4 ms·

One legitimate use is a small business with multiple lines that wants to present one unified phone number to the public.

by c22 9y ago

phkahler 9y ago
No, that's no reason to be able to spoof callerID. That's a reason to have it show the main office number. The callee should have some idea how to get back to the caller, there is never a reason for this to be subverted.
- c22 9y ago
  The only way I know to have it "show the main office number" is by spoofing the outbound caller id, whether this is done on the customer's equipment or by the provider. Do you have a deeper insight into the phone network, am I missing something?
  - phkahler 9y ago
    The phone company is accepting calls from the PBX or whatever at the company. They most certainly could enforce that the caller ID match the main number for the office the call originates from. It's been over 20 years since I worked for a phone company, but all calls from any line were associated with a BTN (billing telephone number). There is no technical reason the caller ID could not be forced to the BTN or something similar. In that case you could always call the phone company and find out where the call originated - or at least where they send the bill for it. I guess that's the point, the phone company can identify the origin of a call for billing purposes and I think the callee should also be provided the identifying information - certainly not lied to about it.
    - c22 9y ago
      Of course the originating network (presumably) knows the billing number, but how do you propose to enforce correct reporting across hundreds of telephone companies in hundreds of countries? Most caller ID spoofing today happens over poorly secured or fly by night VoIP networks. If the telco can send ANI of a "main office number" instead of the number of the actual originating line then so can a hacker or any entity with access to ss7. Theoretically you could block calls from numbers not served by the originating network the way many isps ignore advertised routes for ip ranges not served by a particular AS, but LNP complicates this further.

One legitimate use is a small business with multiple lines that wants to present one unified phone number to the public.

by c22 9y ago

One legitimate use is a small business with multiple lines that wants to present one unified phone number to the public.

phkahler 9y ago

No, that's no reason to be able to spoof callerID. That's a reason to have it show the main office number. The callee should have some idea how to get back to the caller, there is never a reason for this to be subverted.

c22 9y ago
The only way I know to have it "show the main office number" is by spoofing the outbound caller id, whether this is done on the customer's equipment or by the provider. Do you have a deeper insight into the phone network, am I missing something?
- phkahler 9y ago
  The phone company is accepting calls from the PBX or whatever at the company. They most certainly could enforce that the caller ID match the main number for the office the call originates from. It's been over 20 years since I worked for a phone company, but all calls from any line were associated with a BTN (billing telephone number). There is no technical reason the caller ID could not be forced to the BTN or something similar. In that case you could always call the phone company and find out where the call originated - or at least where they send the bill for it. I guess that's the point, the phone company can identify the origin of a call for billing purposes and I think the callee should also be provided the identifying information - certainly not lied to about it.
  - c22 9y ago
    Of course the originating network (presumably) knows the billing number, but how do you propose to enforce correct reporting across hundreds of telephone companies in hundreds of countries? Most caller ID spoofing today happens over poorly secured or fly by night VoIP networks. If the telco can send ANI of a "main office number" instead of the number of the actual originating line then so can a hacker or any entity with access to ss7. Theoretically you could block calls from numbers not served by the originating network the way many isps ignore advertised routes for ip ranges not served by a particular AS, but LNP complicates this further.