Clever Caller ID Tricks With VoIP

An anonymous reader writes "securityfocus.com has an interesting article collecting some clever exploits for VoIP. According to the article, using 'the open-source Linux-based PBX software Asterisk, used in combination with a permissive VoIP provider' can be used to fool caller id, and even get caller numbers that are supposed to be private."

Comments

Freaks!

[krumms]

Return of the phreak? :P

old news for me :)

[Anonymous Coward]

Back in 2001 or so I found this out when talking to my local ISP/VoIP provider IPOnly. Then me and some of my friends thought about setting up some kind of SMS-style service that was free, since it apparently works sending ascii as caller ID :)

Re:old news for me :)

[itwerx]

Back in 2001 or so...
A heck of a lot longer than that, as this "issue" isn't limited to VOIP. Ask anybody who installs/maintains standard PBX systems.
The privilege of setting your own outbound CID is simply another (business class) service and reading blocked inbound is actually your right if you have a toll-free number (because you're paying for the call).
(Dunno why cell-phones don't have the same right though, c'est la vie :).

from overseas

[millahtime]

Does this mean that I could get a call on a private line with with my number on the do not call list from overseas? Kind of like spam for my phone.

Gone Phishing

[Mz6]

"Callers with life-or-death anonymity concerns might consider spoofing just to get a little privacy. For now, Lucky says pranks among friends are the most common use that he's seen of VoIP spoofing, but he believes that identity thieves and other swindlers could have a field day. "I've used it myself to activate my own credit cards, because I never give credit card companies my real number," he says. "One simple spoof, and it's like saying, if you have the guy's phone number, that piece of information is more important than his mother's maiden name and date of birth. If you have the phone number, you don't need anything else."

Well this is nice. Once again the social engineering tricks will creep up on most once again. However, who's really that stupid to be giving away all of their personal info over the telephone anyway? Does this mean that it's going to start being like the phishing scams now?

Re:Gone Phishing

[LostCluster]

Who's really that stupid? Big business.

Call-centers are using the CPN data as an authentication method to recognize customers. Call from somebody else's phone, or in this case appear to be doing so, and instantly that person's account will open on the operator's screen.

Banks and credit card companies seem to be smart enough to know that they have to ask some other challenge question to make themselves confident enough that they have the right person before discussing anything sensitve... but it just take one merchant willing to charge to an account and ship merchandise based on the the phone data alone and suddenly there's a way to get a charge onto somebody's credit account without even knowing their card number.

It's a matter of "trust", and a formerly trustworthy system no not so much.

Err... so what?

[newt]

This isn't new. You can do exactly the same thing with a PABX with ISDN ports. The ability to set your own caller-ID is part of the ISDN call setup protocol.

What you can't do, though, is set the ANI data (which is used by the telcos to find out who gets billed for the call and for call interception). And I can't see how that capability changes at all just because you're using a VoIP gateway either.

- mark

Re:Err... so what?

[bhmit1]

This isn't new. You can do exactly the same thing with a PABX with ISDN ports.

Read the article. The interesting part isn't that this is some new feature. The interesting part is that you don't have to go out and get a lot of expensive telephone equipment to intercept blocked numbers and impersonate someone else's number.

And, as was said before, the biggest fear this creates is that someone will start grabbing the ready-to-activate credit cards out of the mail, look up the persons name in a phone book, program their voip with that persons number, and activate that card. And this is only a problem because credit card companies trust that Joe Shmoe was really him when he called from his home number.

Re:Err... so what?

[Tmack]

Then this sounds like a simple problem to fix to me: The phone companies would simply have to check that the phone number reported for caller id matches one that they have registered for the person who is billed. If not, they can give an error message or something. Or did I misunderstand something?

You misunderstand how caller ID works. On traditional PSTN lines, when you make an outbound call your callerID information is looked up in a database (maintained by your carrier) when it hits the callswitch in the Central Office (CO). This is tacked onto the call and is sent with the rest of the call routing information to the destination via the signalling lines of SS7 trunks (note: SS7 splits voice traffic and call signaling between physically seperate routes/lines, meaning voice traffic is not transmitted or routed until the call is established, eliminating the effectiveness of the old blue/black box dialers.). When it reaches the last CO and goes out to a Remote Terminal (RT), the RT sends the ring tones to your phone over the local loop copper (for PSTN, more on that in a sec). Mixed in with the ring tones is a modem-sounding signal that your Caller ID box intercepts and decodes to get the caller ID info. Since this data is stored by the phone company, it is hard to spoof.

With digital phone systems, the signaling goes all the way to the switch itself, allowing the PBX more control over the call. ISDN and CAS have provisions to inject CallerID information into the outbound calls. Whether or not this information is passed through the CO call switch or is replaced is up to the carrier. Generally since its less stuff for the carrier to deal with, they let it pass. I-VoIP (internet VoIP) carriers need the software to be able to route calls back to their switch, and in doing so, the software basically becomes a software based digital PBX. So along with routing information, the CallerID info can be passed into the signaling.

Another issue is that caller-ID can be any alpha-numeric string, with a few special characters thrown in as well. Because of this, you can have your CallerID Name set to show up as a random phone number (867-5309?), and unless someone actually checks the number portion of the CaID against what shows up in the display, they probably wont notice, and if it is noticed, it would look like 2 different phone numbers and probably just confuse the person receiving the call.

Tm

business opportunity

[ch-chuck]

so is voip going to turn into something like the email spam mess once the peddlers of Mydixaflopin and their cronies start figuring out how to use it?

Alight!

[theJerk242]

Thanks to this exploit, I can do crank calls again without getting caught!

Is this a surprise?

[insensitive_clod]

Is this a surprise? From the article, it says that the calling party number is always sent, and there's just a flag set saying "don't look here." If you tell someone they can't or shouldn't do something... that's the best way to insure that they will.

Useful part

[dacarr]

You know those idiots (read: bill collectors) who call with "OUT OF AREA" tags on their Caller ID data? Yeah. I wonder if you can reset those to figure out who those are. The possibilities are good here. =^_^=

Re:Useful part

[machine of god]

Or, you could, you know, pay your bills.

Re:Useful part

[hackstraw]

You know those idiots (read: bill collectors) who call with "OUT OF AREA" tags on their Caller ID data? Yeah. I wonder if you can reset those to figure out who those are. The possibilities are good here. =^_^=

First, its much less stressful to just pay your bills.

Also, I dispise the fact that there can be either "OUT OF AREA", or "Unavailable", or the worst, "Private Name/Private Number". The only reason I answer these on my phone, is because I do sometimes get legitimate business call from people hiding behind these things. I do not answer politely, and I'm ready to start bitching at someone.

I am required to have a license plate on my car, I have to show ID to do most anything. I certainly would never walk into a store or bank disguising my face, why is this acceptable with a phone call?

Re:Countdown

[LostCluster]

This isn't an open source issue at all. It's a "trusting user provided equipment" mistake... a closed source program can violate the standard just as badly.

It's a matter of equipment being given info it's not supposed to share and a flag telling it not to share. But, if the customer provides the software...

Re:Details?

[callipygian-showsyst]

800 numbers always have access to your number, regardless of your "Caller ID" preference.

Amazing...

[yogensha]

...that this type of spoofing is so easy. I work for a small ILEC. We got an Asterisk box almost a year ago to play a bit with VoIP. The caller ID spoofing was easy to do, and fun for awhile. Out of curiosity, I tried to figure out how to secure the switch enough to prevent this type of spoofing from happening. With less than a year of experience in circuit switching, the manual, and about 30 minutes, I managed to limit the spoofable numbers to the range of DID numbers actually assigned to that PRI. In other words, no more spoofing. It amazes me that more providers don't implement this type of security.

Re:Calling FCC...

[Gaewyn L Knight]

There is NOTHING about this that is any more permissive than a normal business with a digital PBX can already do...

"The FCC would never tolerate an old-line phone company selling a service that lets people lie to caller ID"

It is done CONSTANTLY! Marketing companies send out the callerid of the companies they are calling on behalf of... Companies have multiple phone lines send out the callerid of their main phone line.... it is a normal business service.

As for getting the number of the remote caller, anyone with a PRI line can do that. This is mandated because otherwise on 1-8XX lines you would never be able to verify you were being correctly billed for their usage from your provider.

I hate to say this... but you obviously havn't worked with a real phone system before.

Not New

[suwain_2]

The fact that this is happening is interesting, but this sort of thing's always been possible.

First off, any sort of digital phone line lets you set your own caller ID info, it's just that most home users can't afford bringing a T1 into their home just to mess with caller ID.

Secondly, there've always been ways around caller ID anyway. A common one is called 'op diverting,' where you route your call through an operator, who will, in many cases, manually key in your Caller ID info with no authentication at all.

There are real privacy concerns here, but my point is, for those alarmed by them... Be even more alarmed. This is entirely doable without VoIP.

I don't know about getting blocked caller ID, though 800 numbers (and, IIRC, almost all high-volume digital lines?) have full access to caller ID, even if you block it.

The point of the article, IMHO, is that VoIP providers are carelessly sending this data, not the exploits that can be done -- they already exist. And you can almost argue that VoIP providers aren't entirely wrong here -- if you got a PRI line to your home, you could do this type of stuff anyway.

The security "industry" is engageing in FUD

[bferrell]

This isn't a hack. The telco interconnect company (in this case nuphone) sends the info to Ma Bell. The fact that they don't validate it is NOT a hack. It may be a risk, but feeding incorrect info to mother is not a hack or a manipulation. In general the telco themselves require information be provided... It's a little sad that some interconnect companies don't treat it more seriously. I know my company does.

ISDN

[jcrowly]

Having tried to set my MSN (the outbound number) to an invalid number here in the UK (on a primary rate with 100 phone number mapped to it), the invaild caller ID simply got reset by the telco to the billing number of the line.

I guess in the states the Telcos must trust the equipment that connects up to the line to set the MSN connectly, hence being able to fake the Caller ID.

As for the privicy bit for callerid, in the UK (as far as I am aware, but I'll test this) only telecos are passed the CallerId+Flag (by telecos I means those with an Interconnect with other telecos and an NX2 license, but the licenses are being phased out), It's then the telecos job to strip out the CallerID and Flag before passing on the data to the customers line.

Once again, this is not really a hack or exploit.

[BlueTT]

CID information was never designed nor intended to be in any way secure.

PBXs have always had the ability to set outgoing CID information - so, for example, all outgoing calls would appear on the receiver's CID box as coming from a company's main switchboard rather than whatever extension they were actually originating from.

It always frightens me to see press accounts of CID information being used as "proof" of something, say the violation of a restraining order or proof of harassment when it is absolutely trivial to spoof. Newer VOIP devices just make it easier to do without the need for a PBX and trunk line to do so.

ANI information, the calling number information provided when you call an 800 number, is an entirely different matter. Since it is used for billing information, it IS secure, the only way to spoof it to be to call a provider who then turns around and reroutes your calls from their exchange. But whether you have CID blocking or not, the ANI number is ALWAYS passed because, frankly, they're paying for the call and they have a right to see who's calling them.

Another trick

[rindeee]

I just sent Kevin an e-mail to this effect, but for anyone else interested here's more info:

**Portion omitted**

Vonage has "fixed" their CID spoofing problem (at least in some switches), but in the process has created a new "feature". Try this:

1. Call a party. When they answer, flash over to a new dial-tone (as if to initiate a 3rd party call). Dial the new third party (who has been instructed not to answer the call coming from your phone number) and after a couple of rings hang up the phone. Rather than the initial call ringing back to you as it should, it will ring forward to the third party. A nifty way to put your friend in CA in touch with your friend in NY with no long-distance charges even when they don't use Vonage.

2. Let a party call you. Flash over to a new line and dial a 3rd party. Repeat process above and you can effectively "transfer" the call out of your phone system with no toll charges.

In both cases, your Vonage line is free to make and receive calls as soon as you hang up.

Thanks, and keep up the great writing!!!

Egon Rinderer

Re:Details?

[Feyr]

i run a small ISP, and i have the callerid of everyone calling, no matter what their privacy setting says. it even gets logged in my cute little radius database

as someone pointed out, it's a part of the ISDN call setup protocol.

Re:Details?

[cmburns69]

The theory behind it is that since the owner of the 800 number is paying for the call, he has the right to know who is calling.

"It's not a bug, it's a feature."

[faedle]

Let me echo the statements of others that said "This has been possible forever" by saying that I was doing this with a Pacific Bell ISDN line six years ago. I discovered that they weren't authenticating any of the data I sent out on the D-channel, they were just passing it along.

Also, the reason why many VoIP providers are passing along Caller ID data without verification is legitimate. VoIP has no concept of "numbers" tied to hard physical "lines". Many VoIP providers sell outgoing service that is not tied to any physical telephone number. This is nothing new: conventional telcos have been doing that for years (it used to be called OutWATS) over T1s. If my VoIP gateway provider has no physical phone number to set my calls to, what are they supposed to do? This is the #1 reason all those telemarketer calls are labelled "OUT OF AREA", BTW.

In my case, I set the Caller ID to the POTS line that terminates into the same phone system. However, it would be trivial for me to set it to something like 714-853-1212, and it would get passed.

The problem is not that I can set Caller ID to any arbitrary number, but that idiots are actually depending upon an in-band signalling system which depends upon third parties (private PABXs) for the data as a secure authentication method.

I don't personally see any easy fix to this, nor should there be. The telecom business is increasingly having small players in it, and it will be difficult to fix this alleged "problem" without locking out these same small players.

Re:Countdown

[Idarubicin]

And I am on the Do Not Call List, but they call and it is "unknown", and worse a recording to call some 800 number for a free satelite dish, from some company in Canada. No way to make them accountable for violating the law.

Interesting. You might actually look at their violations of Canadian law, then. Using an auto-dialler (an Automatic Dialling and Announcing Device, or ADAD) for solicitation--charitable donations, promotions, sales, etc.--is forbidden by the CRTC (Canadian Radio-television and Telecommunications Commission.) The CRTC can demand that a phone company suspend service to any company or individual who flagrantly violates these rules. Even if a company hires another company to make the calls, they can be held accountable. You might want to contact the CRTC directly to see how the rules apply on international calls, however.

Even if a company is blocking call ID, your phone company can probably trace the call. For advice on how to handle this type of thing with an international call, again you might need to contact the FTC and the CRTC. It doesn't hurt to ask, and I'm pretty sure that the people at these organizations hate the spam callers as much as everyone else.

Re:Countdown

[bareminimum]

This isn't about violating standards. We've been faking caller ids for fun with Asterisk for a while. It does work, however my local (Bell) provider will not let me put one of its own numbers in the bogus CID I pass.

This is a normal "feature" of CID. That's how you can go through a third-party LD provider yet still have your own phone number show up on the recipient's display. Voicepulse or other VOIP providers are not being overly permissive here. If you get a T1 bank you will have the same capability. That's what makes it possible for huge corporations to have thousands of phone lines in hundreds of offices yet display only their main incoming number on your caller id capable phone when someone from their office calls you.

The difference is that now average Joe can fake CID like the big boys used to do with a mere $7/month investment, vs the couple hundred dollars it would cost (plus install fees) if you went with a standard channel bank.

CID is for information purposes only. The problem is that people have grown to trust it as being 100% accurate, but they definitely shouldn't.

Re:Reading unlisted numbers

[jjhall]

Nope, it isn't possible anywhere, US or otherwise. The reason is, that your CID box is showing exactly what is sent to it. The correct information is blocked at the switch level, before your line even rings.

Now if you want to get as many numbers as is possible, like this article is stating, get yourself a toll-free number and use it instead of your local number. Anyone calling it (that has CID information available) will have it show up, regardless as to whether or not they try to block it.

That article was very misleading, making it seem as though this is a flaw that the information was displayed when it was blocked. In reality, it is just how the network operates. Nufone provides a toll-free number, since the person being called is the one paying, they have a right to know the number. This is how it has always worked.

Jeremy