Caller ID Falsification Service
Dan writes "
A US website will offer Caller ID falsification service...Slated for launch this week, Star38.com would offer subscribers a simple Web interface to a Caller ID spoofing system that lets them appear to be calling from any number they choose. [...]
SecurityFocus took the site for a test drive, and found it worked as advertised. The user fills out a simple Web form with his phone number, the number he wants to call, and the number he wants to appear to be calling from. Within two seconds, the system rings back, and patches the user through to the destination. The recipient sees only the spoofed number displayed on Caller ID. Any number works, from nonsense phone numbers like "123 4567" to the number for the White House switchboard."
"Mr. President, you have a call from the Pope."
Right is wrong when left is right.
"The recipient sees only the spoofed number displayed on Caller ID. Any number works, from nonsense phone numbers like "123 4567" to the number for the White House switchboard."
I think that the people who are going to profit from this the most will be guys like Howard Stern (if he's still on the air). He'll ring up anyone he wants and pretend to be working for some fake government agency while the nimrods on the line will be in fear if they have caller id. Oh the laughs... until the FCC has their way with Stern and shut him down.
How many kids are going to get into serious trouble with this service?
Let's not even start talking about all the wonderful social engineering that can now be performed with this great service. "This is Bill Gates. I forgot my password. Give it to me."
So all ye lawyers, would the owners of Star38.com be in the doghouse for this service when the masses start using it as a launchpad for social engineering? I'm thinking, hell yes (but IANAL).
The dangers of knowledge trigger emotional distress in human beings.
Star38.com claims it will screen subscribers, and initially make the service available only to licensed private investigators and collection agencies. Jepson and his partners believe that collection agencies in particular will find the service invaluable for getting recalcitrant debtors to answer the phone.
Debt collection agencies already mask their online and phone identities pretty well. Using common telephone setups (before the big Asterik "save the children" bullshit) they just appeared as whatever they wanted. In fact their web-presence is generally unknown and they even mask their hostnames to the rest of the world with benign addresses like mta-mailserver.alliedfinancial.com (this is a recreation of an actual NAT host used by a collection agency).
Private Investigators should opt for paying the phone company to offer them a similar service (or better yet don't call from your business phone).
If they are really allowing ANY number it isn't going to make it very far out of the "hype-stages". Think of what this could do to our children and what could happen in the hands of the terrorists!
CallerID: "J. KERRY CAMP. OFF. HQ"
Caller: "Hi, I'm calling you to vote for John Kerry via absentee ballot."
John_Overseas: "Ok. Count me in. Down with Bush!"
Caller: "Done. Thanks for helping Bu...I mean...Kerry win!"
Caller: "Another close one Dubya."
Have you ever wanted to post a comment as someone else, for humor or other more mischievous purposes? Now you can thanks to Slashdot's new comment author falsification service! You can be CmdrTaco, Hemos, CowboyNeal, or one of literally hundreds of thousands of other people, some of them actually famous!
Author falsification starts at a mere 10,000 subscription points!
Chalk one up for the stalkers!
The methods behind this are still hidden. They claim that it's not VoIP as most people currently do...
Any speculation what it could be?
...watch legislation arrive to clamp down on who can own PBX equipment, and what it can be used for.
Bye bye, Asterisk.
tasks(723) drafts(105) languages(484) examples(29106)
I knew a friend who worked in a courthouse, and she'd call me from the phone in there.
The caller id was (999) 999-9999. Always thought that was kinda cool.
Isn't there a law (at least in the US and Canada) that says telemarketers must make the call with real callerid information supplied?
Anyone have Darl's phone number?
Jepson claims the service will charge a twenty-five cent connection fee for each call, and seven to fourteen cents per minute.
Hopefully this will deter the telemarketers. That's my biggest fear.
Its a copy and paste from theregister.co.uk.
i d_ falsify/
http://www.theregister.co.uk/2004/08/30/caller_
Now the neighbor's kid can activate my credit cards he stole from my mailbox without breaking into my place to use my phone line.
Phone customers with 800 and other toll free numbers get the caller's number delivered via ANI (automatic number identification), which is not CallerID. I suspect that this service will not change the ANI, as ANI is much harder to block than CallerID.
Please don't tell me you still trust the government...
make the service available only to licensed private investigators ...
Yeah, right. Hey, I write out the check and I'm a licensed private investigator. Who the heck ever determined that this should ever be legal, for any entity.
A feeling of having made the same mistake before: Deja Foobar
As Kevin Mitnick pointed out in his book The Art of Deception, anyone with a PBX system can program their outgoing Caller-ID information to show anything they want.
As far as star38.com goes, I wonder what purpose they hope to serve by doing this. After all, it's a free service, and as we all know, nothing in this world is free. Could it be that star38.com will sit in the middle and record these conversations, either to sell prank calls a la The Jerky Boys? Or, maybe they'll gleam little bits of information about people and sell that marketing information to companies?
Overrated / Underrated : Moderation
All my calls go to the answering machine...
I need a service like this, to make my CallerID more accurate. I have a VoIP landline and a mobile phone, with two different numbers. The landline rings my mobile simultaneously, at no charge, so I distribute only that phone#, and answer whichever phone is nearest - I'd prefer the mobile# remain undisclosed, to funnel all calls through the landline#. But when I initiate calls from my mobile, the recipient gets only the mobile#, which they might call back directly, insert into their contacts list, etc. But incoming calls on that mobile# won't ring my landline (although a less robust service for the mobile has a charge, while the landline multiringing doesn't). So I'd like to spoof the landline# when making mobile calls.
One way to do it would be to call a service at my VoIP landline, authenticate my mobile# CallerID, and replace the call to the actual recipient, from the landline with the landline# sent in CallerID. A better way would be to learn from email, and include both a "From:" and a "Reply-To:" field in the sent CallerID metadata. This service is a step in the right direction.
--
make install -not war
Unless they figure out who all my friends and family members are. I don't answer the phone if I don't recognize the number. My current phone number is one digit off from the local KFC, so I get a half-dozen calls every day that I don't answer.
The more advanced and complex our communication systems get the more confusing and time-consuming and frustrating it becomes to communicate. It's odd how many people I know that will send emails to people, or chat online, but barely talk to people in person -- or at least with any real depth. The more "advanced" our communication, the more time we spend dealing with all the problems of communication that crop up (spam, caller id spoofing, junk mail, etc.)
I know this whole group of people who are barely seen by other people and do nothing but communicate with random people from all over the world on a website.
Oh wait... damn ... nevermind
Why would a website want to offer this kind of service and put themselves in legal jeopardy?
And could traditional phone companies block them the way spam is blocked, to say anything originating from their service is blocked? I hope the telemarketers don't start using this kind of system. I am on the do not call list, and suddenly the number from which telemarketers call has switched from USA numbers to numbers located in Canada.
Reminds me of the day when I receaved a bill for $100 for a mag subscription to a sports mag I never wanted.
(Not a sports fan)
They identified themselfs and I contacted a laywer who was apparently handling a class action lawsute against thies people (not the dept colection agentcy but the people they were colecting for) for fraud.
Dept colection agentcys should not be alowed to hide who they are (or who they work for) for this reason.
I don't actually exist.
My state has laws saying if you tell a creditor to stop calling and only communicate with mail, they have to honor that. Yet I know people with bad credit, and the phone rings with "Unidentified" in the caller ID. He is pretty sure it is the collection agencies because it happens all day long, at least once every other hour. About every 10th one of these unidentified calls is a recorded message saying "call 1-913-xxx-xxxx" or some number like that.
How can collection agencies circumvent the law? How can someone prove it is them?
I would simply go back to an answering machine that screens my calls and pick up the line when I recognize the voice, as I did before CallerID.
Cheers,
Erick
http://www.busyweather.com/
No, it doesn't. This has been possible for YEARS. Normally it would require the use of a very expensive piece of equipment known as a PBX. It's able to display caller-id however they want it to. Notice how when you receive calls from very large companies, the number always comes back as the main line, instead of the individuals desk number? That's the PBX working. This is nothing new, and it's not illegal.
My daughter and her friends figured out a way to do this years ago. Here's the scenario:
Amy is supposed to be having a sleepover at Beth's house, but instead is spending the night with her boyfriend Carl.
Dad calls Beth's house to speak to Amy. Beth says, "Oh, Amy's in the bathroom. I'll have her call you back when she gets out." A minute later, Dad's phone rings, Beth's number displays on the Caller ID, and Amy's voice is on the line. Dad is satisfied that Amy is at Beth's house. Wrong!
What happened is that after speaking to Dad, Beth calls Amy at Carl's house, initiates 3-Way Calling back to Dad's number, then hangs up as soon as Das picks up the phone. Amy (at Carl's house) is on the line, but it's Beth's number on the Caller-ID because that's where the call originated from.
I have gray hair.
So, sometimes, we changed the number enroute so that it would launch a new ticket window instead of a ticket with 20,000 IDs all indexed to the same phone number. We just marked it with a random number that let the techs know this was not their real home phone, and thus, had to ask for a callback number if needed.
We also had hackers that did this as well, like one guy in Vancouver who hacked the ANI so he could make illegal and harrassing long distance calls in the US using a US 800 number that would, in theory, make the call unbillable.
Then there's the mysterious 604 number that people get from time to time...
I don't like the thought of goofballs mucking around with the service either but I can see legitimate uses for it.
Take a look at some of these nifty caller-id features such as "Prevent Your Number from Displaying on Caller ID" or "Caller ID with Anonymous Call Block"
Suppose your phone number is unlisted and typically shows up as "Anonymous" or "Unavailable" to caller ID. Now suppose the recipient of your call has Caller ID with Anonymous blocking. You can't get through or, with some services, you have to leave your name at the tone and hope they pick-up and decide to take your call.
It would serve as a way to make your own number show up when you want it to but otherwise remain anonymous and not defeat the purpose of having an unlisted telephone number.
If you do what you always did, you get what you always got.
Standards for honesty for any method of a collection company presenting itself are very strict. Wording of exactly what can be said is drilled into collectors. You can't claim to be an old college buddy, a cop, lawyer, or anything else to try to get someone on the phone. If you can't tell someone a lie like that, I don't see how telling a lie by caller ID would be any more allowed.
Every time a killer taughted his victim over the phone you'd know right away who John Q. Killer was but, leave it to the MPAA and their crafty ways to secretly fund this anti-Caller ID technology....
-- Thou hast strayed far from the path of the Avatar.
Its not a free service, its 25 cents to initiate the call and 7-14 cents per minute.
I think there's another risk here though, which is less stated. This service is to go live Sept 1st, from the web site. Unless it's on a minimal page after getting /.ed, I couldn't find any link to terms and conditions. What exactly are you submitting to when you use this? Is your information safe? Keep in mind, the call is routed through their system. Right now, until I see T and C which specifically states that my information is priviledged and cannot be listened in on or used against me, I can only assume it will be. They must have some concept of how they intend to make money.
Also, who's liable for the damages WHEN (not if) someone uses it to commit a crime? This company, I can forsee turning anyone over at the drop of a hat. They're going to have a hard time pleading the internet provider's argument that they are merely the conduit (and therefore not liable for the actions of individuals on their networks), since there is little or no use for the system for legal ethical purposes.
This "service" won't last long. This was brought up on a Telehpreak.org conference (shameless plug). There's better ways to do this _with_ VoIP. It's much easier to go down to my local store (with cash), by a pre-paid Visa card with any name I want. Then, use that card to signup with a VoIP server (Voicepulse, Vonage, etc). Then, using the fun of Asterisk, set my caller ID to anything I want. No ANI [it's VoIP], spoofed caller ID, and anonymous.
We actually thought about setting up a similar type of service (more of a concept service, really) to allow CID spoofing. After much discussion, between ourselves and the EFF, we decided that it wasn't a very smart thing to do.
http://www.telephreak.org
Amy was spending waaaaaay too much time in Beth's bathroom. ;-)
Actually, Beth's mother got pissed at the number of 3-Way Calls on her bill, and demamded that I pay for some, since they involved my number -- as well as Carl's.
From that point, it didn't take long to figure it out.
The telemarketing scumbags have been masking their identities for quite some time without this 'service' so I am just finishing yawning over the article, which has a few inaccuracies that I correct below.
The ICLID (Individual Caller ID) field is separate from the ANI field in the SS7 message. Depending on your tariffs you might or might not be able to stuff the ANI field; you almost always can stuff the ICLID field with whatever nummer you want.
What the other end displays is not always consistent across the various operating companies and carriers, so don't go strutting around like you've pulled the wool over everyone's eyes just yet.
Further, the name lookup that you see on your display is performed by the terminating switch (serving you), so you can't spoof that. Of course, if you spoof John Q. Smith's nummer it will usually show his name, unless he is not a subscriber of your local tephone cumpny; in that case you get nuttin and like it. Even that is subject to variations due to interexchange agreements.
All in all, this service does not meet the technical neatness test, can't overcome the stupidity and ineptness of the various carriers, and is just a jolly good way for somebody to make some extra bucks. It's probably easier just to go down to 7-11 and use their coin box and get it over with.
Have fun!
slashdot: A failed experiment.
> Let's not even start talking about all the wonderful social engineering that can now be performed with this great service. "This is Bill Gates. I forgot my password. Give it to me."
It's probably a front for an FBI sting operation, an invitation for stupid criminals to use them as a middle-man in their crimes.
Sheesh, evil *and* a jerk. -- Jade
This spoofing system is a telemarketer's dream for two reasons.
1.) Nearly all telemarketers have their Caller ID blocked because they don't want to actual name to appear in people's caller ID display and thus keep people from picking up the phone.
2.) I pay about $4 a month to have SBC (my local phone company) block all 'Anonymous' calls incoming to my phone. The caller has to leave a message or unblock their number to for call to be successfully connected. This filtering has reduced the number of unsolicited telemarketer calls by over an order of magnitude.
Now, telemarketers can falsely spoof any name and number they wish. They already know my full name and phone number and easily could construct a database of people that are related to me. For example, I could now see my Mom's name and phone number every time a telemarketer calls me. Now both my caller ID and Anonymous caller ID blocking is circumvented. Now I am totally unable to avoid the torrent of calls from telemarketers that has plagued my phone number for years.
This is has to be made illegal.
Chew: You Nexus, huh? I design your eyes.
Roy: Chew, if only you could see what I've seen with your eyes.
They should just change their names...
It just so happens that I share a first name, last name, and middle initial with a convicted felon. Debt collectors and private investigators can't tell from a phone listing that I'm not the same person.
At one point, my house would get several calls a week from debt collectors and private investigators. They would impersonate police officers, threaten legal action, etc...
It became really annoying. Finally, itcame down to this:
- I have a habit of answering the phone in a jovial manner, i.e., with phrases like, "Mort's morgue, you stab 'em, we slab 'em...." Generally speaking, I only get calls from close family, so everyone's in on the joke.
- But one time, I decided to answer "Dominoes Pizza, how may I help you..."
- And the reply was not whom I expected, but the voice of our least-favorite sheriff impersonator. Yes, it was the collection agency. But to my surprise, he played along:
- "Dominoes pizza, eh... I'd like a large pepperoni pizza.."
- Well, I continued to take his order, address, phone number and all. I thanked him and then hung up.
- Turns out, he was across the state in a major city. Still not a problem, though. I looked up the phone number for the local Dominoes, and relayed his order.
- Forty five minutes later, I got a call, "Very funny, wise guy..."
- To which I replied, "Dominoes pizza, may I take your order?"
That was the last time he called.The society for a thought-free internet welcomes you.
try wildgate.com -
sign up for an account and you have the choice in your prefs on what outgoing ID you want...
cost $5.00 or so.
been around for years now.
...they'd go one step further. They'd send the new password directly to his voice mailbox...
Actually there are lots of voicemail systems out there in "idiot mode" that ID the user from their caller ID and wil dump them straight into their voicemail without any authentication.
Feeding that number into this service and spoofing the callers number would theoretically allow anyone access to someone's voicemail should they know the numbers involved.
Feel free to tell Darl to take a chill pill. A number of people have supposedly sent him death threats (just as other wierdos have sent threats to PJ of Groklaw). While I seriously doubt any of those people were serious, Darl is pretty stressed out about them. He has even started carrying a gun and should be considered armed and dangerous. I don't doubt that he'd shoot someone who tried to approach him if he even so much as suspected they might attack him.
c k/index. html
Anyhow, so long as you're not stupid enough to get yourself killed by him, here's all the contact info you could want:
The SCO Group
355 South 520 West
Suite 100
Lindon, Utah 84042 USA
(801) 765-4999 phone
(801) 765-1313 fax
Contact SCO online
http://www.thescogroup.com/company/feedba
Darl C McBride
1799 Vintage Oak Ln
Salt Lake City, UT 84121-6539
Darl's home phone #: (801) 424-2006
Darl's office phone #: (801) 932-5820
Email Darl: darl@sco.com
except it was usually pizza hut answering the phone: "hello, pizza hut" only to be greeted by "uh, hello, this is papa johns"
it was a real treat to listen to the two angry pizza guys, both of whom were insisting that THEIR phone was the one that rang, work out who was the bigger jerk
3 way calling and the "mute" button is the best thing that happened to beeing a geeky teenager.
My opinions are my own, and do not necessarily represent those of my employer.
"Why is it that when we talk to God, we call it praying, but when God talks to us, we are schizophrenic?"
--Lily Tomlin