4 ms·

Can someone "eli5" why this possibility of spoofing even exists and is allowed ? What are the legitimate use cases of this feature ? EDIT : thank you all for y

by pjerem 5y ago

Can someone "eli5" why this possibility of spoofing even exists and is allowed ? What are the legitimate use cases of this feature ? EDIT : thank you all for your answers ! I suppose it’s the same thing that allows you to receive messages from "SOME BRAND" and … why not. But this could be easily regulated. I don’t understand why anyone can spoof anything they want. Also, I don’t understand why my iPhone don’t allow me to block messages from "SOME BRAND" as if it was from any other sender.

ggm 5y ago
https://datatracker.ietf.org/wg/stir/documents/ https://datatracker.ietf.org/wg/stir/documents/ its not exactly ELI5. The CLI (Caller Line ID) field of a "incoming call" message isn't adequately policed. This is sort-of baked into how telephony works. It's stupid, and it should have been thought about more. The CLI field isn't how the call routes, its just how the caller announces who you are. Telephone call routing uses other data fields, its part of SS7 and the other signalling systems the phone network uses. The field which comes up a mobile call, inside "payload" isn't how it routed. Imagine some company has the indial range 667 2200 to 667 2299. If you dialled from your assigned handset 667 2241 the CLI can say 667 2200 so it looks like you come from the switch (in this example we assume the company's PBX operator is on 2200, and you publish 2200 as the incoming call number) so people don't learn your office handset: thats why they permitted it. I have no idea why they allow to to "lie" above your indial group range. But they do. STIR is how in a VOIP world people are approaching the fix. But really? the FCC and other national regulators have to tell the telco to stomp on the fakeout, when people inject calls into their system. This has parallels with "envelope sender vs RFC822 header" in email. Or spoofed source if your ISP doesn't do BCP38. Guess what: SPAM is a problem in email (duh) and spoofed source is how DDoS can happen. "telling lies" in end-to-end communications is not helpful.
- marcus_holmes 5y ago
  If this is baked into telephony, why we don't have this problem in Europe? (genuinely curious why this happens in the USA but not here)
  - ggm 5y ago
    We do have it in Australia fwiw
    - marcus_holmes 5y ago
      I used to live in Perth, and never had this problem this bad. I got the occasional spam text, but it was usually from some company I'd given my number to. Are you getting that many spam texts?
      - ggm 5y ago
        I get 2-3 spam texts and calls per month. About 1/2 fake my mobile # off by 1 digit near the end, a trick to make me "think its a number I know" I'm on ALDI which is an MVNO overlay on Telstra wholesale. Maybe ALDI do worse for source detect? (there is no difference between SMS and calls in regard to CLI faking. I don't know about RCS, its possible RCS gets rid of this problem. ALDI doesn't have RCS, its not ubiquitous, has to be enabled in the phone profile by the provider)
  - willis936 5y ago
    It sounds like it shouldn't even be happening in USA. It's a trivial bit of code in the routing software to check if CLI matches SS7. If it doesn't: don't connect. You don't even need to correct it. There's no legitimate reason to connect a spoofed number.
    - riskable 5y ago
      It is trivial to implement. They don't do it because they make a ton of money every year selling origin spoofing to businesses and charging customers for incoming texts (they never asked for). Spoofing is a service that the telcoms offer. Not a weakness! At least, that's how they see it.
- pjerem 5y ago
  Thank you for explaining me :)
YATA0 5y ago
Phone support is a good example. You may have 20 support reps that have unique numbers, but when they call out to you, the number that shows up is the support dispatch number. Support dispatch may be subcontracted out to an entirely different company (that may change over the months/years), so you'd still need to ability to spoof numbers you technically don't own. I agree there needs to be more controls and regulations in place though. The status quo is unsustainable.
- pjerem 5y ago
  Thank you for explaining me :)
closeparen 5y ago
The idea of a phone line having a specific number is a consumer thing. In the business world your connection is some number of concurrent channels. The business’s PBX decides what number should be displayed as caller ID when setting up an outgoing call on one of those channels. Inbound and outbound routing may be different (just like a domain’s outbound SMTP server may not be the same as its MX record) so allowing only the numbers that are routed to that PBX doesn’t work. You need something like the SPF record. That thing is called STIR/SHAKEN and it’s only being rolled out now.
- pjerem 5y ago
  Thank you, I get a better understanding now. If I understood correctly, those are more or less the same issues the mail world is trying to solve with DMARC.
gumby 5y ago
This goes back to when caller ID was introduced (80s?). There was a lot of opposition. Anyway, a company could have what was called a PBX — a bunch of lines would come in and the operator would connect them (by plugging cables — I still remember this system). When they replaced that with electronic “exchange” — Private Business eXchange you could dial straight out from your desk. However there were fewer lines coming in than extensions. For direct dial the PBX could either set all outgoing calls to be the main number or could send the direct dial number for the desk phone that made the call. We had a system like that into the late 80s though by that time we weren’t getting a bundle of incoming lines. This system does have an advantage: it lets staff make calls using phone number controlled by the company. So when someone leaves they can be forwarded to the appropriate person, like email addresses. For the last 15-20 years I’ve just used my mobile number which means when I leave a company I continue to get phone calls. I’ve always left on good terms so this isn’t terrible, but what if I had not? Since nobody calls on the phone any more this may be less of a problem, but phone numbers are still used as authentications for services like WhatsApp. These numbers need to go away.
- pjerem 5y ago
  Thank you for explaining me :)
- fortran77 5y ago
  > This goes back to when caller ID was introduced (80s?). There was a lot of opposition. The opposition was fascinating. Nobody predicted spoofing, of course, but I saw teary-eyed people crying on publicly televised hearings in NYC arguing both sides of Caller ID! - One women's group was against it. "We don't want women who are in safe homes or moved in with relatives to have to reveal their location when having to call their abusive partners" - One women's group was for it: "We want to know who calls us and says obscene things." Total craziness! See: https://www.google.com/books/edition/Caller_ID_Technology/84iZqwuyyuQC?hl=en&gbpv=1&dq=%22Caller%20ID%22%20opposition%20New%20York%20City%20hearings%20women&pg=PP1&printsec=frontcover https://www.google.com/books/edition/Caller_ID_Technology/84... for some of the hearing minutes
daneel_w 5y ago
"But this could be easily regulated. I don't understand why anyone can spoof anything they want." No, unfortunately it's not easy to regulate. It would involve not just all domestic operators, but also all telecom service aggregators (e.g. Twilio, Infobip, Sinch, and a thousand more), to find common ground and coordination of a working register of what company has the rights to what SMS sender name within one nation's network, whether it's numeric or alphanumeric. STIR/SHAKEN (which regulates usage of numeric caller IDs for phone calls) has taken ages to come to fruition, and that's despite the huge technical benefit of phone numbers being inherently anonymous and already belonging to a specific network operator. With the sender of an SMS the logistics are very different, and that's before even touching on the enormous business of legitimate SMS services and how these should be able to compete on the open market.

by pjerem 5y ago

ggm 5y ago

https://datatracker.ietf.org/wg/stir/documents/ https://datatracker.ietf.org/wg/stir/documents/ its not exactly ELI5. The CLI (Caller Line ID) field of a "incoming call" message isn't adequately policed. This is sort-of baked into how telephony works. It's stupid, and it should have been thought about more. The CLI field isn't how the call routes, its just how the caller announces who you are. Telephone call routing uses other data fields, its part of SS7 and the other signalling systems the phone network uses. The field which comes up a mobile call, inside "payload" isn't how it routed. Imagine some company has the indial range 667 2200 to 667 2299. If you dialled from your assigned handset 667 2241 the CLI can say 667 2200 so it looks like you come from the switch (in this example we assume the company's PBX operator is on 2200, and you publish 2200 as the incoming call number) so people don't learn your office handset: thats why they permitted it. I have no idea why they allow to to "lie" above your indial group range. But they do. STIR is how in a VOIP world people are approaching the fix. But really? the FCC and other national regulators have to tell the telco to stomp on the fakeout, when people inject calls into their system. This has parallels with "envelope sender vs RFC822 header" in email. Or spoofed source if your ISP doesn't do BCP38. Guess what: SPAM is a problem in email (duh) and spoofed source is how DDoS can happen. "telling lies" in end-to-end communications is not helpful.

marcus_holmes 5y ago
If this is baked into telephony, why we don't have this problem in Europe? (genuinely curious why this happens in the USA but not here)
- ggm 5y ago
  We do have it in Australia fwiw
  - marcus_holmes 5y ago
    I used to live in Perth, and never had this problem this bad. I got the occasional spam text, but it was usually from some company I'd given my number to. Are you getting that many spam texts?
    - ggm 5y ago
      I get 2-3 spam texts and calls per month. About 1/2 fake my mobile # off by 1 digit near the end, a trick to make me "think its a number I know" I'm on ALDI which is an MVNO overlay on Telstra wholesale. Maybe ALDI do worse for source detect? (there is no difference between SMS and calls in regard to CLI faking. I don't know about RCS, its possible RCS gets rid of this problem. ALDI doesn't have RCS, its not ubiquitous, has to be enabled in the phone profile by the provider)
- willis936 5y ago
  It sounds like it shouldn't even be happening in USA. It's a trivial bit of code in the routing software to check if CLI matches SS7. If it doesn't: don't connect. You don't even need to correct it. There's no legitimate reason to connect a spoofed number.
  - riskable 5y ago
    It is trivial to implement. They don't do it because they make a ton of money every year selling origin spoofing to businesses and charging customers for incoming texts (they never asked for). Spoofing is a service that the telcoms offer. Not a weakness! At least, that's how they see it.
pjerem 5y ago
Thank you for explaining me :)

YATA0 5y ago

Phone support is a good example. You may have 20 support reps that have unique numbers, but when they call out to you, the number that shows up is the support dispatch number. Support dispatch may be subcontracted out to an entirely different company (that may change over the months/years), so you'd still need to ability to spoof numbers you technically don't own. I agree there needs to be more controls and regulations in place though. The status quo is unsustainable.

pjerem 5y ago
Thank you for explaining me :)

closeparen 5y ago

The idea of a phone line having a specific number is a consumer thing. In the business world your connection is some number of concurrent channels. The business’s PBX decides what number should be displayed as caller ID when setting up an outgoing call on one of those channels. Inbound and outbound routing may be different (just like a domain’s outbound SMTP server may not be the same as its MX record) so allowing only the numbers that are routed to that PBX doesn’t work. You need something like the SPF record. That thing is called STIR/SHAKEN and it’s only being rolled out now.

pjerem 5y ago
Thank you, I get a better understanding now. If I understood correctly, those are more or less the same issues the mail world is trying to solve with DMARC.

gumby 5y ago

This goes back to when caller ID was introduced (80s?). There was a lot of opposition. Anyway, a company could have what was called a PBX — a bunch of lines would come in and the operator would connect them (by plugging cables — I still remember this system). When they replaced that with electronic “exchange” — Private Business eXchange you could dial straight out from your desk. However there were fewer lines coming in than extensions. For direct dial the PBX could either set all outgoing calls to be the main number or could send the direct dial number for the desk phone that made the call. We had a system like that into the late 80s though by that time we weren’t getting a bundle of incoming lines. This system does have an advantage: it lets staff make calls using phone number controlled by the company. So when someone leaves they can be forwarded to the appropriate person, like email addresses. For the last 15-20 years I’ve just used my mobile number which means when I leave a company I continue to get phone calls. I’ve always left on good terms so this isn’t terrible, but what if I had not? Since nobody calls on the phone any more this may be less of a problem, but phone numbers are still used as authentications for services like WhatsApp. These numbers need to go away.

pjerem 5y ago
Thank you for explaining me :)
fortran77 5y ago
> This goes back to when caller ID was introduced (80s?). There was a lot of opposition. The opposition was fascinating. Nobody predicted spoofing, of course, but I saw teary-eyed people crying on publicly televised hearings in NYC arguing both sides of Caller ID! - One women's group was against it. "We don't want women who are in safe homes or moved in with relatives to have to reveal their location when having to call their abusive partners" - One women's group was for it: "We want to know who calls us and says obscene things." Total craziness! See: https://www.google.com/books/edition/Caller_ID_Technology/84iZqwuyyuQC?hl=en&gbpv=1&dq=%22Caller%20ID%22%20opposition%20New%20York%20City%20hearings%20women&pg=PP1&printsec=frontcover https://www.google.com/books/edition/Caller_ID_Technology/84... for some of the hearing minutes

daneel_w 5y ago

"But this could be easily regulated. I don't understand why anyone can spoof anything they want." No, unfortunately it's not easy to regulate. It would involve not just all domestic operators, but also all telecom service aggregators (e.g. Twilio, Infobip, Sinch, and a thousand more), to find common ground and coordination of a working register of what company has the rights to what SMS sender name within one nation's network, whether it's numeric or alphanumeric. STIR/SHAKEN (which regulates usage of numeric caller IDs for phone calls) has taken ages to come to fruition, and that's despite the huge technical benefit of phone numbers being inherently anonymous and already belonging to a specific network operator. With the sender of an SMS the logistics are very different, and that's before even touching on the enormous business of legitimate SMS services and how these should be able to compete on the open market.