7 ms·

Wait, it's possible to spoof phone numbers?! Does anyone know how this works?

vkou 4y ago
When you make a phone call, your phone sends metadata containing your phone number to whomever you are calling. That's what the recipient sees as your caller ID. Of course, since you control your own device, you can make that metadata contain anything you want.
dahfizz 4y ago
https://en.m.wikipedia.org/wiki/Caller_ID_spoofing https://en.m.wikipedia.org/wiki/Caller_ID_spoofing
ceejayoz 4y ago
It's absolutely trivial. https://en.wikipedia.org/wiki/Caller_ID_spoofing https://en.wikipedia.org/wiki/Caller_ID_spoofing > Providers which market "wholesale VoIP" are typically intended to allow any displayed number to be sent, as resellers will want their end user's numbers to appear. I've gotten calls from banks' 1-800 numbers that were 100% definite scams this way.
- dave78 4y ago
  ..and there are plenty of non-nefarious reasons to want to spoof numbers. I used to have a VOIP setup at home that, when I dialed out, the call would appear to come from my cellphone[0]. Google Voice used to be able to do that too (no idea if it still does). Businesses often use this to have all their calls appear to come from the main office line or a 1-800 number. Or, when forwarding a call, you could make the 2nd leg outbound call appear to come from the original caller instead of the forwarder, things like that. Unfortunately as with so many things, bad actors are going to ruin it for everyone. [0] I also found out that if I dialed my cell phone voicemail number from this VOIP phone, it bypassed my security code and went straight to my mailbox - since the outgoing number matched my cellphone number, it assumed it was me calling. A quick experiment showed I could then access anyone's voicemail (on that carrier at least) by simply setting my outbound number to appear as their cell number...
  - not2b 4y ago
    Such cases could be handled if there were a way to verify that a spoofed number is an authorized use. Your cellphone number belongs to you. Some bank's 800 number does not. What we need is a mechanism that prevents the scammers from lying while still permitting setups like yours.
    - fryguy 4y ago
      I mean, that's what STIR/SHAKEN do.
  - jjtheblunt 4y ago
    > plenty of non-nefarious reasons? aren't they all variations of "both numbers are provably yours"?
    - viraptor 4y ago
      Define provably and yours. When forwarding a call, the origin is not yours. When calling "in the name" of the company's switchboard, the number is not yours. When I use a number which is actually mine but comes from another country, it's not really provable.
  - bagels 4y ago
    Every provider should be responsible for verifying that their downstream customers are legitimate. If they deliver junk on behalf of their customers, they should get banned. That's how this problem gets solved. Your provider doesn't want to get black-holed, and now has an incentive to make sure your VOIP system is legitimate.
    - worthless-trash 4y ago
      I fully support this behavior, however from what I read about Australias wiretap laws, they can't check the source number without a warrant :|
bombcar 4y ago
It is insanely easy to spoof "caller ID", it is slightly harder to spoof whatever the "real source" thing is that's just below it. But both are not hard, and if you have the right VOIP provider you're off to the races.
rolph 4y ago
one way is with ANI abuse. the 2nd is abusing callID transmitters and protocol. i think the 2nd way may have been mitigated. it was kinda like butting into line before anyone notices. if you've ever had a call when your at the phone, and you see a brief flash of a number, that instantly changes to another number, this 2nd method is likely in play
carom 4y ago
Fairly long video [1] to show how to operate a VOIP app, but yea, pretty simple. Should be harder whenever STIR/SHAKEN [2] goes into effect. 1. https://odysee.com/@cybering:1/spoofing-call-id-using-voip:2 https://odysee.com/@cybering:1/spoofing-call-id-using-voip:2 2. https://en.wikipedia.org/wiki/STIR/SHAKEN https://en.wikipedia.org/wiki/STIR/SHAKEN
- mminer237 4y ago
  STIR/SHAKEN is already in effect for 99% of people. That's what this order is about. These seven small VoIP companies are the only ones who haven't implemented it. (Presumably, their whole raison d'être is for spammers.) Those seven companies are currently providing service for all remaining spoofers, so they have two weeks to fix it or they're done.
  - bagels 4y ago
    Presumably if they are illegitimate, they will lose most of their customers if they do comply, or they lose network access by not acting. Sounds like this will put the illegitimate ones out of business.
r3trohack3r 4y ago
Here is an excellent video of McAfee doing it to a fox news anchor: https://mobile.twitter.com/officialmcafee/status/1305383285904814081 https://mobile.twitter.com/officialmcafee/status/13053832859...

vkou 4y ago

When you make a phone call, your phone sends metadata containing your phone number to whomever you are calling. That's what the recipient sees as your caller ID. Of course, since you control your own device, you can make that metadata contain anything you want.

dahfizz 4y ago

https://en.m.wikipedia.org/wiki/Caller_ID_spoofing https://en.m.wikipedia.org/wiki/Caller_ID_spoofing

ceejayoz 4y ago

It's absolutely trivial. https://en.wikipedia.org/wiki/Caller_ID_spoofing https://en.wikipedia.org/wiki/Caller_ID_spoofing > Providers which market "wholesale VoIP" are typically intended to allow any displayed number to be sent, as resellers will want their end user's numbers to appear. I've gotten calls from banks' 1-800 numbers that were 100% definite scams this way.

dave78 4y ago
..and there are plenty of non-nefarious reasons to want to spoof numbers. I used to have a VOIP setup at home that, when I dialed out, the call would appear to come from my cellphone[0]. Google Voice used to be able to do that too (no idea if it still does). Businesses often use this to have all their calls appear to come from the main office line or a 1-800 number. Or, when forwarding a call, you could make the 2nd leg outbound call appear to come from the original caller instead of the forwarder, things like that. Unfortunately as with so many things, bad actors are going to ruin it for everyone. [0] I also found out that if I dialed my cell phone voicemail number from this VOIP phone, it bypassed my security code and went straight to my mailbox - since the outgoing number matched my cellphone number, it assumed it was me calling. A quick experiment showed I could then access anyone's voicemail (on that carrier at least) by simply setting my outbound number to appear as their cell number...
- not2b 4y ago
  Such cases could be handled if there were a way to verify that a spoofed number is an authorized use. Your cellphone number belongs to you. Some bank's 800 number does not. What we need is a mechanism that prevents the scammers from lying while still permitting setups like yours.
  - fryguy 4y ago
    I mean, that's what STIR/SHAKEN do.
- jjtheblunt 4y ago
  > plenty of non-nefarious reasons? aren't they all variations of "both numbers are provably yours"?
  - viraptor 4y ago
    Define provably and yours. When forwarding a call, the origin is not yours. When calling "in the name" of the company's switchboard, the number is not yours. When I use a number which is actually mine but comes from another country, it's not really provable.
- bagels 4y ago
  Every provider should be responsible for verifying that their downstream customers are legitimate. If they deliver junk on behalf of their customers, they should get banned. That's how this problem gets solved. Your provider doesn't want to get black-holed, and now has an incentive to make sure your VOIP system is legitimate.
  - worthless-trash 4y ago
    I fully support this behavior, however from what I read about Australias wiretap laws, they can't check the source number without a warrant :|

bombcar 4y ago

It is insanely easy to spoof "caller ID", it is slightly harder to spoof whatever the "real source" thing is that's just below it. But both are not hard, and if you have the right VOIP provider you're off to the races.

rolph 4y ago

one way is with ANI abuse. the 2nd is abusing callID transmitters and protocol. i think the 2nd way may have been mitigated. it was kinda like butting into line before anyone notices. if you've ever had a call when your at the phone, and you see a brief flash of a number, that instantly changes to another number, this 2nd method is likely in play

carom 4y ago

Fairly long video [1] to show how to operate a VOIP app, but yea, pretty simple. Should be harder whenever STIR/SHAKEN [2] goes into effect. 1. https://odysee.com/@cybering:1/spoofing-call-id-using-voip:2 https://odysee.com/@cybering:1/spoofing-call-id-using-voip:2 2. https://en.wikipedia.org/wiki/STIR/SHAKEN https://en.wikipedia.org/wiki/STIR/SHAKEN

mminer237 4y ago
STIR/SHAKEN is already in effect for 99% of people. That's what this order is about. These seven small VoIP companies are the only ones who haven't implemented it. (Presumably, their whole raison d'être is for spammers.) Those seven companies are currently providing service for all remaining spoofers, so they have two weeks to fix it or they're done.
- bagels 4y ago
  Presumably if they are illegitimate, they will lose most of their customers if they do comply, or they lose network access by not acting. Sounds like this will put the illegitimate ones out of business.

r3trohack3r 4y ago

Here is an excellent video of McAfee doing it to a fox news anchor: https://mobile.twitter.com/officialmcafee/status/1305383285904814081 https://mobile.twitter.com/officialmcafee/status/13053832859...