3 ms·

I thought it was a legal requirement for phone network operators to leave phone numbers accessible to all Is it a legal requirement to allow spoofed caller ID

by 300bps 4y ago

I thought it was a legal requirement for phone network operators to leave phone numbers accessible to all Is it a legal requirement to allow spoofed caller ID from bad actors? Spoofed IP addresses used to be a much bigger problem on the Internet than they are today (many examples but see Smurf Attack). We collectively implemented security to reduce the threat. Phone companies could do the same for spoofed caller ID for companies that consistently abuse it.

toast0 4y ago
> Spoofed IP addresses used to be a much bigger problem on the Internet than they are today (many examples but see Smurf Attack). Most of the large DDoS attacks are UDP reflection, the attacker spoofs the victims address and sends to chargen[1] servers or whatever. So spoofing is still alive and well. [1] yes really, the worst ones are people who install Microsoft's Services for Unix and enable the chargen server to the public... It sends a 64k fragmented response. Thanks Microsoft.
- 300bps 4y ago
  How long have you been on the Internet? I ask because I started an ISP in 1996 and IP address spoofing used to be soooo much worse. Today’s situation is the product of literally 2.5 decades of encouraging and/or shaming Internet-connected networks into properly configuring their routers to drop spoofed packets egressing from their network with a spoofed IP address not from their network.
  - toast0 4y ago
    Approximately forever, although while I worked at an "ISP" in 1999, it was a two T1 ISP; one for modems, one for upstream; and then we outsourced all the modem stuff to MegaPath when something weird happened to our modem T1, but I was never trained on how that T1 worked, all just magic to me. I kind of sort of get the idea today, but ... I poked at the RADIUS server, and setup webhosting for customers. I never worked for a real DDoS target until 10 years ago (and even then it was mostly people kicking the tires with 90 second DDoS services). I'm sure it's not as bad as it once was, but it's still probably easier to get a big DDoS with UDP reflection than through botnets directly hitting the target. Back to the topic of telco spam. STIR/Shaken should maybe get us actual caller-ids soonish, I think there's one more deadline for small carriers that service actual phone lines. OTOH, what are you going to do with a real caller id? I'm pretty sure phone companies just don't want to do it anymore, there's no money in voice calling, and it'll fall apart like landlines have.
    - 300bps 4y ago
      but it's still probably easier to get a big DDoS with UDP reflection than through botnets directly hitting the target. We were more sophisticated back then. So picture your netblock is 207.180.10.0/24 and you've directly connected all 200 computers on your Class-C netblock directly to the public Internet without any NAT. 207.180.10.0 is your network ID and 207.180.10.255 is your broadcast address. Someone comes along and sends a 64 byte ICMP ECHO request to 207.180.10.255. And they get 200 responses. Literally every one of the computers on your entire network responds with an ICMP ECHO reply. So now they can spoof an IP address from Victim IP address to send 1k ICMP ECHO requests to 207.180.10.255 and multiply their attack 200:1. But now imagine instead of a tiny Class-C netblock they find a similarly configured broadcast address for a huge Class-A netblock. And their scanner counts 29,000 ICMP ECHO replies for each request they send out. Now their attack is multiplied 29,000:1. And since they've been scanning for broadcast addresses on the public Internet every day for a month they have compiled a list of hundreds of them so the attack seems to be coming from everywhere. https://www.fortinet.com/resources/cyberglossary/smurf-attack https://www.fortinet.com/resources/cyberglossary/smurf-attac...

by 300bps 4y ago

toast0 4y ago

> Spoofed IP addresses used to be a much bigger problem on the Internet than they are today (many examples but see Smurf Attack). Most of the large DDoS attacks are UDP reflection, the attacker spoofs the victims address and sends to chargen[1] servers or whatever. So spoofing is still alive and well. [1] yes really, the worst ones are people who install Microsoft's Services for Unix and enable the chargen server to the public... It sends a 64k fragmented response. Thanks Microsoft.

300bps 4y ago
How long have you been on the Internet? I ask because I started an ISP in 1996 and IP address spoofing used to be soooo much worse. Today’s situation is the product of literally 2.5 decades of encouraging and/or shaming Internet-connected networks into properly configuring their routers to drop spoofed packets egressing from their network with a spoofed IP address not from their network.
- toast0 4y ago
  Approximately forever, although while I worked at an "ISP" in 1999, it was a two T1 ISP; one for modems, one for upstream; and then we outsourced all the modem stuff to MegaPath when something weird happened to our modem T1, but I was never trained on how that T1 worked, all just magic to me. I kind of sort of get the idea today, but ... I poked at the RADIUS server, and setup webhosting for customers. I never worked for a real DDoS target until 10 years ago (and even then it was mostly people kicking the tires with 90 second DDoS services). I'm sure it's not as bad as it once was, but it's still probably easier to get a big DDoS with UDP reflection than through botnets directly hitting the target. Back to the topic of telco spam. STIR/Shaken should maybe get us actual caller-ids soonish, I think there's one more deadline for small carriers that service actual phone lines. OTOH, what are you going to do with a real caller id? I'm pretty sure phone companies just don't want to do it anymore, there's no money in voice calling, and it'll fall apart like landlines have.
  - 300bps 4y ago
    but it's still probably easier to get a big DDoS with UDP reflection than through botnets directly hitting the target. We were more sophisticated back then. So picture your netblock is 207.180.10.0/24 and you've directly connected all 200 computers on your Class-C netblock directly to the public Internet without any NAT. 207.180.10.0 is your network ID and 207.180.10.255 is your broadcast address. Someone comes along and sends a 64 byte ICMP ECHO request to 207.180.10.255. And they get 200 responses. Literally every one of the computers on your entire network responds with an ICMP ECHO reply. So now they can spoof an IP address from Victim IP address to send 1k ICMP ECHO requests to 207.180.10.255 and multiply their attack 200:1. But now imagine instead of a tiny Class-C netblock they find a similarly configured broadcast address for a huge Class-A netblock. And their scanner counts 29,000 ICMP ECHO replies for each request they send out. Now their attack is multiplied 29,000:1. And since they've been scanning for broadcast addresses on the public Internet every day for a month they have compiled a list of hundreds of them so the attack seems to be coming from everywhere. https://www.fortinet.com/resources/cyberglossary/smurf-attack https://www.fortinet.com/resources/cyberglossary/smurf-attac...