6 ms·

Can someone explain to me how spoofing is even possible and why it is allowed? That’s what I’ve never understood about this whole thing. Does it has any legitim

Can someone explain to me how spoofing is even possible and why it is allowed? That’s what I’ve never understood about this whole thing. Does it has any legitimate use? Robocalls would be much easier to address if you could block/report the actual number they come from.

hateful 8y ago
I don't have the real answer, but I remember back when Google Desktop was a thing, I had a widget that would allow me to send a text to anyone and it had a field for the "from" number. So my guess is that the protocol they use asks the caller for the "from" number.
AnimalMuppet 8y ago
Let's say you're a business. You have a "front desk" number that you want incoming calls to come from, but you have a bunch of other people with their own numbers that make outbound calls. You want those outbound calls to show up as if from your "front desk" number, not from the actual individual numbers they came from. But spoofing to a number that you don't own? No, I don't know of any legitimate use for that.
- Buttons840 8y ago
  I did this for the medical industry. We made robocalls to remind patients of their appointments. We originated the robocalls from a central location, but would spoof the Caller ID so that it would show the number of the appointment desk of their local medical facility. This way if they called the number on the CID, they would reach an appointment desk with the power to help them reschedule or otherwise.
- reificator 8y ago
  > But spoofing to a number that you don't own? No, I don't know of any legitimate use for that. When making calls on behalf of an entity that does own that number. Happens all the time, a company hires a bunch of call centers, they make outbound calls, then those return calls go back to a number owned by the original company. They can then answer them in-house, transfer them to a certain call center, transfer them round-robin, whatever they need to do. Plus it gives them the flexibility to drop a certain call center if needed, without having to worry about losing control of that number.
ghaff 8y ago
Yes. One common use is that companies often want to display their main number rather than the number associated with a specific employee. Phone numbers can also often be associated with a physical address which can be a problem for people who legitimately don't want to give away their location.
- cortesoft 8y ago
  Shouldn't they have some sort of mapping that says "These numbers are all owned by the same company, and can spoof any of the others they also own"?
  - reificator 8y ago
    I believe that's essentially what's going into place now. You pay a bunch of money to get a certificate that says you own a bunch of numbers, and then you should be fine to project any of those numbers as your caller id.
    - flavor8 8y ago
      IIRC Twilio "rents" you a number for a month at a time, so this is fairly non-binding.
  - briffle 8y ago
    Last big company I worked for had 90 offices in all 50 states. Up until a large consolidation and VOIP change, Each office had a PRI line (or more) with a phone number associated with each incoming line (for the hunt group). Each PRI came with 24 numbers, 1 'main' number, and 20 others for the individual lines in the PRI. Calling the main number would forward to the 20+ numbers in a hunt group. All 23 of those numbers would then forward to the local PBX, and then get the 'please enter the extension of the party you are trying to reach' kind of IVR response. (there were hundreds of actual people in the office) This is a relatively small company with 2500 employees. Imagine something much, much larger, with offices worldwide, VOIP routing internally, least cost routing of phone calls, etc.
- 8y ago
eridius 8y ago
AIUI spoofing is possible because the phone systems were designed back in the days when a single entity controlled the entire network and so everything just trusts everything else. That said, I don't know why we still haven't fixed this. We've had plenty of time. I guess the answer just comes down to it costs money to fix it and the phone companies historically haven't cared. Though at this point, given how many people outright refuse to answer numbers they don't recognize due to spammers, you'd think the phone companies would be feeling financial pressure to work towards restoring trust in the phone system.
- kalleboo 8y ago
  > Though at this point, given how many people outright refuse to answer numbers they don't recognize due to spammers, you'd think the phone companies would be feeling financial pressure to work towards restoring trust in the phone system I imagine it's the kind of issue where there are still enough people answering the calls where if they dealt with the issue it would have a noticeable, measurable financial impact, so nobody in the company can propose it. But by not fixing the issue now it will also destroy all future business. So short-sightedness.
- ohazi 8y ago
  > Though at this point, given how many people outright refuse to answer numbers they don't recognize due to spammers, you'd think the phone companies would be feeling financial pressure to work towards restoring trust in the phone system. What financial pressure do the phone companies feel when I never answer my phone? I still have to give them identical amounts of money to maintain my internet connection.
chrischen 8y ago
It’s the difference between dropping an envelope in a blue mailing box with only the destination address vs registering on usps.com to print a label. Probably Due to the Unabomber, they stopped accepting large packages in the anonymous blue postal bins that were paid by stamps. Phone companies can CHOOSE to stop routing calls without more identity/registration from the caller but it’s just not implemented, maybe for legacy compatibility reasons. I believe for some countries on twilio, phone number registrations require additional verification, but for the US you just need credit on twilio.
nradov 8y ago
There's no real authentication in SS7 so spoofing is trivial.
wingspar 8y ago
One purpose is for legitimate calls on the behalf of others. I got a call just yesterday from my DR's office reminding me of a scheduled appointment. Have no way of knowing for sure, but I have no doubt that it's a service spoofing their office phone number so the calls get answered. It was a computer generated voice and automated response processing.
- saghm 8y ago
  Speaking personally, I always let calls from numbers not in my contacts go to voicemail and then listen to the message afterwards to see if I need to call back. For an automated appointment reminder, calling from a different number than my doctor's office wouldn't be an issue, since it would still go to voicemail just the same (which I actually prefer, since then I can listen to the message again later if for some reason I forget the time).
zackmorris 8y ago
It's because: 1) Caller id was conceptually flawed from the beginning so was implemented as an honor system instead of something required to communicate (like an IP address) 2) Caller id is unregulated, so there is no penalty for spoofing My previous comment on it: https://news.ycombinator.com/item?id=19303931 https://news.ycombinator.com/item?id=19303931 From the linked article: Unlike phone numbers and domain name service (DNS), wherein there are internationally recognized databases that are authoritative sources, there is no central authority or regulation for caller ID. No FCC guidelines regulate carrier accuracy, and although federal regulations exist regarding telemarketers and spoofing, carriers can maintain their caller ID databases as they see fit. https://www.onsip.com/blog/how-caller-id-works-why-it-might-take-months-to-update https://www.onsip.com/blog/how-caller-id-works-why-it-might-...
- OrgNet 8y ago
  So why dont they display what serves the purpose of the IP address instead? They have to be able to route calls somehow
  - simias 8y ago
    Originally the telephone network was directly switched, that means that it effectively connected your phone directly to the caller's. There was no need to route a return path because, well, it was as if you had a copper line going from your phone to the caller's. In such a setup the caller might not even need a functional phone number, just an entry point into the network. It's very different from a packet switching network where data is cut in small chunks with a header meant to be routed across the graph (and in which case you need to be able to find your way back for the reply somehow). Of course I expect that modern phone networks have evolved massively from the early days but I'm sure that this original design decision still makes what you're proposing difficult. There's a lot of historical baggage.
    - OrgNet 8y ago
      Are you also talking about VOIP or only old fashioned phone systems?
rtkwe 8y ago
Caller ID is a bit of an afterthought hack added to the system so it's not really built into the original design of phone systems. There's not really the validation built in for a phone company to validate that the phone number sent from another network matches what they get is the target number and some caller id info to continue connecting the call. Add on top of that the fact that phone companies are required to connect incoming and transit phone calls and you get the current mess. Phone companies can't refuse to connect calls systematically from a bad actor and there's no validation mechanism because only the caller's phone company actually knows the initial number for sure.
- mehrdadn 8y ago
  > Phone companies can't refuse to connect calls systematically from a bad actor Isn't that exactly what T-Mobile is doing with their scam blocking? Or did you mean something a bit different?
kyrra 8y ago
SHAKEN/STIR is the answer to this and is being worked on. https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication https://transnexus.com/whitepapers/understanding-stir-shaken/ https://transnexus.com/whitepapers/understanding-stir-shaken...
zelon88 8y ago
Some businesses operate with a single outside facing telephone number. So when you call 1-800-myc-mpny you reach the business at that number. But if that company has 10 people who are making outside calls they need 10 outside lines. By allowing companies to spoof CID all 10 callers can make calls that appear to have originated from 1-800-myc-mpny even though the lines they're using all tie to different external phone numbers.
- rhizome 8y ago
  Yes, but when they spoof a completely different number for strategic purposes it should still be possible to block calls from the unspoofed number's account. I mean, it should be possible to block any account holder, but it would be especially effective here.
phjesusthatguy3 8y ago
When a phone call is made, there are (at least) two parties responsible for what gets displayed on the callee's phone: a) CallerID: This is the numeric part of the info displayed on the callee's phone. Is provided by the calling party, DOES NOT have anything to do with the second part. IS NOT RESPONSIBLE FOR THE NAME THAT SHOWS ON THE CALL b) CNAM: This is the Name part that gets delivered to the callee's phone. This is essentially a reverse lookup on the CallerID part of the call IN THE CALLEE'S PROVIDER'S DATABASE Back when (today's) AT&T ran the whole phone system, those two databases were essentially the same. Now that they aren't, hilarity ensues.
brianpgordon 8y ago
Nobody has mentioned VoIP yet. If you think about corporate VoIP networks, it's pretty clear why spoofing works. There's no secure out-of-band signaling available when everything is made of standard IP packets passing through normal networking equipment. This stuff got plugged into the public switched telephone network without adding authentication first.

hateful 8y ago

I don't have the real answer, but I remember back when Google Desktop was a thing, I had a widget that would allow me to send a text to anyone and it had a field for the "from" number. So my guess is that the protocol they use asks the caller for the "from" number.

AnimalMuppet 8y ago

Let's say you're a business. You have a "front desk" number that you want incoming calls to come from, but you have a bunch of other people with their own numbers that make outbound calls. You want those outbound calls to show up as if from your "front desk" number, not from the actual individual numbers they came from. But spoofing to a number that you don't own? No, I don't know of any legitimate use for that.

Buttons840 8y ago
I did this for the medical industry. We made robocalls to remind patients of their appointments. We originated the robocalls from a central location, but would spoof the Caller ID so that it would show the number of the appointment desk of their local medical facility. This way if they called the number on the CID, they would reach an appointment desk with the power to help them reschedule or otherwise.
reificator 8y ago
> But spoofing to a number that you don't own? No, I don't know of any legitimate use for that. When making calls on behalf of an entity that does own that number. Happens all the time, a company hires a bunch of call centers, they make outbound calls, then those return calls go back to a number owned by the original company. They can then answer them in-house, transfer them to a certain call center, transfer them round-robin, whatever they need to do. Plus it gives them the flexibility to drop a certain call center if needed, without having to worry about losing control of that number.

ghaff 8y ago

Yes. One common use is that companies often want to display their main number rather than the number associated with a specific employee. Phone numbers can also often be associated with a physical address which can be a problem for people who legitimately don't want to give away their location.

cortesoft 8y ago
Shouldn't they have some sort of mapping that says "These numbers are all owned by the same company, and can spoof any of the others they also own"?
- reificator 8y ago
  I believe that's essentially what's going into place now. You pay a bunch of money to get a certificate that says you own a bunch of numbers, and then you should be fine to project any of those numbers as your caller id.
  - flavor8 8y ago
    IIRC Twilio "rents" you a number for a month at a time, so this is fairly non-binding.
- briffle 8y ago
  Last big company I worked for had 90 offices in all 50 states. Up until a large consolidation and VOIP change, Each office had a PRI line (or more) with a phone number associated with each incoming line (for the hunt group). Each PRI came with 24 numbers, 1 'main' number, and 20 others for the individual lines in the PRI. Calling the main number would forward to the 20+ numbers in a hunt group. All 23 of those numbers would then forward to the local PBX, and then get the 'please enter the extension of the party you are trying to reach' kind of IVR response. (there were hundreds of actual people in the office) This is a relatively small company with 2500 employees. Imagine something much, much larger, with offices worldwide, VOIP routing internally, least cost routing of phone calls, etc.
8y ago

eridius 8y ago

AIUI spoofing is possible because the phone systems were designed back in the days when a single entity controlled the entire network and so everything just trusts everything else. That said, I don't know why we still haven't fixed this. We've had plenty of time. I guess the answer just comes down to it costs money to fix it and the phone companies historically haven't cared. Though at this point, given how many people outright refuse to answer numbers they don't recognize due to spammers, you'd think the phone companies would be feeling financial pressure to work towards restoring trust in the phone system.

kalleboo 8y ago
> Though at this point, given how many people outright refuse to answer numbers they don't recognize due to spammers, you'd think the phone companies would be feeling financial pressure to work towards restoring trust in the phone system I imagine it's the kind of issue where there are still enough people answering the calls where if they dealt with the issue it would have a noticeable, measurable financial impact, so nobody in the company can propose it. But by not fixing the issue now it will also destroy all future business. So short-sightedness.
ohazi 8y ago
> Though at this point, given how many people outright refuse to answer numbers they don't recognize due to spammers, you'd think the phone companies would be feeling financial pressure to work towards restoring trust in the phone system. What financial pressure do the phone companies feel when I never answer my phone? I still have to give them identical amounts of money to maintain my internet connection.

chrischen 8y ago

It’s the difference between dropping an envelope in a blue mailing box with only the destination address vs registering on usps.com to print a label. Probably Due to the Unabomber, they stopped accepting large packages in the anonymous blue postal bins that were paid by stamps. Phone companies can CHOOSE to stop routing calls without more identity/registration from the caller but it’s just not implemented, maybe for legacy compatibility reasons. I believe for some countries on twilio, phone number registrations require additional verification, but for the US you just need credit on twilio.

nradov 8y ago

There's no real authentication in SS7 so spoofing is trivial.

wingspar 8y ago

One purpose is for legitimate calls on the behalf of others. I got a call just yesterday from my DR's office reminding me of a scheduled appointment. Have no way of knowing for sure, but I have no doubt that it's a service spoofing their office phone number so the calls get answered. It was a computer generated voice and automated response processing.

saghm 8y ago
Speaking personally, I always let calls from numbers not in my contacts go to voicemail and then listen to the message afterwards to see if I need to call back. For an automated appointment reminder, calling from a different number than my doctor's office wouldn't be an issue, since it would still go to voicemail just the same (which I actually prefer, since then I can listen to the message again later if for some reason I forget the time).

zackmorris 8y ago

It's because: 1) Caller id was conceptually flawed from the beginning so was implemented as an honor system instead of something required to communicate (like an IP address) 2) Caller id is unregulated, so there is no penalty for spoofing My previous comment on it: https://news.ycombinator.com/item?id=19303931 https://news.ycombinator.com/item?id=19303931 From the linked article: Unlike phone numbers and domain name service (DNS), wherein there are internationally recognized databases that are authoritative sources, there is no central authority or regulation for caller ID. No FCC guidelines regulate carrier accuracy, and although federal regulations exist regarding telemarketers and spoofing, carriers can maintain their caller ID databases as they see fit. https://www.onsip.com/blog/how-caller-id-works-why-it-might-take-months-to-update https://www.onsip.com/blog/how-caller-id-works-why-it-might-...

OrgNet 8y ago
So why dont they display what serves the purpose of the IP address instead? They have to be able to route calls somehow
- simias 8y ago
  Originally the telephone network was directly switched, that means that it effectively connected your phone directly to the caller's. There was no need to route a return path because, well, it was as if you had a copper line going from your phone to the caller's. In such a setup the caller might not even need a functional phone number, just an entry point into the network. It's very different from a packet switching network where data is cut in small chunks with a header meant to be routed across the graph (and in which case you need to be able to find your way back for the reply somehow). Of course I expect that modern phone networks have evolved massively from the early days but I'm sure that this original design decision still makes what you're proposing difficult. There's a lot of historical baggage.
  - OrgNet 8y ago
    Are you also talking about VOIP or only old fashioned phone systems?

rtkwe 8y ago

Caller ID is a bit of an afterthought hack added to the system so it's not really built into the original design of phone systems. There's not really the validation built in for a phone company to validate that the phone number sent from another network matches what they get is the target number and some caller id info to continue connecting the call. Add on top of that the fact that phone companies are required to connect incoming and transit phone calls and you get the current mess. Phone companies can't refuse to connect calls systematically from a bad actor and there's no validation mechanism because only the caller's phone company actually knows the initial number for sure.

mehrdadn 8y ago
> Phone companies can't refuse to connect calls systematically from a bad actor Isn't that exactly what T-Mobile is doing with their scam blocking? Or did you mean something a bit different?

kyrra 8y ago

SHAKEN/STIR is the answer to this and is being worked on. https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication https://transnexus.com/whitepapers/understanding-stir-shaken/ https://transnexus.com/whitepapers/understanding-stir-shaken...

zelon88 8y ago

Some businesses operate with a single outside facing telephone number. So when you call 1-800-myc-mpny you reach the business at that number. But if that company has 10 people who are making outside calls they need 10 outside lines. By allowing companies to spoof CID all 10 callers can make calls that appear to have originated from 1-800-myc-mpny even though the lines they're using all tie to different external phone numbers.

rhizome 8y ago
Yes, but when they spoof a completely different number for strategic purposes it should still be possible to block calls from the unspoofed number's account. I mean, it should be possible to block any account holder, but it would be especially effective here.

phjesusthatguy3 8y ago

When a phone call is made, there are (at least) two parties responsible for what gets displayed on the callee's phone: a) CallerID: This is the numeric part of the info displayed on the callee's phone. Is provided by the calling party, DOES NOT have anything to do with the second part. IS NOT RESPONSIBLE FOR THE NAME THAT SHOWS ON THE CALL b) CNAM: This is the Name part that gets delivered to the callee's phone. This is essentially a reverse lookup on the CallerID part of the call IN THE CALLEE'S PROVIDER'S DATABASE Back when (today's) AT&T ran the whole phone system, those two databases were essentially the same. Now that they aren't, hilarity ensues.

brianpgordon 8y ago

Nobody has mentioned VoIP yet. If you think about corporate VoIP networks, it's pretty clear why spoofing works. There's no secure out-of-band signaling available when everything is made of standard IP packets passing through normal networking equipment. This stuff got plugged into the public switched telephone network without adding authentication first.