### and hanging up, will shove the call to voicemail, then launch a "DTMF bomb", which is a rapid sequence of over a hundred tones of DTMF keysmash, even including some of the "ABCD" keys. This has blown up spammers' cheapass PBXes, especially ones with poor security and too much trust given to the DTMF decoder on the call server.
So, when IKEA called from a random 1-877 number to confirm my furniture shipment worth $1200 (that's the equivalent of
blåhaj!), the only thing it said is "To continue in English, please press 1."... and I had no idea who it was, immediately thought it was spam, and did the ### gesture. Oops.
What follows is a transcript of the call in the recording above.
here's the DTMF bomb decoded:
***00###00***00###DD3001784002B322767B6327677ABA88000CCCDC4002375543716604322108322407332846410873320925710855AAAAA888888888888888888888888888888888888888
here's what is likely happening:
- the PBX allocates a 128-byte buffer for parsing DTMF tones, which should be fine, since it is only expecting one
- the DTMF bomb sends 154 tones, which overflows the buffer, filling an extra 28 bytes with
88888888888888888888888888 - the pickup info, which is positioned after this buffer in memory, is (partially?) overwritten with 8s. this causes... problems, which leads to the glitches and the 8888888... phone number


💀
for the hard work \o