4 ms·

Part of the problem is the conceptual designs around the SS7 signalling network. Trust is all or none. If you allow a switch in {x} country to connect to your

Part of the problem is the conceptual designs around the SS7 signalling network. Trust is all or none. If you allow a switch in {x} country to connect to your switches, then they can spoof calls. All it takes is one shady company with an SS7 link and they can resell access for all manor of spoofing. The SS7 network really has no concept around levels of trust or banning specific connections from specific types of messages. It's a very ancient system, much older than the internet. It's only newer than the even more ancient "A" series mechanical phone switch networks. To overhaul such a system on such a large scale would require building out a new system in parallel in my opinion. I can not even fathom the level of bureaucratic battles, legal battles required for such an undertaking. Back in the day, I wanted to nix a SS7 link to a shady vendor that was spamming cell phones. I got in trouble for that. "They are paying their bills, leave them alone and keep your nose out of it". That is another aspect of the problem. Even if a telco wanted to stop abuse on their own network, it would not be permitted unless they are legally obligated to do so. Even then, telco's have more lobbyists than all the silicon valley big tech combined, no exaggeration. That is just based on my very dated experience. I have long since left telco and very happy I did.

chris_st 6y ago
Ouch... if that's the case, how can the FCC do anything to find the scammers? It sounds like it's technically impossible (and maybe also politically, alas).
- LinuxBender 6y ago
  At best, they could require the U.S. to implement STIR/SHAKEN [1], maybe. There will be significant technical and legal challenges in this. Overhauling or upgrading the existing switches is non trivial. This is just my opinion, but I predict this will result in legal battles and legal stalling on the part of the telcos. Even if all the telcos agreed to do this, there would be a period of time that nothing is enforced and even then, this has no impact on anyone outside of U.S. jurisdiction unless laws with teeth require amended agreements between the U.S. and non-U.S. telcos. I am not a lawyer, but I don't need to be one to see some of the ways this will play out and how this can turn into political posturing, deflection of responsibility and saber rattling between the U.S. and other countries. [1] - https://transnexus.com/whitepapers/stir-and-shaken-overview/ https://transnexus.com/whitepapers/stir-and-shaken-overview/
robocat 6y ago
Surely spoofed calls can be detected and infringements penalised i.e. you can’t lock the front door so instead of prevention you identify who walks through the door and punish thieves. Detection seems like it is doable - either technically (detect spoofing which implies something impossible like a home phone in Nigeria) or consumer feedback (e.g. a short number to call which marks previously received call as a robocall). And some detection can be done with existing equipment and fails gracefully (it doesn’t need to be 100% reliable) unlike changes to core protocols/equipment.
akira2501 6y ago
> It's a very ancient system, much older than the internet. That seems an odd characterization.. they both were being developed at nearly the same time. SS7 developed faster and was put into use much more broadly than IP due to corporate need and support, but they're both about the same age.
im3w1l 6y ago
So there needs to be a way to report them anonymously?
wtallis 6y ago
> Part of the problem is the conceptual designs around the SS7 signalling network. Trust is all or none. If you allow a switch in {x} country to connect to your switches, then they can spoof calls. Why does the problem have to be tackled from the direction of extending the wire protocol? It seems like it would be straightforward to tackle it from the business end first: a major phone company declares that it will block spoofing on calls originating in its network, and will only accept calls coming into its network from partners who make the same commitment to not allow spoofed calls onto their networks. This doesn't require any changes to the technology used to connect phone networks, just changes to the business arrangements (a threat of blacklisting). (If you don't want to take quite such a hardline approach, then require that all calls either originate from a network that is trusted to have valid caller ID data, or the caller ID data is stripped from the call. And then give all end users the option of blocking calls with blank caller ID.)
- spc476 6y ago
  I suspect it has to do with roaming. I have a phone in country X with company Y. If I travel to country A with company B and make a call, is it spoofed?
- LinuxBender 6y ago
  This is a good question. I think the problem lies in the fact you would have to include in your business decision to block roaming. Roaming is a money maker, so I think you would have a hard time convincing telcos to block that. There are laws around roaming as well that you would have to augment or remove internationally. If numbers were not portable and roaming did not exist; meaning, you have to acquire a local number through some form of authentication and your source country forwards the calls to that temporary number, then that might work. When you call people back, they won't see your number though. They would see the loaned local number. At this point we are reinventing the proposed shaken/stir but in a more cumbersome manor. all calls either originate from a network that is trusted That is also tricky. What does trusted mean? Does it mean that if someone on that network is abusing SS7, that they become untrusted? If so, every network would be untrusted within 10 minutes. Maybe a cost penalty to self regulate? You have to block your own reported abusers or lose peering? I like the idea, but I think that would put us back into that realm of legal and political quandaries. This would require a fairly significant addition in full time employees to police the abuse reports and entirely new reporting systems to log all the SS7 data, learn and report abuse patterns.
yowlingcat 6y ago
> Even then, telco's have more lobbyists than all the silicon valley big tech combined, no exaggeration. Very interesting, and certainly not the first time I've heard that. I wonder if and when Facebook is going to encroach on telco turf.
- LinuxBender 6y ago
  I would not imagine silicon valley wanting into the landline business. Mobile perhaps, Google dipped its toes in that one I believe through acquisitions. Landline operators today are the opposite of agile, move-fast-break-things. Change control in telco is draconian compared to anything SV tech have seen. New ideas almost never see the light of day. And all of this is codified in regulations. It's comparable to the banking industry, though each have their own quirks.
xen2xen1 6y ago
That sounds wrong to me? Surely you could do something like ingress / egress filtering of the numbers, and not allow an American number from India, for instance? Am I missing something in the setup. I guess what you're really saying is that most phone systems are nowhere near that sophisticated?
- mjevans 6y ago
  Not my expert domain but; Roaming. How do you let someone with a cell phone make a call while on vacation half way around the world, without giving them most of a second of latency?
- LinuxBender 6y ago
  What you are saying totally makes sense, but numbers are portable as mjevans pointed out and b-number analysis is a bit more primitive. This requires cooperation from all the telcos and would require business changes, process changes and code changes to systems so that you could approve-list what is a mobile network NPA/NSX and deny-list what is not. This just means spoofers would only be spoofing mobile numbers. Now you have a game of whack-a-mole. Some of these systems are so old that the people that wrote code for them are long gone. I am not saying that is universally true of course. Some switches had fairly modern hardware. But unlike the internet where everything peers with bgp and information / routing information is freely shared, there is a lot more manual work and manual changes and coordination required. Even if you could update all of them, now you have to maintain yet another real time deny-list and that does not really solve spoofing.
  - deleted 6y ago
    [deleted]
mjcl 6y ago
> It's a very ancient system, much older than the internet. Actually, you could argue they're around the same age. ARPANET switched from NCP to TCP on 1 January 1983 [1] and the initial SS7 standard was released by the ITU in 1988. [1] https://tools.ietf.org/html/rfc801 https://tools.ietf.org/html/rfc801
rhizome 6y ago
The thing that gets me is that no matter what is on the line, spoofed Caller ID or no, telcos know exactly which account is paying for that outbound call to exist. The technology can't be quite as primitive as portrayed, since AFAIK there is absolutely no way you can spoof someone's number in CID and have something billed to them, such as a long-distance call from a landline (which still have LD plans). Telco is always going to know where the money is coming from for every volt and bit on their wires. It's possible I'm clueless, but that's where I feel enforcement should be focused: on the money side.

chris_st 6y ago

Ouch... if that's the case, how can the FCC do anything to find the scammers? It sounds like it's technically impossible (and maybe also politically, alas).

LinuxBender 6y ago
At best, they could require the U.S. to implement STIR/SHAKEN [1], maybe. There will be significant technical and legal challenges in this. Overhauling or upgrading the existing switches is non trivial. This is just my opinion, but I predict this will result in legal battles and legal stalling on the part of the telcos. Even if all the telcos agreed to do this, there would be a period of time that nothing is enforced and even then, this has no impact on anyone outside of U.S. jurisdiction unless laws with teeth require amended agreements between the U.S. and non-U.S. telcos. I am not a lawyer, but I don't need to be one to see some of the ways this will play out and how this can turn into political posturing, deflection of responsibility and saber rattling between the U.S. and other countries. [1] - https://transnexus.com/whitepapers/stir-and-shaken-overview/ https://transnexus.com/whitepapers/stir-and-shaken-overview/

robocat 6y ago

Surely spoofed calls can be detected and infringements penalised i.e. you can’t lock the front door so instead of prevention you identify who walks through the door and punish thieves. Detection seems like it is doable - either technically (detect spoofing which implies something impossible like a home phone in Nigeria) or consumer feedback (e.g. a short number to call which marks previously received call as a robocall). And some detection can be done with existing equipment and fails gracefully (it doesn’t need to be 100% reliable) unlike changes to core protocols/equipment.

akira2501 6y ago

> It's a very ancient system, much older than the internet. That seems an odd characterization.. they both were being developed at nearly the same time. SS7 developed faster and was put into use much more broadly than IP due to corporate need and support, but they're both about the same age.

im3w1l 6y ago

So there needs to be a way to report them anonymously?

wtallis 6y ago

> Part of the problem is the conceptual designs around the SS7 signalling network. Trust is all or none. If you allow a switch in {x} country to connect to your switches, then they can spoof calls. Why does the problem have to be tackled from the direction of extending the wire protocol? It seems like it would be straightforward to tackle it from the business end first: a major phone company declares that it will block spoofing on calls originating in its network, and will only accept calls coming into its network from partners who make the same commitment to not allow spoofed calls onto their networks. This doesn't require any changes to the technology used to connect phone networks, just changes to the business arrangements (a threat of blacklisting). (If you don't want to take quite such a hardline approach, then require that all calls either originate from a network that is trusted to have valid caller ID data, or the caller ID data is stripped from the call. And then give all end users the option of blocking calls with blank caller ID.)

spc476 6y ago
I suspect it has to do with roaming. I have a phone in country X with company Y. If I travel to country A with company B and make a call, is it spoofed?
LinuxBender 6y ago
This is a good question. I think the problem lies in the fact you would have to include in your business decision to block roaming. Roaming is a money maker, so I think you would have a hard time convincing telcos to block that. There are laws around roaming as well that you would have to augment or remove internationally. If numbers were not portable and roaming did not exist; meaning, you have to acquire a local number through some form of authentication and your source country forwards the calls to that temporary number, then that might work. When you call people back, they won't see your number though. They would see the loaned local number. At this point we are reinventing the proposed shaken/stir but in a more cumbersome manor. all calls either originate from a network that is trusted That is also tricky. What does trusted mean? Does it mean that if someone on that network is abusing SS7, that they become untrusted? If so, every network would be untrusted within 10 minutes. Maybe a cost penalty to self regulate? You have to block your own reported abusers or lose peering? I like the idea, but I think that would put us back into that realm of legal and political quandaries. This would require a fairly significant addition in full time employees to police the abuse reports and entirely new reporting systems to log all the SS7 data, learn and report abuse patterns.

yowlingcat 6y ago

> Even then, telco's have more lobbyists than all the silicon valley big tech combined, no exaggeration. Very interesting, and certainly not the first time I've heard that. I wonder if and when Facebook is going to encroach on telco turf.

LinuxBender 6y ago
I would not imagine silicon valley wanting into the landline business. Mobile perhaps, Google dipped its toes in that one I believe through acquisitions. Landline operators today are the opposite of agile, move-fast-break-things. Change control in telco is draconian compared to anything SV tech have seen. New ideas almost never see the light of day. And all of this is codified in regulations. It's comparable to the banking industry, though each have their own quirks.

xen2xen1 6y ago

That sounds wrong to me? Surely you could do something like ingress / egress filtering of the numbers, and not allow an American number from India, for instance? Am I missing something in the setup. I guess what you're really saying is that most phone systems are nowhere near that sophisticated?

mjevans 6y ago
Not my expert domain but; Roaming. How do you let someone with a cell phone make a call while on vacation half way around the world, without giving them most of a second of latency?
LinuxBender 6y ago
What you are saying totally makes sense, but numbers are portable as mjevans pointed out and b-number analysis is a bit more primitive. This requires cooperation from all the telcos and would require business changes, process changes and code changes to systems so that you could approve-list what is a mobile network NPA/NSX and deny-list what is not. This just means spoofers would only be spoofing mobile numbers. Now you have a game of whack-a-mole. Some of these systems are so old that the people that wrote code for them are long gone. I am not saying that is universally true of course. Some switches had fairly modern hardware. But unlike the internet where everything peers with bgp and information / routing information is freely shared, there is a lot more manual work and manual changes and coordination required. Even if you could update all of them, now you have to maintain yet another real time deny-list and that does not really solve spoofing.
- deleted 6y ago
  [deleted]

mjcl 6y ago

> It's a very ancient system, much older than the internet. Actually, you could argue they're around the same age. ARPANET switched from NCP to TCP on 1 January 1983 [1] and the initial SS7 standard was released by the ITU in 1988. [1] https://tools.ietf.org/html/rfc801 https://tools.ietf.org/html/rfc801

rhizome 6y ago

The thing that gets me is that no matter what is on the line, spoofed Caller ID or no, telcos know exactly which account is paying for that outbound call to exist. The technology can't be quite as primitive as portrayed, since AFAIK there is absolutely no way you can spoof someone's number in CID and have something billed to them, such as a long-distance call from a landline (which still have LD plans). Telco is always going to know where the money is coming from for every volt and bit on their wires. It's possible I'm clueless, but that's where I feel enforcement should be focused: on the money side.