6 ms·

I've suggested in the past that every instance of provable spoofing where they did not control the claimed number should result in a fixed fine. $100 sounds abo

by ikeboy 8y ago

I've suggested in the past that every instance of provable spoofing where they did not control the claimed number should result in a fixed fine. $100 sounds about right. Every phone network will then quickly begin passing on that cost to anyone they "peer" with and it will be a non-issue soon enough. Is there a compelling reason to allow such spoofs?

Rjevski 8y ago
There are legitimate reasons for spoofing to work given how fucked up the PSTN is. Mobile roaming is one for example - when you roam on another carrier and place a call, that carrier directly originates the call and “spoofs” your caller ID to make it look like the call originated from you. Some companies may use different carriers for either load balancing or least-cost routing and so both of these carriers are required to “spoof” the company’s caller ID. This can definitely be fixed with a CA system and “delegation” where the main carrier who owns the number can issue certificates for any other carrier you’d like to use to temporarily allow them to use a particular caller ID, and each call request should be signed with that certificate and the signature should be verified by call intermediate carriers down the chain, and the call dropped if the signature is missing or invalid.
- amluto 8y ago
  I think the correct approach is economic, not technical. Make a rule that, if you get a spoofed call, then your telco owes you $100, not subject to any arbitration clause or other contractual waiver. Give a way out to avoid actually killing the telcos: annual penalties are limited to a few percent of annual gross revenues. The telcos will find a technical solution real fast.
  - bdamm 8y ago
    How would you prove the call was spoofed? Record all calls? Prove it with statistics? No telco will pay. This is a technical problem.
    - Lionsion 8y ago
      >> I think the correct approach is economic, not technical. > This is a technical problem. IMHO, it's both. Economic sanctions need to be put in place to motivate the telcos to create and adopt robust technical solutions.
    - jimktrains2 8y ago
      You have a call received on your monthly bill from a number and the owner of that number does not have the call on their bill.
      - bdamm 8y ago
        How? Even in the same city, cellular and land lines aren't always serviced by the same company. In most places I'm pretty sure it's illegal for phone companies to be swapping call data. Or are you suggesting I call back all the numbers that call me to compare bills with the owner on the other end? This plan is not going to work out.
        amluto 8y ago
        The courts can deal with things like this.
    - raverbashing 8y ago
      If an incoming call is saying it's coming from 555-1234 and telco owns 555-1234 and it's not one of their authorized income points then the call should get dropped. Or if they don't own it then it's on who's inserting the call into the system. Telco systems are fun. And by fun I mean it's a complete mess. ISDN is hard and full of caveats (look at SIP for a taste of what it involves).
  - deleted 8y ago
    [deleted]
  - njarboe 8y ago
    Or just let telephone users set a price, for someone not in there contact list, to call them. Set it at 5 cents by default. Problem solved for the most part. People that don't know you can still call you (like the person who you left your curtains at for repair) but most robo call campaigns won't be worth it. If you really hate spam, set your price to $10.
wtallis 8y ago
> Is there a compelling reason to allow such spoofs? It makes telcos money. That's reason enough, since there are no economic downsides to the network operators that enable these crimes. If companies like AT&T and Verizon were also being subject to this $120M fine, we might see them decide to make caller ID trustworthy so that it could be used to block robocalls.
- nonbel 8y ago
  >"It makes telcos money." How?
  - dbatten 8y ago
    Telcos charge for connecting phone calls and routing voice packets. Even robocallers have to pay those fees.
    - flyinghamster 8y ago
      Not only that, but they also charge for Caller ID name lookups.
      - nonbel 8y ago
        This is interesting. So if I get a strange number and search 800notes.com or whatever the carrier is getting paid?
        flyinghamster 8y ago
        No, this occurs at the telco level. When a call is placed, only the number is sent. The receiving exchange must look up that number to get the name, and that lookup costs some fraction of a cent. This is why Caller ID with name costs extra money.
    - nonbel 8y ago
      So if I don't answer, who is paying for the call? I thought unanswered calls were free for some reason.
dqv 8y ago
>Is there a compelling reason to allow such spoofs? A few use cases to spoof the number: * Appointment reminder systems - if I see the caller ID is from my doctor's office, I'm going to pick it up and hear the reminder. When the calls come from some other number, people think it's spam. People still expect reminder calls even if you/HN crowd would prefer an email/text. * Outbound call centers on behalf of others companies (same reason as above) * People who work from home but want to make business calls from a personal phone If no one could spoof, it probably result in a huge uptick of people claiming spam calls since they would be getting tons of calls from numbers they didn't know. There really needs to be an SPF, DKIM, DMARC for VOIP. I don't think a no spoofing policy would go over well for businesses or consumers.
- ikeboy 8y ago
  In all of those scenarios, one could prove they controlled or had authorization for the spoofed number, hence it would not be eligible for my proposed fine. I'm not suggesting no spoofing, I'm suggesting a fine on the carrier for unauthorized spoofing, which will force them to actually verify that there is authorization.
  - dqv 8y ago
    >had authorization for the spoofed number You didn't make this clarification in your first post. In the first two examples, they don't control the claimed number, which is what I was responding to. >I'm suggesting a fine on the carrier for unauthorized spoofing, which will force them to actually verify that there is authorization. This makes sense. Legitimate companies will get authorization agreements signed etc.
- wtallis 8y ago
  The question wasn't about why spoofing exists at all. It was about spoofing where they did not control the claimed number. If you want to place a call with spoofed caller ID info, your provider should require you to prove that the spoofed information is legitimate, not fraudulent. Otherwise, the telco should be obligated to strip the suspect caller ID information from the call so that the recipient can properly identify the call as fishy. There's no need for any complicated cryptographic solution. Telcos should just be required to know their customer, much like banks, before allowing them to do certain things.
mikekchar 8y ago
I'm afraid I didn't read TFA, so apologies if I'm getting the wrong end of the stick. Also it's been 20 years since I worked in PSTN stuff. But at least at that time, the security in the protocol was ridiculously lax. IIRC, with PRI there was literally a bit that you set to say that the originating number was checked and was legitimate. Every other switch on the way through would accept it blindly. In most areas it was illegal to set that bit unless you were a telco. It was also illegal to sell equipment that set that bit unless you were selling it to a telco. But... it's not that hard to hack. Someone who's more current can probably give you better information. As to why nobody does anything about it... well.. why should they? They literally don't care. The equipment manufacturers aren't going to change the specs (because it's pretty darn hard to change specs and they are all trying to screw each other over in the specs anyway). The telcos aren't going to demand that the specs are changed because people are making telephone calls -- exactly what they want. It's only if the governments demand the change -- and it will take laws to do that (even then, I imagine that it's cheaper to lobby against the law than to change the equipment -- you have absolutely no idea how crappy those systems are).
lend000 8y ago
The reason I would agree with a fine is not because a caller's identity cannot be unmasked, but because phone numbers are so closely connected with identity that robocallers are essentially engaging in identity theft and slander when they use people's legitimate numbers to spoof their calls.
- mark-r 8y ago
  I had someone call me once, claiming I had just called them. I hadn't of course, so the only thing I could think of was that someone had used my phone number for spoofing.

by ikeboy 8y ago

Rjevski 8y ago

There are legitimate reasons for spoofing to work given how fucked up the PSTN is. Mobile roaming is one for example - when you roam on another carrier and place a call, that carrier directly originates the call and “spoofs” your caller ID to make it look like the call originated from you. Some companies may use different carriers for either load balancing or least-cost routing and so both of these carriers are required to “spoof” the company’s caller ID. This can definitely be fixed with a CA system and “delegation” where the main carrier who owns the number can issue certificates for any other carrier you’d like to use to temporarily allow them to use a particular caller ID, and each call request should be signed with that certificate and the signature should be verified by call intermediate carriers down the chain, and the call dropped if the signature is missing or invalid.

amluto 8y ago
I think the correct approach is economic, not technical. Make a rule that, if you get a spoofed call, then your telco owes you $100, not subject to any arbitration clause or other contractual waiver. Give a way out to avoid actually killing the telcos: annual penalties are limited to a few percent of annual gross revenues. The telcos will find a technical solution real fast.
- bdamm 8y ago
  How would you prove the call was spoofed? Record all calls? Prove it with statistics? No telco will pay. This is a technical problem.
  - Lionsion 8y ago
    >> I think the correct approach is economic, not technical. > This is a technical problem. IMHO, it's both. Economic sanctions need to be put in place to motivate the telcos to create and adopt robust technical solutions.
  - jimktrains2 8y ago
    You have a call received on your monthly bill from a number and the owner of that number does not have the call on their bill.
    - bdamm 8y ago
      How? Even in the same city, cellular and land lines aren't always serviced by the same company. In most places I'm pretty sure it's illegal for phone companies to be swapping call data. Or are you suggesting I call back all the numbers that call me to compare bills with the owner on the other end? This plan is not going to work out.
      - amluto 8y ago
        The courts can deal with things like this.
  - raverbashing 8y ago
    If an incoming call is saying it's coming from 555-1234 and telco owns 555-1234 and it's not one of their authorized income points then the call should get dropped. Or if they don't own it then it's on who's inserting the call into the system. Telco systems are fun. And by fun I mean it's a complete mess. ISDN is hard and full of caveats (look at SIP for a taste of what it involves).
- deleted 8y ago
  [deleted]
- njarboe 8y ago
  Or just let telephone users set a price, for someone not in there contact list, to call them. Set it at 5 cents by default. Problem solved for the most part. People that don't know you can still call you (like the person who you left your curtains at for repair) but most robo call campaigns won't be worth it. If you really hate spam, set your price to $10.

wtallis 8y ago

> Is there a compelling reason to allow such spoofs? It makes telcos money. That's reason enough, since there are no economic downsides to the network operators that enable these crimes. If companies like AT&T and Verizon were also being subject to this $120M fine, we might see them decide to make caller ID trustworthy so that it could be used to block robocalls.

nonbel 8y ago
>"It makes telcos money." How?
- dbatten 8y ago
  Telcos charge for connecting phone calls and routing voice packets. Even robocallers have to pay those fees.
  - flyinghamster 8y ago
    Not only that, but they also charge for Caller ID name lookups.
    - nonbel 8y ago
      This is interesting. So if I get a strange number and search 800notes.com or whatever the carrier is getting paid?
      - flyinghamster 8y ago
        No, this occurs at the telco level. When a call is placed, only the number is sent. The receiving exchange must look up that number to get the name, and that lookup costs some fraction of a cent. This is why Caller ID with name costs extra money.
  - nonbel 8y ago
    So if I don't answer, who is paying for the call? I thought unanswered calls were free for some reason.

dqv 8y ago

>Is there a compelling reason to allow such spoofs? A few use cases to spoof the number: * Appointment reminder systems - if I see the caller ID is from my doctor's office, I'm going to pick it up and hear the reminder. When the calls come from some other number, people think it's spam. People still expect reminder calls even if you/HN crowd would prefer an email/text. * Outbound call centers on behalf of others companies (same reason as above) * People who work from home but want to make business calls from a personal phone If no one could spoof, it probably result in a huge uptick of people claiming spam calls since they would be getting tons of calls from numbers they didn't know. There really needs to be an SPF, DKIM, DMARC for VOIP. I don't think a no spoofing policy would go over well for businesses or consumers.

ikeboy 8y ago
In all of those scenarios, one could prove they controlled or had authorization for the spoofed number, hence it would not be eligible for my proposed fine. I'm not suggesting no spoofing, I'm suggesting a fine on the carrier for unauthorized spoofing, which will force them to actually verify that there is authorization.
- dqv 8y ago
  >had authorization for the spoofed number You didn't make this clarification in your first post. In the first two examples, they don't control the claimed number, which is what I was responding to. >I'm suggesting a fine on the carrier for unauthorized spoofing, which will force them to actually verify that there is authorization. This makes sense. Legitimate companies will get authorization agreements signed etc.
wtallis 8y ago
The question wasn't about why spoofing exists at all. It was about spoofing where they did not control the claimed number. If you want to place a call with spoofed caller ID info, your provider should require you to prove that the spoofed information is legitimate, not fraudulent. Otherwise, the telco should be obligated to strip the suspect caller ID information from the call so that the recipient can properly identify the call as fishy. There's no need for any complicated cryptographic solution. Telcos should just be required to know their customer, much like banks, before allowing them to do certain things.

mikekchar 8y ago

I'm afraid I didn't read TFA, so apologies if I'm getting the wrong end of the stick. Also it's been 20 years since I worked in PSTN stuff. But at least at that time, the security in the protocol was ridiculously lax. IIRC, with PRI there was literally a bit that you set to say that the originating number was checked and was legitimate. Every other switch on the way through would accept it blindly. In most areas it was illegal to set that bit unless you were a telco. It was also illegal to sell equipment that set that bit unless you were selling it to a telco. But... it's not that hard to hack. Someone who's more current can probably give you better information. As to why nobody does anything about it... well.. why should they? They literally don't care. The equipment manufacturers aren't going to change the specs (because it's pretty darn hard to change specs and they are all trying to screw each other over in the specs anyway). The telcos aren't going to demand that the specs are changed because people are making telephone calls -- exactly what they want. It's only if the governments demand the change -- and it will take laws to do that (even then, I imagine that it's cheaper to lobby against the law than to change the equipment -- you have absolutely no idea how crappy those systems are).

lend000 8y ago

The reason I would agree with a fine is not because a caller's identity cannot be unmasked, but because phone numbers are so closely connected with identity that robocallers are essentially engaging in identity theft and slander when they use people's legitimate numbers to spoof their calls.

mark-r 8y ago
I had someone call me once, claiming I had just called them. I hadn't of course, so the only thing I could think of was that someone had used my phone number for spoofing.