5 ms·

Caller ID can still be forged Can anyone explain, or point to a resource that explains, why this is still the case in 2012? Is there some technical reason why

Caller ID can still be forged Can anyone explain, or point to a resource that explains, why this is still the case in 2012? Is there some technical reason why this is the case, or do the phone companies make enough money off of scammers and robocallers that there's no incentive for them to fix it?

pyre 14y ago
I don't know the technical details, but I know this is trivial to do if you have Asterix setup to manage your POTS line.
- viraptor 14y ago
  Actually you cannot spoof a number on your own pots line. At least not a standard end-user line, because that one's connected directly to your telco and is bound to one specific id. But if you have a trunk with your own control channels (so basically you and telco assume trust between each other and that you provide correct information) you can publish any numbers you want. It's quite popular with the internet telephony providers to relax the rules a bit. Basically some allow you to check the "I promise not to break the law, believe the data I send" and will accept any caller id you want. Since there's no way for one telco to verify other telco's source numbers, everyone else has to believe your caller id too.
stephengillie 14y ago
Why can email headers still be spoofed?
- barrkel 14y ago
  Because you don't have to pay for it.
objclxt 14y ago
> Can anyone explain, or point to a resource that explains, why this is still the case in 2012? This wikipedia article has a reasonable summary: http://en.wikipedia.org/wiki/Caller_ID_spoofing http://en.wikipedia.org/wiki/Caller_ID_spoofing
jamesmcn 14y ago
The reason why Caller ID can be forged is that the calling device announces its CallerID number. The easiest way to get into spoofing CallerID is by using a SIP-driven POTS gateway (very common 6 years ago, telecom moves very slowly, so I suspect they are still easy to find today). Some providers will validate the number you want to announce, and prevent you from announcing a number that they don't think you should be using. Others don't care at all. There are a lot of different telecom service providers, so finding one with lax policies isn't hard. Almost anyone who is actually operating a phone card business has all the equipment needed to do this, for example. Phone cards are incredibly competitive, so if you head over to your local telecom hotel you won't have much trouble finding people willing to take your money in exchange for steady business. The next time you are in a data center, take some time to talk to the people messing with the funky gear that doesn't look like any firewall or router you've ever seen.
viraptor 14y ago
There's no real system that would allow verifying if telco X can use number Y for a given call. Verifying that is actually not as simple as it would be 20 years ago. These days you can move numbers between providers pretty quickly. You can request services which fake the callerid for legitimate reasons (when you setup call forwarding, it's your telco making the new call but you probably want the original number to be preserved). There are also cases when you want to authorise some numbers to be faked (for example you want your company phone to have caller id set to the office switchboard). There would have to be a global opt-in system allowing to verify those cases. And it would be as effective as the DNS records for verifying sender domains - you probably want to assign it a score, rather than reject right away.

pyre 14y ago

I don't know the technical details, but I know this is trivial to do if you have Asterix setup to manage your POTS line.

viraptor 14y ago
Actually you cannot spoof a number on your own pots line. At least not a standard end-user line, because that one's connected directly to your telco and is bound to one specific id. But if you have a trunk with your own control channels (so basically you and telco assume trust between each other and that you provide correct information) you can publish any numbers you want. It's quite popular with the internet telephony providers to relax the rules a bit. Basically some allow you to check the "I promise not to break the law, believe the data I send" and will accept any caller id you want. Since there's no way for one telco to verify other telco's source numbers, everyone else has to believe your caller id too.

stephengillie 14y ago

Why can email headers still be spoofed?

barrkel 14y ago
Because you don't have to pay for it.

objclxt 14y ago

> Can anyone explain, or point to a resource that explains, why this is still the case in 2012? This wikipedia article has a reasonable summary: http://en.wikipedia.org/wiki/Caller_ID_spoofing http://en.wikipedia.org/wiki/Caller_ID_spoofing

jamesmcn 14y ago

The reason why Caller ID can be forged is that the calling device announces its CallerID number. The easiest way to get into spoofing CallerID is by using a SIP-driven POTS gateway (very common 6 years ago, telecom moves very slowly, so I suspect they are still easy to find today). Some providers will validate the number you want to announce, and prevent you from announcing a number that they don't think you should be using. Others don't care at all. There are a lot of different telecom service providers, so finding one with lax policies isn't hard. Almost anyone who is actually operating a phone card business has all the equipment needed to do this, for example. Phone cards are incredibly competitive, so if you head over to your local telecom hotel you won't have much trouble finding people willing to take your money in exchange for steady business. The next time you are in a data center, take some time to talk to the people messing with the funky gear that doesn't look like any firewall or router you've ever seen.

viraptor 14y ago

There's no real system that would allow verifying if telco X can use number Y for a given call. Verifying that is actually not as simple as it would be 20 years ago. These days you can move numbers between providers pretty quickly. You can request services which fake the callerid for legitimate reasons (when you setup call forwarding, it's your telco making the new call but you probably want the original number to be preserved). There are also cases when you want to authorise some numbers to be faked (for example you want your company phone to have caller id set to the office switchboard). There would have to be a global opt-in system allowing to verify those cases. And it would be as effective as the DNS records for verifying sender domains - you probably want to assign it a score, rather than reject right away.