Caller ID Spoofing for the Masses

lolly72 writes "SecurityFocus has a story on a new U.S. website offering a caller I.D. falsification service. It's called Camophone. It's being advertised in Google ads that appear with search results for Star38.com, which was the the last service to try and make money off caller I.D. hacking. But unlike Star38.com, Camophone isn't limited to collection agencies and private investigators, and it doesn't cost $125 to sign up. Anyone with a PayPal account can use it, and at five cents a minute, probably will. Who do you want to fake out today?"

Comments

Somebody will figure it out

[erick99]

I am assuming that someone will figure out who the owner(s) of this company is/are. PayPal would have some information but even that could be mostly false accept for an actual checking account number. Would a law enforecement agency be able to track down the owners?

I am not a proponent of bigger government but I think that this is something that should be made illegal. Communication is too important to our society. It's one thing to block your I.D., it's a whole 'nother thing to falsify it.

It is most likely a mistake for them to boast of their annonymity. Someone will figure out who they are and I am betting that more than intrepid hacker will take down Camophone's website repeatedly.

We should keep track of this one for a while, it should get real interesting.

Re:Somebody will figure it out

[SnowDeath]

Ever heard of Call-Back security? Any security that is based on Caller-ID is inherently flawed.

Re:Somebody will figure it out

[Anonymous Coward]

Are you kidding me? Falsification or not, the constitution, be it implicitly, grants me the right to annonymity.

Re:Somebody will figure it out

[jessecurry]

We really shouldn't be relying on a service that is so easily spoofable anyways.
It has always been pretty easy to do this from a PBX, now it's just open to the masses.

Re:Somebody will figure it out

[jellomizer]

Good point. Saying I dont want to be track with caller ID is one thing. But giving a false record is open to a lot more abuse. Call some one up threaton then with someone elses number. So that other person will get in trouble. Telemarketers hiding altering their IDs so the call you and not be tracked via their telephone #. This is not a good thing. Being anonymous is different. The person who sees anonymous can make an informed decision to pick up the phone or not. But if the number is altered say their bests friends number but it is a telemarketer then they will pick up the form thinking it is their fried calling.

Re:Somebody will figure it out

[erick99]

Your right to annonymity does not require that you provide a false identity. Then your rights would trample on the rights of the person or entity of whose ID you have stolen.

Re:Somebody will figure it out

[Anonymous Coward]

I am not a proponent of bigger government but I think that this is something that should be made illegal

The kneejerkreaction is to want a law against this. But I am becoming a bigger proponent against government intervention and letting free market sort it out. I can guarantee you that before any law can be drafted that people will change their behavior in relation to caller id. I for one doesn't subscribe to caller id, as I don't care to spend $36 a year just pre-know who is calling me. I imagine that people that use this service will likely cease using it after the fun is over or more people will cease using caller id or caller id, as we know it changes.

No. No new laws are necessary just wait and keep the wobbly knee at bay and wait for the market to clear up. In this case the wallet speaks louder than the pen.

Re:Somebody will figure it out

[Monkeyman334]

Putting a different From: in your email is the same thing as spoofing caller id. If you've been using it as authoritative then you're wrong. The operators at the phone company are making fun of (l)users like you for not knowing that.

Re:Somebody will figure it out

[Anonymous Coward]

You do NOT have a right to anonymity when you call me on the phone that I pay for.

Otherwise, I agree with your statement. Providing false information does trample on my rights.

Re:Somebody will figure it out

[Anonymous Coward]

Your right to annonymity does not require that you provide a false identity.

But your right to free speech does require that you have the right to lie.

If you happen to use that right to lie to commit fraud in the course of business, then you'll go to jail. But that's far from the only potential use of this service.

Re:Somebody will figure it out

[R.Caley]

It has always been pretty easy to do this from a PBX, now it's just open to the masses.

What amazes, and pleases, me is that so many of the people I don't want to answer the phone for withhold their number. If they gave the real number I might answer, but if they withhold it I don't (at least not outside office hours).

Re:Somebody will figure it out

[Tacky the Penguin]

I am not a proponent of bigger government but I
> think that this is something that should be made
> illegal.

I'm not a proponent of bigger government, either.

If someone makes the spoofing illegal, it will still be done. If it is not made illegal, technological solutions will be developed. It would be a no-brainer for the phone company itself to to block the problem. In the case of a VOIP connection, adding a "VOIP" prefix to the caller ID data would help greatly.

In the long run, it doesn't matter much. The traditional phone is going to go the way of the hand cranked phone. Instead of a phone line, we will have a data line. Something like net phone will probably be used. At that point, IP address spoofing and anonymous servers will make any form of non-voluntary caller ID useless. If you want to identify yourself, you can use a PGP signature. If you want to avoid spam calls and the like, you can choose to only answer properly identified calls.

Re:Somebody will figure it out

[ZB Mowrey]

Um.... That makes you a de facto proponent of bigger government. The fact that you disclaim it just shows that you're uncomfortable with the fact that you're promoting big government in a forum where a majority prefer smaller government. ;) See, us small government types know that saying 'this ought to be illegal' can lead to a slippery-slope situation over time. For example, what if this were made illegal, giving us precedent to mandate that all internet transactions provide authentication of the sender's identification? No more anonymity != limits on free speech. And away we go again...

Re:Somebody will figure it out

[Austerity Empowers]

I think no new law is needed. If you are spoofing in order to break the law anonymously, that's already illegal.

This means telemarketers spoofing to get around the do not call list, people spoofing to cause the spoofed person harm etc. This service is not sufficiently anonymous to protect criminals.

Re:Somebody will figure it out

[rasqual]

Free speech implies the freedom to lie, but the number of statutes that punish misrepresentation and, yes, lying, belie ;-) the notion that all lying is protected speech. Furthermore, for my part I'm sick of everything anyone does, anymore, being classified as "speech." All I need to do is claim I'm a performance artist, and anything I freakin' do is protected. And how do I prove I'm a performance artist? By doing something gratuitous and outrageous. Everyone knows no one but a genuine performance artist would engage in the outrageous, inasmuch as only everyone else would be interested in preserving the respectable status quo, whereas we artistes are, of course, obliged to challenge such pretentions. ;-)

Re:Somebody will figure it out

[squiggleslash]

Quite. Despite commonly called "Caller ID", CLI (Calling Line Identification) doesn't even do that. Forget this service: if I call from someone else's phone, the number doesn't ID me in any way.

I do often get surprised at the number of people in computing I know who'll usually make a big deal of defining databases, etc, to refer to distinct entities, and then are perfectly happy to refer to CLI as "Caller ID".

On my cellphone it's the only call screening feature available, but at home, where I have the luxury of chosing a suitable technology for the job, I use a cheap, no-subscription-required, $15 answerphone to screen calls. I always know who's calling using it, and I'm not demanding what's ultimately private information that's none of my business (other people's telephone numbers) before I speak to them. There is no other technology, other than the answerphone, that does what CLI advocates claim CLI does.

Re:Somebody will figure it out

[abulafia]

Furthermore, for my part I'm sick of everything anyone does, anymore, being classified as "speech."

A lot of people seem to feel that way, which is why the constitution is in tatters.

One of the prices of freedom is that other people get to have it, too.

Re:Somebody will figure it out

[alonsoac]

I don't think this should be illegal. It's just the same as if someone went to a pay phone and then said they were someone else. Are you going to beleive everything they say? Would you beleive them just because they have a seemingly real CID?

If someone uses this to do illegal things it's another story. But I feel I should have the right to send whatever text I want instead of the my real number. Just as I can say whatever I want on the phone. It's the other persons problem if they beleive me or not.

On the other hand taking down sites is clearly illegal and a seroius problem globally, but you don't seem to care.

Re:Somebody will figure it out

[BenFranske]

You and a lot of other people just don't seem to understand that CID is really a novelty service. You should not be using CID data for any real level of security. As other have mentioned the ability to write your own CID data is an important PBX function for businesses and call centers that don't want to make all their lines public. ANI data is much more reliable and accurate. I see no problem with services such as these because they should increase awareness in the public of something that has always been true, CID is convenience data and should not be trusted. get over it, if you really need to know who's calling use ANI.

Re:Somebody will figure it out

[BrookHarty]

You do realize, even with call back security, that call center could still be based on a work release center, prison work camp, overseas forwarding. How do you trust the call center reps?

Re:Somebody will figure it out

[EvilAlien]

PayPal would have some information but even that could be mostly false accept for an actual checking account number. Would a law enforecement agency be able to track down the owners?

Sure... a bank account number is a grrreat piece of evidence. They have to access the funds somehow, either electronically so it can be transfered or applied as a bill payment to something, or physically get access. Those provide all sorts of great opportunities to track down the bastards ;)

That evil DMCA thing might be all that is needed to get the investigation and disclosure of information happening, too... good times, good times.

Re:Somebody will figure it out

[tompaulco]

I for one had to spring for the $36 a year for this service so that my wife could tell when she doesn't need to answer the phone, thus saving her from 5 to 10 calls a day from people trying to harass her into giving money. I don't subscribe to the idea of "just don't answer the phone" any more than I subscribe to the idea of "just click delete on the spam". It's my phone, I pay for it, and I should be able to answer it without having to worry about the caller trying to sell me something.
If we socialize the telephone and pay for it entirely out of telemarketer taxes, then they can call me to their hearts content.

Re:Somebody will figure it out

[AK Marc]

It would be a no-brainer for the phone company itself to to block the problem.

It may be harder than you think. If I have a T1 between offices and use toll bypass, I may want 713-555-1212 coming out of 214-123-4567 so that they can reach me back properly. I may want to have different numbers for outgoing call centers from incoming call centers, and they may be in different parts of the country.

It would be technically trivial for phone companies to fix the problem, but many large companies would be very annoyed, and you don't want to piss off your bigest customers.

Re:Somebody will figure it out

[rasqual]

Are you being disingenuous? Not everything defended as exercise of first amendment rights is genuine "speech." This should be obvious to anyone familiar with either the absurd or almost-reasonable-sounding cases that have been through the courts.

For example, in the reasonable-sounding department, in December of '99 the USSC found (7-2) that a state can squelch the commercial use of some public records. A California law makes police records available to journalists and private detectives, but proscribes commercial use. Facing an argument that this was in violation of free speech, the court disagreed, arguing that the use of such records is not "speech" (I won't go into their reasons).

Less reasonable was the case of a man in South Carolina, who violated state law by tattooing without a license (a health issue in the state). He argued that his indictment was wrongful on a couple grounds, one being that the law suppressed free speech. The appelate [federal] court ruled that tattooing is not "speech."

I poked around a bit, and there's a ton of case law on this. And then there's the longstanding -- and admittedly besieged -- notion that obscenity is not protected speech. Like it or not, the USSC has upheld this. And we all know the SC is the law of the land. :-/

Now if "a lot of people seem to feel" the way the courts also rule (namely, that not everthing defended as free speech actually is), isn't that a good thing?

I'm not running around suppressing other people's free speech. But I'm glad that courts are ruling responsibly in tough cases (such as the first, above) and ridiculous cases (such as the second, above). It's ridiculous to claim that they do so because they "feel" as if other people's rights don't matter. The question is what the constitution is protecting, and on the other hand what it never intended as cover for bad arguments by people trying to evade justice on other issues.

Re:Somebody will figure it out

[bleifuss]

...the constitution, be it implicitly, grants me the right to annonymity. You're up in the night! Show me where in the Bill of Rights or in an Amendment there is anything about a right to anonynimity. I've never even heard of that concept. This problem with this service is not that it provides anonynimty. Individuals can still ask to not have their number and name transmitted when they make a call. My mother does that. There is your "right to anonynimty". This service provides a means of fasification. Just think of the Phising potential with such a service. I think it would most definitely be overthrown by the courts. They supported the do not call list. I imagine they will support any litigation against this as well.

Re:Somebody will figure it out

[Carnildo]

I assume by "USSC" you mean the United States Supreme Court? The normal abbreviation for it is "SCOTUS": Supreme Court of the United States.

Re:Somebody will figure it out

[Bill Dog]

If we socialize the telephone and pay for it entirely out of telemarketer taxes, then they can call me to their hearts content.

There's an interesting thought (I'd use a mod point if I had 'em at the moment). Except then if they were paying for it, they'd definitely want to feel like they were getting their money's worth, and would end up saturating the system with their calls, thereby killing it off as a communication medium, as then everyone would just unplug their phones and cancel their service. I don't see how everything can't eventually end up white-list only, whether it be phones, email, whatever, as the boundaries of "acceptable" intrusiveness are pushed farther and farther.

Re:Somebody will figure it out

[rasqual]

Oh, I dunno that it matters so much. But the EDUs tend toward USSC, I note:

http://snipurl.com/a53k
http://snipurl.com/a53m

And there's someone else that uses USSC somewhat exclusively:

http://snipurl.com/a53p
http://snipurl.com/a53q

;-)

Re:Somebody will figure it out

[Forthan Red]

You don't need this to spoof calls. Your phone company will gladly supply everything you need. All that is required is the add-on services of call forwarding, and call management. Used with a second phone (your cell works fine), it's a simple matter to make your caller ID appear to be any number you want.

Re:Somebody will figure it out

[arminw]

It seems to me a phone spammer or bill collector still would have to know who the trusted friends are whose number they might fake. If I would get such a faked phone call, where the number the caller ID told me it was a friend or relative and it was really a spammer, I would immediately and without fanfare very rudely hang up. Any caller coming up as unknown or some suspected solicitor, right now gets only the answering machine which sends the first 10 seconds to the loudspeaker, if the caller leaves a message. If it someone I want to talk to, I pick up the phone myself.

Re:Somebody will figure it out

[jessecurry]

One gives birth to two, two gives birth to three, three gives birth to all things...

Re:Somebody will figure it out

[abulafia]

Are you being disingenuous? Not everything defended as exercise of first amendment rights is genuine "speech." This should be obvious to anyone familiar with either the absurd or almost-reasonable-sounding cases that have been through the courts.

You know, I did write out a response to this, with complicated legal reasoning on your points. I lost it, when I rebooted, (I thought I posted it). But coming back to this, I see the fundamental disagreement: you seem to believe that what the courts say should be law, no matter what. I believe, on the other hand, that if laws stop making sense, then they should be ignored. I suppose this is probably the fundamental disagreement.

For the record, I was being just a little disingenous, but this is slashdot. And actions are speech, whether they are me doodling on paper, someone's back, or blathering on a soap box. Sorry if you don't like that.

The best way to tell if someone supports free will is to see if they follow the statement up with the term, 'but'.

Re:Somebody will figure it out

[rasqual]

I don't believe that what the courts say should be law, no matter what. I note your magic word "should." Nor do I believe that everything that's legislated should be law. But I do believe that not all acts are protected rights, and frankly that's a rather self-evident thing.

The logical terminus of your implications, since "actions are speech," is that all actions are defended by the first amendment. Since we know that's not true, neither are your premises.

All speech is a right
All actions are speech instances
Therefore, all actions are a right

But not all actions are exercises of rights (to the contrary, some are abridgments of rights) Therefore, at least one of your two premises must be false. Either not all actions are speech instances, or not all speech is a right.

Which is pretty much my point. The only thing I "don't like" is unsound thinking on the matter. As for support of free will, all freedom has limits. I am not free to both live and die, to both endear myself to and alienate myself from someone, to both act and refrain from acting, to both speak and to remain silent (unless we're going to engage in equivocation, in which case we might just as well say "Hitler," evoke Godwin, and be done with it ;-)

do this for free

[Prophetic_Truth]

you can already do this using an asterisk pbx and a VoIP provider. Although once this starts being abused I doubt it will remain a feature.

Re:do this for free

[exhilaration]

You can do this with just about any PBX. And they'll never remove this feature because call centers make heavy use of it.

Re:do this for free

[DarthBart]

Assuming your VoIP provider lets you set caller id. We've started implementing filtering that only allows you to set your CID to one of the DIDs that are assigned to you.

Re:do this for free

[DarthBart]

But, again, your provider has to support this. Some providers allow you to set CID/ANI to anything. Others limit you to certain numbers.

Re:do this for free

[ncttrnl]

This is necessary in alot of setups as not every phone has a DID (direct inward dial) that allows it to be called from outside the PBX. This feature isn't going anywhere.

Re:do this for free

[Lumpy]

for about 3 weeks back in 1999 I had the new PBX here reporting our outgoing caller ID information as "Touch my Monkey"

we were setting it up, messing around and forgot to set it to the company information after we put it online.

The Director of sales was, for some strange reason, not amused.

Re:do this for free

[rmarll]

"for about 3 weeks back in 1999 I had the new PBX here reporting our outgoing caller ID information as "Touch my Monkey"

we were setting it up, messing around and forgot to set it to the company information after we put it online.

The Director of sales was, for some strange reason, not amused. "

That explains why the salesman refused to talk dirty to me. I thought it was just an agressive 976 campaign.

Re:do this for free

[RichDice]

I've got a story like that, though perhaps a bit more grim than funny. (Though maybe funny too.)

The hackers in my company were not given any test data to work with (of course) in a particular web app we were building, which had (among other features) an online events calendar.

So, the hackers would make up data themselves. Which led to some fairly off-colour events being entered into the events calendar database.

At a client acceptance meeting, the project manager demonstrated a "show all events through the web" feature and was presented with (among other things) a "baby raping festival".

We were given a policy on test data creation after that.

Cheers,
Richard

Re:do this for free

[jerde]

> Some providers allow you to set CID/ANI to anything

CID, yes. ANI? Are you sure?

Since ANI is used for billing purposes, including 900 numbers, I highly doubt any telco allows it to be modified.

Camophone sets CID, but the ANI is the number of the line that belongs to Camophone. (Or whomever their telco provider is)

Given that, it really really surprises me that anyone bases security on CallerID. I just successfully broke into my own t-mobile voicemail box using camophone, since I have the feature set so i don't have to dial my password if i'm calling from "my own phone."

I also have a sprint phone, and I haven't been able to get in there, yet, but I don't know their voicemail system direct number, so I can't be sure. (I had to use the direct access number for tmobile to get the hack to work on them)

I would HOPE that creditcard activation systems use ANI, not CID.

How soon before ordinary plebes will be able to get ANI on their incoming calls? Or a new service that lets you forward your calls to an ANI-detection center that then places ANI on CID and sends the call back to you!

I see some Sneetches whose bellies have stars...

Re:do this for free

[gstoddart]

for about 3 weeks back in 1999 I had the new PBX here reporting our outgoing caller ID information as "Touch my Monkey"

we were setting it up, messing around and forgot to set it to the company information after we put it online.

That's because all Monkey Touching at the corporate level is strictly reserved for sales people and other wankers. ;-)

But, if *I* had call display, I'd certainly be intrigued by such an item displayed on an incoming call.

Re:do this for free

[Your_Mom]

I would HOPE that creditcard activation systems use ANI, not CID.

No, they usually don't. They usually use the CPN (Calling Party Number), which is not /supposed/ to be able set by the end user, but can be in certain circumstances with certain VoIP providers.

Like you said, ANI is the Telco's billing number, it is just usually the same number at yours.

Re:do this for free

[kgasso]

> CID, yes. ANI? Are you sure?
>
> Since ANI is used for billing purposes, including 900 numbers, I highly doubt any telco allows it to be modified.


I have a 23-channel PRI here from a local CLEC (utilizing it for inbound local DID numbers and toll-free DNIS numbers as well as outbound calls) who lets us not only stuff our own CID, but sends that as the ANI as well. Not sure if they even know they're doing this, although we have a pretty good standing business relationship with them, and we have no intent of using it for "evil" purposes.

(We utilize sending outbound CID for sending the DID # of individual extensions behind the PBX, as well as the primary number of the "account" we're calling for... we're a call center for several ISPs. It's also useful for call transfers/routing from our PBX, as the original caller's CID shows up when we transfer.)

The PRI that I have running into the same PBX from the ILEC (Qwest) only sets the CID, as expected.

It's not overly hard to forge your ANI; it just takes some legwork and potentially a wad of cash. There is still an audit trail at the ILEC and CLEC switching facilities, too. I suspect if they start getting complaints about things being billed to wrong numbers, it's not hard to find out which one of your interconnects did it.

-k

Re:do this for free

[DarthBart]

>> Some providers allow you to set CID/ANI to anything > >CID, yes. ANI? Are you sure? > >Since ANI is used for billing purposes, including 900 numbers, I highly doubt any telco allows it to be modified. Yup. I have access to a DS3 worth of PRIs from Radiant and Global Crossing. I can set ANI on them to anything I want to all day long. I've also got direct access to CLEC's switch with an SS7 interconnect. I can do pretty much anything I want to. It could, eventually, be traced back...so I don't. The only thing "questionable" I did was light up 4 PRIs worth of calls to the 800 numbers set up for voting for American Idol. I wonder how far I skewed the numbers.

Re:do this for free

[LiENUS]

According to my provider, itc^Deltacom, a recent fcc regulation makes it so not just anyone can set the cid information, they wouldnt let us change all 6 lines to say the same number (the main line) despite the fact we had just purchased a T1 from them for the phone lines...

Re:do this for free

[FunkyMarcus]

I also have a sprint phone, and I haven't been able to get in there, yet, but I don't know their voicemail system direct number, so I can't be sure. (I had to use the direct access number for tmobile to get the hack to work on them)

Try your own telephone number, replacing the last four digits with 6245 (MAIL).

Most cell phones also take you straight into your voicemail if you call your own number. Using this CID trick, can you just hit voicemail without knowing the backdoor?

Re:do this for free

[Anonymous Coward]

Did he touch your monkey?

Re:do this for free

[Patersmith]

In Canada, at least, you cannot see or set ANI digits unless you are an intra-LATA carrier. It's a safe assumption that the same holds true in the USA.

The poster a little farther above is also correct that call centers heavily depend on being able to set CLID digits. By law you have to set the client's contact number on the outdial, which makes this feature critical if you're calling on behalf of a number of different clients on the same trunks. Tantacomm sells a device that does just the trick. All you need is a properly provisioned PRI.

I would think the same should be possible with the right combination of hardware, software, and a plain old ISDN BRI. Sounds like a fun open source project to me.

Matt...

Re:do this for free

[cjsnell]

The hackers in my company were not given any test data to work with (of course) in a particular web app we were building, which had (among other features) an online events calendar.

God forbid you show some common sense and input some non-offensive events like "Jane Doe's Birthday"...

Re:do this for free

[serutan]

Or, fill a paper bag with dog shit, light it on fire on someone's porch, ring their doorbell and run away.

Doesn't Work

[The_Rippa]

I signed up for the service while this article was still in the mysterious future. Tried it out, didn't work.

I got to file my first Paypal dispute claim!

Seriously though, the website is just text and there's no contact info for anything.

Scam.

Re:Doesn't Work

[onion2k]

You paid money to a company you had no details of?

Err.. I've got this bridge for sale..

Re:Doesn't Work

[The_Rippa]

It cost five bucks, so I figured I'd give it a spin. It'd be good to use to play pranks on friends and family.

I'm not concerned about the five bucks, but if Paypal can get it back then more power to them.

Take off the tinfoil cover off your checkbook.

Re:Doesn't Work

[redJag]

How do we know this is really The_Rippa posting??

Re:Doesn't Work

[Anonymous Coward]

Take off the tinfoil cover off your checkbook.

worst advice ever.

Re:Doesn't Work

[matth]

Didn't work? Really.. worked great for me.. I just made about 4 calls testing.

Re:Doesn't work

[OmegaGX]

Actually - it does work. The first time I put in 911 and I guess it automatically blocks that for all sorts of legal issues of impersonating police. But any other number works great.

Re:Doesn't Work

[mskfisher]

Did it really work for you? I was just assuming it was slashdotted, so I was going to wait and try it later.

Re:Doesn't Work

[Anonymous Coward]

You want your 5 cents back, I'll give you 5 cents. Just give me your mailling address.

Re:Doesn't Work

[matth]

Yeah.. I've made several calls on it now to friends.. both trying it out and showing them.

Re:Doesn't Work

[NineteenSixtyNine]

I think "Oh, we let little Joey stay over with that nice Michael Jackson all the time. Go ahead, send your son right over!" pretty much tops that.

Re:Doesn't work

[jerde]

It does that for me with any 10 digit callerID.

I've found that with my business's T1 PBX, too... I did some tests with the CID set to "123" -- and it worked fine for local calls. But all long distance calls would fail, fast-busy.

My guess is that the wider telephone network doesn't pass through obviously invalid CIDs, and anything other than 10 digits is invalid.

Re:Doesn't Work

[That's Unpossible!]

I tried it, but the number came through to both parties as 425-789-4268, not the number I had selected (123-456-7890).

Re:Doesn't work

[rs6krox]

I wonder how many calls that number is going to get... This is a BRILLIANT idea! Just post the phone number of some enemy, ex-wife, or coworker on Slashdot and watch the fun!

Re:Doesn't Work

[HundredthMonkey]

This happened with one number I tried, but the others work as advertised. So far I'm pretty happy with the service. I wonder if 425-789-4268 is the number from which the call is bridged, and I wonder if that would be a good way to start tracking down who runs this thing. Or at least where the run it from.

Re:Doesn't Work

[ZeroGee]

That maps to Everett, WA (CLEC) according to thedirectory.org. That's based on 425 - 789. If this is in fact where the company is based, this is some fun detective work...

Oh no!

[mconeone]

Now we will have scammers blackmailing businesses with the threat of sending falsified phone calls to the general public.

Not sure why this is needed...

[Anonymous Coward]

...since caller ID doesn't work half the time anyway.

It's just a web-site

[Nom du Keyboard]

It's all run off a web-site. Just DDoS it.

Or /. it!

Re:It's just a web-site

[tcopeland]

Running an outdated version of Apache 2.0, too:

[tom@hal tom]$ curl -sI http://www.camophone.com/ | grep Serv
Server: Apache/2.0.48 (Fedora)
[tom@hal tom]$

Re:It's just a web-site

[Anonymous Coward]

your sig should really add a step 5 : "do it". Cause otherwise, you'll keep looping over the same problem.

Re:It's just a web-site

[Nom du Keyboard]

your sig should really add a step 5 : "do it". Cause otherwise, you'll keep looping over the same problem.

Not that most people don't loop over the same problem continuously, however step 5 was lost to the Slashdot 120-character limit for sigs.

Did Camophone get advance notice?

[YetAnotherName]

Of the /. story, that is? Their website is currently up (this posting will probably be the 10th or so), but is surprisingly minimal. No images at all. Plain, unadorned HTML. Not even a CSS file.

I have a feeling they'll withstand the slashdotting.

Re:Did Camophone get advance notice?

[Anonymous Coward]

That sounds like a challenge.

Telemarketing

[Ambient_Developer]

This could make telemarketing nearly untraceable, a company just uses a call center that utilizes this technology, and people will never know where the phone call is coming from. Imagine getting a phone call from a telemarketer, and it says 911 on the caller ID.

Re:Telemarketing

[erikharrison]

It already does make telemarketing diffcult to trace. Those telemarketers who call you do not, I repeat, do not work for AT&T or whoever else they are selling products for. They work for a telemarketing firm (which, by the way, are dying out. They're being purchased by legit incoming call callcenters). If you get a call and it says that it is from BellSouth, and you get a telemarkter (for example, BLS has a strict no telemarketing policy), then you are seeing a falsified id.

Re:Telemarketing

[gebbeth]

This could make telemarketing nearly untraceable, a company just uses a call center that utilizes this technology, and people will never know where the phone call is coming from. Imagine getting a phone call from a telemarketer, and it says 911 on the caller ID.

Yes, but if this costs 5 Cents per minute, it will probably create a significant overhead to an industry that relies on mass communication. It would probably be prohibitively expensive. This is also probably besides the point being that anyone with their own PBX and PRI lines to the telco (something that I am sure that mass marketers have) can forge their own caller-ID. This was the whole point of recent legislation prohibiting this behavior.

Re:Telemarketing

[Snowdog668]

Do we know where it's coming from now? Most of the telemarketing calls I get are either "blocked", "personal", "California Call", etc.

Hell, even my local state senator came up as "Unknown" on the five, yes five, times I've been called in the last eight days by her campaign.

Telemarketers I can see hiding their identity because they are the scum of the Earth but isn't the purpose of campaigning to get your name before the masses?

Hell, I'm voting for her apponent anyway. Of course as a political campaign they don't have to honor a "don't call this number again" request. They also don't care if I have a telezapper. Every time they call my response has been "nope, still voting for the other guy, like the last (x amount) of times you called". I would hope that eventually I would get off their call list (I'm registered with the other party, by the way). I guess one way to look at it after November 2nd, I will be, until the next time. :)

Re:Telemarketing

[Methuseus]

As long as you're registered with the other party, or not registered at all, they will keep calling you til election day. They don't care as much about the die-hard supporters as they do about converting the other people. Plus, the fact that you said no makes them call back more, just like a child who won't stop saying "please mommy" in that annoying ass voice when they want candy and you don't want to give it to them.

Re:Telemarketing

[Anonymous Coward]

Keep them on the phone as long as you can. Ties them up from making other calls. Pretend to be intently interested in what they have to say. Tie up your opponent's resources as much as you can :)

Re:Telemarketing

[Snowdog668]

I've done this before with regular telemarketers when I had time to kill but this person is so polar-opposite of me on the issues that I would just feel sooo dirty by the time I got off the phone.

Re:Telemarketing

[Anonymous Coward]

Then say something like "hold on, let me get him/her" and then just put the phone down and walk away. Check back every so often until the telemarketer hangs up. Of course, you don't want to do this if you are expecting a call, but it is a way to keep them on the line without actually talking to them.

Re:Telemarketing

[TheMysteriousFuture]

Oh brother. Mod this idiot down please.

EVERY SIGNLE CALL CENTER OUT THERE with more then 20 people *A L R E A D Y* is capable of setting *AT LEAST* their CallerID Number, AND ANI.

FOR FREE. (No extra charge over the cost of their normal PRI circuit and LD. Which by the way they are probably paying something under 1c/minute)

MOST of the larger call centers are ALSO capable of setting their CallerID *NAME* using a signalling protocol known as SS7.

Re:Telemarketing

[Anonymous Coward]

And given that this is Slashdot, there's a good chance that you actually are voting the Communist Party all the way!
And it probably doesn't piss off the DNC when you tell them that, as many of them can sympathize.

Glad

[alatesystems]

I'm glad this happened. I am so sick of people using Caller ID as an authentication mechanism. It has been so easy to spoof if you had connections before and is even moreso now.

My cell phone doesn't even require a password to get to my voicemail because it uses caller id. Every credit card I've activated required me to call from my home number, verifying it with caller id. When I order pizzas, they verify I am who I say I am with caller id.

It is ridiculous and is worthless as an authentication mechanism. Its only use is a convienience, to decide if you want to answer the phone. Lesson: don't rack up bills you can't pay :)

Anyway, it's always nice to have another way to screw with your friends' minds.

Re:Glad

[Anonymous Coward]

Hold on a second here. You have just finished explaining that your Credit Card company uses caller id to verify who you are when you call. Then you say you are glad this happened. Listen to yourself. (And me, gimme your phone number.)

Re:Glad

[JUSTONEMORELATTE]

You're mixing callerID (in the case of "voice mail access without password") with ANI (in the case of credit card activation)
CallerID is spoofable, but ANI info is not. Any time you call an 800 number (or 888, or 877, or any of the other variants that are out now) your info is sent prior to the first ring. This is ANI (Automatic Number Identification? It's been a while. I'm sure someone will correct me if I've got it wrong :) You can't disable this with star codes, or with the "Private Name" feature of callerID blocking.
CallerID, on the other hand, can be enabled or disabled, and can be spoofed.

Easy way to remember -- who's paying for the call? If it's you, then it's callerID. If it's the other guy, then it's ANI.
--

Re:Glad

[msblack]

Credit card companies and toll-free numbers use ANI (automatic number identification) which cannot be easily spoofed.

Re:Glad

[alatesystems]

I'm saying I'm glad it happened because maybe they'll _STOP_ using it as an authentication mechanism!

Also, apparently I know nothing about how the US telephone system works, because I see people talking about ANI and SS7 elsewhere and I don't know what they're talking about.

Maybe it is more secure than I perceive.

Chris

Re:Glad

[Methuseus]

The whole cell phone thing can be done because they also check to see if the call is coming from their own network. If you tried calling from your home phone with some sort of Caller ID spoofing, it would still reject the call since it can tell that you are not calling from a wireless phone.

Re:Glad

[Paradise Pete]

Its only use is a convienience, to decide if you want to answer the phone.

And I can see calls I missed.

Re:Glad

[cmburns69]

The theory behind this is that since the person who owns the 800 number is paying for the call, they have a right to know who is really calling.

Re:Glad

[leob]

You are dead wrong at least about the credit card companies. When you call an 800 number, it uses ANI identification that cannot be spoofed unless you run your own phone company, not Caller ID. When you call from a cell phone, the cell phone carrier has to identify you by your phone of SIM card before they decide what caller ID to send out in the first place.

Re:Glad

[narf]

I can tell you that's not true with T-Mobile in the bay area. I've set my own calling party number (caller-id) using my company's PBX, and it lets me into my T-Mo voicemail.

Re:Glad

[muzzmac]

Does anyone know how it works in Australia?

Do the same ANI/CallerID features apply?

Re:Glad

[flaws]

Eh, wrong: Most 8xx numbers use ANI as a secondary process, not as a primary. If caller-id is blocked, yes it reverts to verifying with ANI, otherwise it trusts Caller-ID. 3 systems alone I can point out that do this. Ureach.com, Callwave.com and Buzzme.com - and of course, most credit card agencies do this too.

What's there to lose?

[jtmas83]

With such a professional-looking website I can't see how this can possibly go wrong.

Re:What's there to lose?

[ganiman]

Agreed.

I can make a website claiming that just by putting your paypal info in here, beautiful women will immediatly be attracted to you for just 5 cents a minute. Really, I can do that.

Re:What's there to lose?

[SilentChris]

On the other hand, it's very hard to slashdot a website without graphics.

Re:What's there to lose?

[Luke-Jr]

Yea, too bad all companies/organizations don't use such simple websites...
Seriously, simple isn't neccesarilly a bad thing.

Re:What's there to lose?

[R.Caley]

Someone should tell them they need to get a pointless flash front page or no one will take them seriously.

Re:What's there to lose?

[Anonymous Coward]

I'm just not sure about a website where you can easily login using any login name and no password, too bad there arn't minutes to use!

Phone Call From:

[xThinkx]

Hey the caller ID says Oliver Klozoff...

Re:Phone Call From:

[DarthBart]

You can't spoof CID Name. Your local phone company dips into a database when it gets the ANI/CID from the incoming SS7 signalling. Actual CID name isn't transmitted in the SS7 setup.

Creepy!

[JUSTONEMORELATTE]

As I was reading this, my phone rang and callerID read:

Out Of Area
1-000-000-0000

So which one of you smartasses is messing with me?

Re:Creepy!

[Anonymous Coward]

So which one of you smartasses is messing with me?

It wasn't me. I had a phone call from President Bush!

Re:Creepy!

[rob_squared]

Seriously, I've gotten that number several times. And I'm not popular/unpopular enough for anyone to waste their time like that.

Re:Creepy!

[Anonymous Coward]

Out Of Area
1-000-000-0000

I've gotten "Unknown 1111111111" -- it was a recorded message urging me to vote for Kerry. I have no idea where they were calling from, and I had already sent in my ballot for Badnarik.

This is old news.

[Anonymous Coward]

as old as the Hot Grits in Natalie Portmans' pants.
and Natalie, baby... I wanna heat up your GRITS!

In Soviet Russia...

[radish]

...911 calls you!

Re:In Soviet Russia...

[schovanec]

This actually exists.

Doesn't work

[OmegaGX]

The call shows up to be from 425-789-4268 - it doesn't show the Caller ID info that I put in. I guess I'll have to file a Paypal claim too.

OpenVoIP

[Doc Ruby]

These services are the harbinger of a dazzling array of VoIP services just over the horizon. Today's telcos need millions of customers to want any given feature before it's worth their while to roll it out, because of their monolithic architecture. While a VoIP service can be plugged into the VoIP pipeline by a startup, putting their feature server on the Neb, and accepting connections through open, standard protocols. Anonymizing or spoofing are just the kind of TCP/IP services we'll see. And since the infrastructure is much cheaper, and more competition can get started globally, the prices for niche features will be much lower than the rates for voice provisioning itself.

Can't wait..

[HanShootsFirst]

to get a call from Jack Mehoff.

Re:Can't wait..

[Red Weasel]

That is the actual name of a DJ here in Colorado Springs. His parents were from Europe( Hungary I think) and his name is really pronounced like "jock".

Needless to say the radio contests like "Beat Mehoff!" and "Can you jack Mehoff?" where widely considered rude until they found out that that was his real name and to get a life.

It was still nice to see "Mehoff the intern" become Jack Mehoff the DJ.

Asterisk, Nufone and PHP...

[cuban321]

This company is probably nothing more than someone running Asterisk, using Nufone for the PSTN service.

A simple php script will dump a callfile into /var/spool/asterisk/outgoing and bridge the two calls together.

Then all you need to do is write something to manage user accounts, and accept paypal payments and bam. You've got camophone.com.

This whole configuration could probably be whipped up in a day.

Re:Asterisk, Nufone and PHP...

[the_weasel]

That doesn't make it less interesting that someone has chosen to do so.

Re:Asterisk, Nufone and PHP...

[Anonymous Coward]

Parent is correct. This is FRIGGING *TRIVIAL* to do with Asterisk. OR ANY OTHER MAJOR PHONE SYSTEM THAT USES PRI FOR THAT MATTER.

I also signed up...

[daveschroeder]

Figured $5 through PayPal (and yes, it really was PayPal, not some spoofed tab or scam site) was worthwhile.

However, even though their FAQ said it would be ready in 30 seconds, my account still shows zero minutes. Don't know if that's because PayPal takes a while to do the transfer, but I wasn't about to use a credit card with them.

For what it's worth, their "Privacy Guard" service page looks like this:

Camophone.com Home | Login to Privacy Guard | Frequently Asked Questions | Signup for Service

Logged in: das
Time Remaining in Seconds: 0
Time Remaining in Minutes: 0
Recharge Account

Enter all phone numbers without a leading "1" and with no dashes or spaces. Example: 9095551212
Caller ID must be ten digits to be passed properly through the telephone network. When the system calls you, the caller ID you set will be sent to you as well.
number to call [recipient]: (format: NPANXXXXXX)
your number [caller]: (format: NPANXXXXXX)
caller ID to send:

Re:I also signed up...

[Fweeky]

If you paid using a bank account, you sent what PayPal call an eChe{que,ck} which will take a few days to clear. If you didn't use a CC, and didn't have a balance with PayPal, that'll be why.

That PayPal don't make this clear to you is a small demonstration of how much they suck.

Re:I also signed up...

[radish]

That used to be true. They have a new service now, provided you have a card on file with PayPal. It will make the payment straight away, like with a CC, and will try to charge your bank account. In a few days, if the bank account transfer fails, they will bill your CC instead.

Billing systems gone bad

[Anonymous Coward]

This is actually really easy to do on any switch with a PRI line. The originating switch is responsible for sending out the calling line. This is why sometimes you see just extensions, or 0 or nothing when you get a call from a compaany's PBX. The funny thing is that some phone companies are still using the number sent out for billing records. This is where it gets into fraud. I know as recently as last year, if you spoofed the caller ID, Qwest (in Utah) would bill the call to that number. Although, there is nothing funnier than making the Whitehouse (202-456-1414) shouw up on a caller ID! I guess I better post this anonymously now that I said that :)

As a

[Anonymous Coward]

...as a starving college student, managing a pizza hut, I have to say.... SHAME!

Re:As a

[tvh2k]

As an anonymous coward, to you I have to say SHAME!

About time

[blether]

Caller id is provided by the originating PBX and has always been unauthenticated - that's why this service works. If you choose to withhold id, the system sends your id anyway along with a flag saying "please don't display this."

The system has been broken for years. Now that's it's easily abused, maybe it will get fixed.

Doesn't say anything about Linux support....

[xiando]

Then again GnomeMetting and calling cards from Linuxjack.com pretty much gives us spoofing anyway. Not that the phone number is spoofed in any way, it's just that it changes once you've used up your calling card and buy another one.. Personally I've assumed this to be a bad thing, but I do see the value with all this talk about caller id spoofing....

Don't talk to strangers

[Doc Ruby]

Why do we need the government, when our address books can authenticate the caller cryptographically? Unfamiliar callers should all be treated as untrustworthy until proven otherwise. That can be established through an automated web of trust, and callback, or shunted to voicemail or /dev/null. Distributed software is much better protection than the FBI, much cheaper, and doesn't come with dirty stormtrooper boots muddying up your foyer.

Re:Don't talk to strangers

[LiquidCoooled]

You need the government in this case because the person dialing the number can impersonate any of your already trusted numbers.

Ring Ring.

"Ahhhhh good its my girlfriend...Hello......."

Re:Don't talk to strangers

[Doc Ruby]

It depends on which "numbers" you trust. I'll trust CallerID "From:" fields when they're cryptosigned and authenticated from my contact list, with keys exchanged during a previous call, or beaming in person, etc. Spoof that!

Re:Don't talk to strangers

[jrockway]

[fake voice]
Hi this is Joyce, your girlfriend. My keys got compromised so here are the new ones. I love you honey.
[/fake voice]

0wned.

Re:Don't talk to strangers

[Doc Ruby]

[my voice]
Hi, Joyce, I just got a funny voicemail from you. Sorry my phone didn't recognize you since your keys got compromised, but I'm calling back as soon as I could.
[/my voice]

[Joyce's voice]
I didn't leave you any voicemail; my keys are fine, as far as I know. Who is this girl leaving you messages on your phone?
[/Joyce's voice]

[my voice]
I dunno, let's search the Net for messages these keys decrypt.
[/my voice]

Re:Don't talk to strangers

[andreyw]

You have a point there - Of course it will be a fake voice, since Joyce would never, ever call you :).

Legitimate use?

[Bloke in a box]

Out of interest is there a single possible legitimate use for this?

Re:Legitimate use?

[Zerbey]

Oh sure, outsourced companies (yes, probably ones in India too) use this all the time to make customers think they're really being called by the company not some third party vendor.

Re:Legitimate use?

[wackysootroom]

Out of interest is there a single possible legitimate use for this?

Gettting back at Nigerian Scammers of course!

Re:Legitimate use?

[Anonymous Coward]

Out of interest is there a single possible legitimate use for this?

How about penetration testing of your company's network against social engineering? Imagine how much better a social engineering attack works if the Caller ID says the caller is coming from inside the company, or if it says that the caller is the VP of another division (who is known to be on vacation at the moment, and sometimes connects remotely).

Re:Legitimate use?

[Methuseus]

Like he said, legitimate use. I don't honestly see why they need to make it look like Bob's Help Desk, which is hired by HP to take calls, needs to look like they're HP themselves. Maybe it would wake people up to the fact that by and large help desk employees don't give a flying fuck about them and merely want to keep their call time down to keep a job.

Re:Legitimate use?

[Anonymous Coward]

We use a different sort of caller ID spoofing when calling foster children to check-up on them since according to state law, we can't let the host family know where we're calling from.

Re:777

[erick99]

That was Satan, using Camaphone. You've been pwned!

death threats

[ab384]

[from RTFA] The Camophone site was reportedly registered using a proxy in order to hide the identity of those who run it. They were afraid of receiving death threats like star38. Now, what would that imply about the legality/desiredness of the service? ...

Re:death threats

[Jens_UK]

I don't think death threats imply anything about the legality or illegality of a service. You can get death threats for all manner of legal things.

Re:death threats

[Methuseus]

I received a death threat for looking at this guy's love interest when she was single. And I wasn't even looking at her in a lewd way, I just sort of glanced because she was pretty.

They eventually did start going out, but he gave me a death threat before even their first date, and she wouldn't listen when I said I thought he was bad news....

Here...

[xmda]

...in Sweden you only have to enter a certain prefix before you make your call to make it anonymous. This is the way to do it IMHO. Or you can, if you want, tell your phone provider to list your number as secret.

Re:Here...

[HanShootsFirst]

It is the same in America. What's going on here is spoofing false information at will on phone calls.

Re:Here...

[Col. Bloodnok]

You can do that in the UK too.

Under certain circumstances (nuisance calls, hoax calls, fraud etc.) you can call a free operator number and ask them to give you the number of a call made at a particular time, even if the caller ID was suppressed.

I use this to complain to the Telephone Preference Service, when I get unsolicited commercial telephone calls.

For 1471 users: If you get "the caller withheld their number" when you dial 1471, then you can usually get the number out of BT. If you get "we do not have the callers number", you can't - it was probably an international call.

Spoof Caller ID From Home?

[diagnosis]

I know for a while there has been a phreaking tool called Orange Box, which supposedly lets you spoof caller ID. But my understanding is it only works *after* the other person has picked up the phone, so it's not really good for much, or at least it's a lot trickier to take advantage of.

Of course, there is a very cool software version of this tool: Software Orange Box, here. You enter in the caller ID details you want to spoof, and it generates the phone tones that transmit that data, which you can then play thru your speakers and to the phone, or connect directly to the phone for better results.

Again, it's not a great spoofer, but it is pretty cool to mess around with.

this is *the* faq on orange boxing.

-------------
Rate free iPod offers: RateTheOffers.com
(Flat screens and Desktop PCs too)

It's not that simple...

[dcavanaugh]

I only pick up calls from people I recognize, sort of a mental "whitelist". The fakers would have to get the names and phone numbers of people I know, otherwise they get my answering machine.

Let 'em try faking Caller ID -- it just raises the bar a little. The appropriate countermeasure is a challenge/response scenario where authorized callers have a PIN number and the rest go to voice mail. I can't wait to see how much the telcos enjoy losing their Caller ID revenue stream when people get annoyed with faked calls.

Re:It's not that simple...

[general_re]

I can't wait to see how much the telcos enjoy losing their Caller ID revenue stream when people get annoyed with faked calls.

I'm sure they won't mind too much as long as they can sell you, in its place, the PIN-authentication scheme you propose. You don't think they'll offer such a service for free, do you? ;)

Re:It's not that simple...

[GTRacer]

IIRC, some years ago, Compaq machines came with a "voicemail center" package. The modem answered, and the SW handled calls appropriately, including mailbox selection and passwording.

How long until someone puts all that in a cheap appliance (say a cordless phone base) so that the base screens calls and only rings the handsets if the caller is authorized? Or do they have that now?

GTRacer
- First patent!

Re:It's not that simple...

[fatcatman]

How long until someone puts all that in a cheap appliance (say a cordless phone base) so that the base screens calls and only rings the handsets if the caller is authorized? Or do they have that now?

They did have it now. Microsoft made a 900Mhz cordless phone with this feature. It relied on computer software (the phone base had an RS232 port), but worked very well. I still have it laying around, but don't use it anymore as the software doesn't run on anything later than Windows 98.

Microsoft should really concentrate on what they're good at: Hardware.

Re:It's not that simple...

[arminw]

....otherwise they get my answering machine...

Indeed, me too and our answerer, an old Mac classic lets me hear the first 10 seconds if they leave a message. I then answer if I want to talk to the caller.

When this works ''for real'' CID will die

[davidwr]

When someone offers a reliable, professional version of this service that's affordable to everyone, people will stop trusting Caller-ID and stop paying for it.

You'll also see political pressure to regulate such services, mostly from the telcos who see revenue from CID drying up. Eventually, I think a compromise will be reached:
You'll be allowed to spoof your ID, provided it's from a non-existant # or a # you have permission to use. There will also be a legal requirement to keep logs so the police or civil courts can issue subpeonas.

Under such rules, people who want true anonymity will be forced to use international versions of this service which will show up as "out of area" or as an international #, or break the law.

They use cleartext authentication

[SocietyoftheFist]

nuff said for me...

Lack of traceability is the problem.

[gtrubetskoy]

The ISP community has long had Acceptable Use Policies which forbid certain things (such as sending out spam). This is because when I get spam, I can fairly easily identify where it came from with the help of traceroute and whois, and its in the interest of the ISP not to have problem customers.

Unfortunately there is no way for me to trace the provider behind that sales call with the caller-id of my mother's phone, short of obtaining a court order. Thus, there is no incentive whatsoever for the phone companies to enforce caller-id. If phone providers provided the ability to trace the call (hopefully voluntarily, or even by law), this would not be an issue.

Traceability is what we need, that's all. Caller-id faking should be legal. But more likely what will happen is the lawmakers will make caller-id spoofing punishable by death and declare this a non-issue.

Re:Lack of traceability is the problem.

[dubl-u]

Thus, there is no incentive whatsoever for the phone companies to enforce caller-id.

Well, I wouldn't go that far. They must make a fantastic amount of money on CallerId; if it becomes untrustworthy, they'll lose a lot of dough.

Re:Lack of traceability is the problem.

[base3]

No kidding. Eight or nine bucks a month time all the people with Caller ID is too much money to leave on the table by letting it become useless. The question is whether they'll try for a legislative or a technical solution.

The ultimate Joe-Job

[davidwr]

"Hi, this is the Big Name Legitimate Charity, we're raising money to promote the glorious teachings of Adolf Hitler. Would you care to make a donation [click] hello? hello?"

Word spreads, and Big Name Legitmate Charity's contributions dry up.

Politicians could use it

[essreenim]

You have 1 new message...

This message was left today...
by....

George W. .....

Re:Politicians could use it

[Eccles]

Don'tcha mean: "I'm George W. Bush, and I approved this message."

don't like who's calling..?

[jspectre]

guess what. the old fashioned method still works. just hang up on them. regardless of what CID says. duh.

or. ever try screening with an answering machine..? that works well too!

Free incoming...

[Anonymous Coward]

I know that many calling plans (Nextel cellular for example) have free incoming calls. Would using this service effectively give you .05/min calling on your cell phone?

When fancier technology doesn't do a better job

[bluesangria]

Sheesh, despite the fact that I work in the IT industry I have only the most minimal service for telephone. We have a crappy 6 years old answering machine which we leave on all the time. The important people in my life know to leave a message and if we want to talk to them we will actually pick up the phone. You can *69 your call (or whatever key combo it is) until you are blue in the face. It won't make a damn bit of difference to me until I hear your voice and decide if I want to speak to you or not.

Honestly, it's much simpler and cheaper than constantly trying to "one up" the next technological doohickey.

Just my Luddite $.02

blue

Re:When fancier technology doesn't do a better job

[Ced_Ex]

So... what happens when the person you call back does the same thing? Do you only communicate through voice messages?

Re:When fancier technology doesn't do a better job

[bluesangria]

Absolutely! If the person leaves me a message for callback then I can assume that they want to speak to me. But that's still no guarantee that when I call back will be a good time for them. So, yes, phone tag is a "danger" of using an answering machine. But then, what's the difference between that and e-mail?

The point I'm making is that CallerID was supposed to allow you control of whether or not you choose to answer the call. CallerID spoofing tries to take that control away. So, again, where's the improvement over just a plain old answering machine?

blue

Re:When fancier technology doesn't do a better job

[multipartmixed]

> So, again, where's the improvement over just a plain old answering machine?

CallerID gets added at 50% opacity to the picture currently displaying on my television, until I hit "cancel" on the remote or 10 seconds passes.

Screening with an answering machine requires that the answering machine be turned up loud enough to be audible over the television. And then if the caller is drowing out the TV, you have to get up and turn the volume down on the blasted thing.

A horrible idea, real experience...

[bstarrfield]

Folks, I'm all for cool technology, and I realize one can spoof caller id information. But caller ID can be a very good thing. I know...

Three years ago I had the very unpleasant surprise of finding out my (ex) wife was having an affair. Unfortunately, she had also decided on using tactics designed to ensure her utter victory in the divorce. She'd actually purchased books (I saw them), giving her advice on dirty divorce tactics - "Divorce War! 50 Strategies Every Woman Needs to Know to Win." Apparently, one of the recommended strategies was to call your ex and try to drive him nuts - hopefully he'll say something nasty and you'll be able to bring it up in court, etc.

Well, I realized what she was doing once I started getting anonymous calls at 2:00 - 3:00 AM. Strange, nasty stuff, weird messages. Technology was actually useful - the caller ID information allowed me to get a pretty damn good idea of who was calling. (Hint would-be-nasty-callers: remember to hit *69 before you call!). The police thought it was fun, too. Caller ID and outright stupidity saved the day.

Look, in my case I wasn't directly threatened. it was cruel, it was viscous, it was nasty. But I was never in any danger. However, what if it had been something dangerous? When one's depressed, your willing to listen to anything - and when you see the ID comes out as "Police" or "Crisis Center" - you could be lured into a bad situation. This is real folks - stalkers are out there, I've seen and heard it.

All technology can be abused, I know that. But in this case, let's try to prevent a service which provides fundamental identification information from being turned into something potentially dangerous.

Incidentally, she pretty much wiped me out. Bummer. But all in all, it was for the best...

Re:A horrible idea, real experience...

[Anonymous Coward]

Sounds like you married my ex! What a fucking bitch she was. Forced me out of my own home by threatening to hurt herself and call the cops- then pin the blame on me and let them photograph her cuts and bruises. Thankfully I didn't stick around long enough for her to go through with it. Despite all that bullshit I got married again to a much nicer girl. This time things seem to be great- knock on wood.

Re:A horrible idea, real experience...

[Lumpy]

I'll add some tips for guys looking down the double barrel gun of divorce.

#1 - never EVER meet her without a witness. period. No excuses, nada...

#2 - get a telephone recording device and install it. RECORD EVERY phone call. get in the habit of saying first thing. I am recording this.... if your state requires it, in michigan only one person in the conversation has to know it... you.

#3 - at the first sign of things going wrong, get a GOOD lawyer, one that is specific to helping men in divorce, or the best lawyer in town. This is the best thing to do. Do not give her any money, have it go through the lawyers only and only if ordered to by a judge or advise to by the lawyers.. why do you want to finance her fight against you? you need an audit trail. I went the expensive route hiring the best lawyer in town... I ran and controlled the divorce. Secondly, if you file for it first, you are in the drivers seat.... beat her to the punch.

#4 - document everything... absolutely everything. keep a logbook and write down everything that happen's and everything you notice.

Finally, if you are going to hide assets, dont. if you did not liquidate things the second you thought things were getting a little wierd and before she/you left then you are breaking the law... The judge will fry your ass hard if you try to hide assets.

Lastly you need to keep your nose clean. be perfect for the next year as things progress. act like you are being watched, (you might be) followed, (you might be) or recorded (you probably are). DO NOT be vengeful. this is the time to be the mature adult... if friends offer to do things tell them loudly "NO! are you crazy!" having them replace her taillights with burned out bulbs when she goes to the bar, let's air out of tires, puts a I hate F**king cops bumpersticker on her car and other things is a very bad idea. do not be a part of it and do NOT be connected to it.

Finally prank calls using this spoofing service is also stupid. it is not worth it to lose over something stupid.

I'll probably get modded offtopic, but if I can help a fellow guy from getting screwed hard by his soon-to-be ex.... then the points are certianly worth it.

Re:A horrible idea, real experience...

[IamGarageGuy 2]

Got no mod points - you would get them all though. Am in that situation right now. Thanks for the tips and feel free to send anymore.

Re:A horrible idea, real experience...

[NardofDoom]

Install a recording device in your car and/or on your person. Someone I know was able to keep most of his stuff because he recorded the crazy stuff his ex-wife said.

And if she's really crazy, have your friend bring a video camera to any meetings. You never know...

Re:A horrible idea, real experience...

[Lumpy]

some tips for you right now.

get your name off of any joint bills right now. If both your names are on a phone or credit card get away NOW. close those accounts, whatever you have to do. be 100% sure that you keep nothing in all your bank accounts. run a ZERO balance. if she ever had access to your checks I guarentee she has one or two set aside to cause you pain. She may be mature enough to not use them but do not bet on it.

Finally, the trust you had for this person is 100% gone. do not forget that, you need to trust her less than a random stranger on the street.

Treat the whole situation as that she is trying to do anything she can to make you look really bad and take everything. Emotions are running really high.

and absolutely do NOT date or have a mistress around until AFTER the divorce papers are signed. The last thing you need to do is pissher off more or give her more ammo/targets/whatever. if kids are involved you will be screwed.

Also if kids are involved... do not see them or have them ALONE. she will try crap to punish you including accuse you of abusing them. It sucks but have a relative you trust (mothers are best) with you when you have your kid(s) or visit/pick them up drop them off.

Finally TRUST NO ONE. mutual friends may NOT be your friend anymore but information gathering agents, hell I had a friend find pot planted in his home by a mutual friend about 1 hour before cops showed up at his house unannounced and responding to a child abuse call.

Also, do not believe anyone that it's going to get better. it will continue to get worse UNTIL you get the papers signed by a judge. then it starts to get better. And do not hesitate to file Personal Protection Orders on her, I guarentee she has them filed on you.

Re:A horrible idea, real experience...

[Jacer]

Tip #1 - Find a bald guy with a barcode on the back of his head.

Re:A horrible idea, real experience...

[direwolf puppy]

There is another way to deal with this, if indeed you are going to take the offensive (if she is planning on fighting dirty, you might not have a choice). There is a single magical word that all lawyers love, and it's retainer.

In a sufficiently small area (i.e. not New York, L.A., etc), there is a limited pool of good divorce lawyers. If you can afford it, put them all on retainer. That way, your ex cannot use any of them, as it would constitute a conflict of interest for the lawyer to be on retainer for you, but representing her.

Disclaimer: I just went through a very mature divorce and we are still on good terms, but I made sure I did my homework first

Re:A horrible idea, real experience...

[gone.fishing]

One more thing.

Most states require that you keep your insurance as it is until the divorce is finalized. For most families, this means the man is paying a significant sum that benefits the wife. I pay over $600/month for health & life (etc) and another $300/month for car.

In your initial court hearing, make sure that she is ordered to pay 50% of the premiums and that it is stipulated that she has to pay them to you on or before the day they are due.

She most likely won't. You'll still be stuck with the premiums but the court will see that she is not holding up her end of the bargain.

Most lawyers (even divorce lawyers) don't think of this tactic. But it works for you one way or the other. If she pays, you have a few extra bucks, if she doesn't, the judge will penalize her in the end.

Re:A horrible idea, real experience...

[Anonymous Coward]

"Divorce War! 50 Strategies Every Woman Needs to Know to Win."

Wow.. that's a real book. *shudder*

Re:A horrible idea, real experience...

[AnalogDiehard]

I also was in danger of getting screwed bad by a vindictive STBX. Excellent tips given here, to which I'll add my own:

#5 - Know your enemy.

Pay attention to your ex behavior towards you, towards friends, towards business entities. This goes a long way to predicting her tactics. While we were married my ex used to brag of manipulating public welfare - it was a foreshadowing to her manipulating the divorce system. She used to take joy in "getting even" with friends who stiffed her, then she predictably returned the behavior to me. Divorce is war, so take the approach of a West Point graduate - KNOW YOUR ENEMY.

#6 - get a PO Box and change ALL your mail there.

This is for security reasons. My ex stole my mail and attempted to open a credit card without my consent. I caught it just in time and put fraud alerts on all my credit histories.

With a PO Box no one can access your mail except you, and the USPS clerks cannot retrieve your PO Box mail they will insist that you use your key.

I went through a painful drawn out divorce (no kids, simple assets) and reluctantly followed all the tips given here. THEY WORK, GUYS! In the end the judge slammed my vindictive ex and totally vindicated me - thanks to my hotshot lawyer who provided evidence in court that she was delaying the divorce process.

Re:A horrible idea, real experience...

[valkraider]

Tony Soprano did this to Carmela.

Until a few years ago, it pretty much WAS good

[davidwr]

Until a few years ago, you had to spend some real money to spoof caller-ID to an arbitrary number. Sure, you might find a PBX w/ weak security and use it as your fake #, but you couldn't just pick any random #.

In that sense, it was good enough for "low-loss" authentication like pizza deliveries, and a good-but-imperfect idea for things like "call from your home phone to activate your credit card."
Not any more.

I expect within a couple years that credit card companies will be doing call-back verification - you call them, then they call you back AND send you a confirmation in the mail.

Re:Until a few years ago, it pretty much WAS good

[GreyPoopon]

I expect within a couple years that credit card companies will be doing call-back verification - you call them, then they call you back AND send you a confirmation in the mail.

They're already using the email. Why, just the other day, I received a message from Citibank telling me that they needed to re-verify my identity. They even provided a really easy-to-access web site for me to enter my card number and personal information, no sweat. The really cool thing is that I don't even have a Citibank card yet. Talk about proactive!

Re:Until a few years ago, it pretty much WAS good

[Monkeyman334]

The system that 1-800 numbers and 911 calls is different than caller id. And yes, you could use a PBX and pick any random number. Kevin Mitnick (hypothetically) used it in his book to give a number like "x213" to make it look like a call was internal.

Re:Until a few years ago, it pretty much WAS good

[Anonymous Crowbar]

The real problem with this service will come from mail thiefs who get your new credit card when they still your mail. All they need to activate it is to call from 'your' home number.

It IS that simple

[Anonymous Coward]

Watch the telcos find a counter-counter measure that they can bill you for.

Remember.... it was first caller id.
Then it was caller id blocking.
Then it was a service to block blocked caller id's.
Not it is a service to spoof caller id.

And like lemmings, we pay for this crap. Or, I should say a lot of people pay for it.

You missed the point

[bill_mcgonigle]

You have just finished explaining that your Credit Card company uses caller id to verify who you are when you call. Then you say you are glad this happened. Listen to yourself.

He's glad because the more wide-spread CallerID spoofing is the less people will rely on it for authentication. Since it's not reliable authentication, if you desire reliable authentication this is a good thing.

It's like a social security # - we really ought to just give this out to every body freely at this point as a national ID # - it's not a secret.

But the cat still has his tail in the bag, so people still pretend like the SSN is secret and knowledge of it is a reliable authenticator. Of course it isn't secret at all, yet people pretend like it is, because it's easy to do so. If it was offically our national ID# people would have to come up with something better, yet that would take some effort so they're perfectly willing to continue with their silly charade.

Re:You missed the point

[Anonymous Coward]

I just moved into a new appartment. The old renters didn't get their mail for about 3 months. I had credit card bills, a new replacement credit card, phone bills, electric bills, a replacement SS card. A bill for renewing wired. And tons of other personal mail for this guys wife and children. It was so large I had to write return to sender on a large bag and take it to the post office. But if I was less honest, I could be this guy (Although I know I dont want to by all the collection letters). Most people dont realize with 3 house bills I can get an indiana state ID in your name. With that SS card, I can do a lot worse. And with the credit card...well I dont even have to go there.

So give me that...

[bill_mcgonigle]

CallerID is spoofable, but ANI info is not.

So I want the ANI info in my CallerID line. Why is this hard, or why are the Baby Bells unwilling to do it? They could sell "CallerID+" for an extra $2 per month.

Interestingly enough, VOIP may be the only way to authenticate callers reliably (in some future iteration with something like Domain Keys in SIP, perhaps). I bet a VOIP provider would be more willing to provide ANI information. Heck, maybe it'll spur adoption.

Re:So give me that...

[rcw-home]

So I want the ANI info in my CallerID line. Why is this hard, or why are the Baby Bells unwilling to do it?

Because they didn't create a way to do it that was backwards-compatible.

CallerID is sent as 1200baud FSK between the first and second rings. ANI is, for E&M trunk lines, sent as DTMF codes by the phone switch, or for BRI/PRI trunks, sent digitally with the other call connection information. DTMF incurs a significant connection delay - sending ANI plus DNIS (dialed number identification service, basically telling you which number the call was placed to) means sending 17 or more DTMF tones - so PRI is the preferred method.

So ANI in its current form really only works with trunk lines. In some areas with some ILECs trunks can be analog (leaving you stuck with E&M DTMF) but otherwise you're looking at the expense of ISDN or a T1.

The current CallerID protocol is flawed in that if you answer the call before the second ring, you don't get the CallerID information. I don't know why the telcos released such a flawed protocol or why they aren't interested in fixing it today. Maybe they figured that ISDN would replace POTS by now. Instead, as you mentioned, probably VoIP will instead.

Re:So give me that...

[DAldredge]

Then get an 800 number and have people call you on that. That is how you get ANI. ;->

Re:So give me that...

[bill_mcgonigle]

CallerID is sent as 1200baud FSK between the first and second rings. ANI is, for E&M trunk lines, sent as DTMF codes by the phone switch, or for BRI/PRI trunks, sent digitally with the other call connection information. DTMF incurs a significant connection delay - sending ANI plus DNIS (dialed number identification service, basically telling you which number the call was placed to) means sending 17 or more DTMF tones - so PRI is the preferred method.

I'm stretching past the limits of what I really know here, but isn't all this just what it looks like at the local connection? That is, isn't this all handled in a more abstract way in software between the two endpoints of the connection?

Yeah, you get a PRI into the building, but it's not end-to-end PRI, if you understand what I'm trying to say.

So, couldn't the sofware that feeds the gear that generates the FSK info tell it about the ANI data that it would send to a PRI rather than whatever the originator sent?

Or is the originator actually controlling the entire call more than I'm expecting?

Re:So give me that...

[Anonymous Coward]

mmmmmm ... Alphabet soup is yummy.

Re:So give me that...

[rcw-home]

So, couldn't the sofware that feeds the gear that generates the FSK info tell it about the ANI data that it would send to a PRI rather than whatever the originator sent?

I suppose there's no technical reason why not, but as mentioned elsewhere in this thread:

• You can't send both via the CallerID protocol. CallerID only supports ten digits.
• Telcos have allowed PBX's to set CallerID on outgoing calls so that they can set it to the caller's DID (direct-inward-dial) number so the receiver of the call gets the caller's number (f.e. 555-2391) instead of the business's main number (f.e. 555-2000) on the Caller ID display. The ANI information must remain the main trunk number as that's what is used for telco billing, 911, etc.
• Telcos should have filtered outgoing CallerID based on the DID blocks that the customer actually owns (f.e. 555-2XXX) but most haven't been doing that.

So basically, there is a need to maintain two separate numbers for the originator of the call, CallerID can only show one of them, and you can't trust the one your telco has chosen to show you because telcos as an industry have been careless about it.

ANI spoofable in theory

[davidwr]

In theory, ANI is spoofable, although I don't know enough about it to say how to do it with any number.

An limited mechanism is to use a callback system, but it requires the cooperation of the person whose # you want to fake.

You call a spoofing service, they call you back, then 3-way-call you to the 800#. The spoofing service's # shows up instead of yours.

Same thing works for 911 or any other service by the way.

Re:ANI spoofable in theory

[Anonymous Coward]

in actuality the only reason caller id is so easily spoofable is because of misconfigured telco switches. Don't get me wrong I'm not saying that if they were set up correctly it would be impossible but 90 percent of the time this is the case.

Even in the ever so famous pri configuration of c.i.d. spoofing machine because every telco switch I've seen has the ability to do screening on the cid info. When set up properly the pbx can send any cid info it wants , but in the switch there is a screening list that lists all the numbers assigned to the circuit. If the number does not appear on the list then the billing number of the circuit is used. Sadly I rarely ever see this feature used in the switches.

ANI your really not going to be able to spoof as easily unless you actually have access to a switch. Even in the case of pbx's ANI will generally reflect the billing info on your trunk into the telco switch not the info provided by your switch.

Note - I will however admit that nearly anything is possible with a incorrectly configured switch because these switches are made be capable of all kinds of stuff but telcos generally pay every close attention to anythjing affecting ANI

Re:ANI spoofable in theory

[jerde]

Right... but you're still proving that ANI is not spoofable, in that it still accurately reflects the number of the line that placed the call.

I can hide my ANI by using Camophone, since the ANI that shows up is some line that belongs to them. (I get an ANI in the 214 area code, which is Dallas, Texas)

But I cannot set the ANI to any number I want.

Re:ANI spoofable in theory

[Anonymous Coward]

[quote]Right... but you're still proving that ANI is not spoofable, in that it still accurately reflects the number of the line that placed the call.

I can hide my ANI by using Camophone, since the ANI that shows up is some line that belongs to them. (I get an ANI in the 214 area code, which is Dallas, Texas)

But I cannot set the ANI to any number I want. [/quote]

Exactly and technically as i said before this SHOULD apply to CID as well but the CID screening feature sadly is rarely used.

emergency services is gonna love this

[feorlen]

Maybe that explains why the fire department showed up here the other night. "We" apparently called and reported a fire. Dispatch then said it came from an "invalid" phone number.

Bastards wasted the time of more than a dozen firefighters and several trucks on a prank. And it wasn't even a good prank. I hope their houses weren't on fire that evening...

Re:emergency services is gonna love this

[Anonymous Coward]

911 services don't use Caller ID. They use ANI (automatic number identification), much lower level and not nearly so easy to tamper with as Caller ID.

Re:emergency services is gonna love this

[yetanothermike]

Emergency services should be using an e911 service with the telco that isn't caller ID. e911 existed before CID was in place and works in areas where switches are not capable of carrying the service. If the local setup is relying on CID instead of whatever the telco should be serving up you all are in SERIOUS trouble.

Re:emergency services is gonna love this

[feorlen]

I'm familiar with the difference between Caller ID and ANI. A VoIP system may not be able to stuff in whatever ANI it likes but it sure can fail to provide anything in the first place. So it likely won't be used for spoofing, exactly. But the guy making prank calls to 911 probably doesn't care.

Yes, anything that could really spoof ANI is positively frightening. But just being able to fail to provide it opens up a lot of room for abuse right there.

It's Too Easy...

[xanadu-xtroot.com]

Just use a calling card...

I have a calling card that I got through WalMart. The caller ID comes up as Denver, CO. I live in PA. This is via my cell or my land-line...

Re:It's Too Easy...

[xanadu-xtroot.com]

Interesting...

I just ran another test. The caller ID came up as Atlanta, GA. Again, I called my cell from my land line, and I live in PA....

Aside, I guess, this is really easy to beat...

haven't been monolithic for a decade

[davidwr]

In the 80s, new features required completely new software on a telephone switch, which meant several YEARS of testing for something as simple as 3-way calling.

In the mid-late 90s, switches started using adjunct processors that could add new features without upgrading the switch's core software. This dramatically reduced implimentation time for new ideas, and made it possible for third-parties to "plug into" the switch and offer their own serivces.

It didn't happen where I live, but in theory, 100 different "startups" could colocate at a telco's switch, each with their own adjunct processor, and each offer their own custom services. For example, one might offer call-forward-no-answer, another might offer conference calling, and another might offer voice-dialing services where you spoke, rather than dialed, the number. A company geared toward the tinfoil-hat crowd might offer to record all your calls for you and hand-deliver a tape by courier within the hour. Nobody in my region offered that last one.

With VoIP, this just got a lot more flexible and a lot cheaper to impliment, at least on the technical side. The "business" side, that is, marketing, customer service, etc., is relatively unchanged.

Sheesh

[HarveyBirdman]

Can't you already dial *69 or something to turn off caller ID?

Man, I gotta get cracking on a way to soak some cash out of you paranoia wonks.

NOW FOR SALE! High tech voice masking system. Scrambles the tone of your voice so not even your own grandmother will know it's you! And you can't trust her! Oh, no! You know she's watching you with nanocameras in your colon and reporting your every move to the Library Of Congress!

The Voice Scrambler 7000 is constructed of genuine Corintian leather. Just wrap around the part of the phone you, like, talk into, and your voice will be changed like magic! All this for only six payments of $79.95. And if you order now, we'll throw in a bottle of HyperBlue Stain remover to keep your Voice Scrambler 7000 clean and free of spittle.

Quantities are limited! Act now! The first 20 caller get a freah roll of tinfoil for their fat heads!

Re:Sheesh

[krray]

Well, *69 is typically call-back the previous caller.
*67 is usually block the next caller -- though I'm seeing VoIP providers, for whatever reason, use *67 to block ALL calls, but I digress. :)

You may block caller-id, but there's a few problems. If you call my 800# I get your ANI information which is completely different. If you call my regular [VoIP] number and block caller-id your phone number [at a minimum] is still transmitted, but simply flagged as "P"rivate (which I have my equipment set to ignore).

Using such a service as advertised here today (hey, I call it as I see 'em :) and yes, you will have easily "hacked the hacker". :)

Service DOES NOT WORK

[daveschroeder]

So, I decided to see if a credit card paypal transaction would be any "faster".

It did indeed show my account credited with 100 minutes.

But the service did not work.

I *really* *don't care* about the $10 I've now wasted; just wanted to see if it worked or not. :-)

Anyway, there ya go.

Re:Service DOES NOT WORK

[general_re]

I *really* *don't care* about the $10 I've now wasted....

Errr, well, I hope they're not *total* dirtbags, or you may find you care very much about the $1000 transaction that'll be charged to your card next week ;)

Re:Service DOES NOT WORK

[daveschroeder]

They don't have my credit card. PayPal does. I DEFINITELY wouldn't have given it directly to them. (When I posted the first message, I assumed they had a credit card payment method too; in reality, the only way they "accept" a credit card is via PayPal.)

Re:Service DOES NOT WORK

[general_re]

I guess I'm not surprised that it doesn't work - IMO, nothing says "scam" quite so well as "only accepts payment through PayPal". Well, maybe eGold, but that's about it ;)

Interesting you mention bellsouth

[poptones]

We get several calls a day here from telemarketers and it seems most of them send the Bellsouth phone number. I called Bellsouth about it, the operator didn't even seem to realize it was possible to spoof your callerID signal. I never answer the damn thing anyway. -Tyler D.

Just in time for hallowe'en pranks!!

[ikegami]

Imagina all the fun you could with this on hallowe'en? :)

$.05 per minute?

[H8X55]

I only need it for a few seconds at a time!

If you just want to hide your number...

[AGTiny]

If you just want to hide your number, not necessarily spoof your enemies, any calling card will do, like another posted mentioned.

I use OneSuite as my long distance service because their rates are excellent. Caller ID from OneSuite shows up as either Unknown or some random out of state number.

What - give these guys money?

[slars]

I'd have a real hard time giving these guys any financial info on myself (including PayPal info) based on their website. They come off as a site that does a blind url redirect to their aol account, gathers as much financial data as they can, then runs off to Jamaica to spend the rest of their life in the sun.

My KID can make better websites than that!

Login

[Anonymous Coward]

You can login to check out the interface with their unguarded testing account:

user: test
pass: test

No cash on the account, but fyi.

SS7 - ANI

[Qbans]

No one's mentioned that Caller ID isn't really used for that much authentication. Let me give you a little bit of background on caller ID.

There is actually two types of calling number identification one being the popular Caller ID which as we know can be manipulated and blocked and the other being ANI or Automatic Number Identification which the user has no (or minimal) control over. Caller ID is used for the little displays on your phone and can have a flag set to block it, as well as define what number displays usually on outbound or two way trunks for use with DID (Direct Inward Dialing).

The reason the phone companies allow you to set your outbound caller ID is so when you are using DID, you can have people reach you back directly instead of thru the companies generic number. Now a little bit of background on DID: Mid and large sized companies use DID for everything, it's how everyone has a seperate phone number or fax number on their desk. It would be uneconomical for the businesses to bring in a seperate phone line for everone in the office, so they share them. So say for example a company with 100 employees would have a block of 100 phone numbers, but only 23 incoming phone lines, any number can come in on any one of those phone lines and the company's PBX determines which desk to route the call to. Pretty simple. So when an employee wants to make a call, again he can use any phone line, and the PBX sets the outbound caller ID to his real number so it's easy for people to call him back. Some phone companies limit you to what Caller ID data you can send them, (which makes sense that you can only have outbound Caller ID on numbers that are in your block.)

ANI always knows the calling trunk, and location. It's what's used for credit card verification, 911, etc. You can't block it and usually can't set it. ANI is transmitted (amongst other things) over SS7, which is basically an out of band protcol (which actually does carry caller ID too) that is used between switches. Few companies have phone systems that speak SS7, or a link into the SS7 network for that matter, it's just not useful. Phone companies would crack down pretty hard on fake SS7 info, because they could loose money on billing.

So in summary, Caller ID - not secure, ANI - A little more secure.

Re:SS7 - ANI

[Anonymous Coward]

Some phone companies limit you to what Caller ID data you can send them, (which makes sense that you can only have outbound Caller ID on numbers that are in your block.)

ALL phone companies should do that!
By not doing it, they make their own system uncredible.

Telco nightmare: Caller ID obsolete

[dcavanaugh]

Nobody needs telco services to implement PIN authentication; you can do it yourself. Some of the high-end answering machines are like a miniature PBX; it won't take long before they screen all incoming calls for you. I believe there are some that already do.

The ultimate telco nightmare is when commodity hardware replaces network-based services. If the telcos don't defend the integrity of Caller ID, the problem will be solved without their participation.

Re:haven't been monolithic for a decade

[Doc Ruby]

Telco equipment is still "vertical": NorTel switches require NorTel plugins. The most important vertical "silo" is the telco itself, which might outsource feature supply, but users get all their services from the telco, in whatever bundles they integrate and sell. No third party service provision direct to the customer, integrated with telco equipment or services, has ever survived. Even something as simple as DSL was blown away by the telcos' extreme competitive (including legislative) advantages.

VoIP is different. It's inherently distributed. Since it's entirely executable on commodity hardware with open source software and published standards, distributed interop comes first. So a component architecture is available for any integrator, even an agressive end user. Of course all that changes the marketing, customer service, technical support. Even the "customer care", integrated billing and customer service, becomes a necessity rather than a luxury, and gets pushed closer to the customer than in the proprietary telco model. Customer care itself can be an addon from a third party with aggregated niches around the Net.

Sure telcos have slowly moved towards their versions of some of the features and architectures of VoIP. The ATM long lines network between COs is VoIP (for lowercase "i" and some value of "P" :). This callerID spoof is an example of the blurred lines. Those blurred lines will make transition to VoIP smoother, bringing the benefits of open interop to every user and provider.

Great, now it will be just like the movies again

[Anonymous Coward]

Remember the old movies where the police had to stay on the phone long enough with the bad guy to trace the call? At this rate, it looks like we may have to go back to that all over again.

Long Distance capable???

[Ced_Ex]

How It Works

Making Calls with Privacy Guard -- To make a telephone call, you fill out our simple web form with 1) Phone number of party you are calling, 2) A phone number to reach you, and 3) The Caller ID you wish to send. At the click of a button, the system will call you first, then call the party you are attempting to reach. The called party will receive the caller ID that you specified. The system will then bridge the two calls together. This method is private and untraceable.

Given that the method they use to operate requires them to do the calling to both parties, does that mean you can get away with getting free long distance calls?

Re:Long Distance capable???

[Dahan]

... does that mean you can get away with getting free long distance calls?

RTF article summary? It's not free, it's 5 cents a minute.

Re:Long Distance capable???

[the last fortress]

does that mean you can get away with getting free long distance calls?

Considering the fact that you have to pay to use the service (as mentioned in the Slashdot blurb, in the associated article, and on the website), I think it's fairly safe to say that you can't use the service for free. In general, if you have to pay for something, it's not free.

Re:Long Distance capable???

[Ced_Ex]

I read the article, 5 cents a minute is significantly cheaper than some long distance rates.

If it's 5 cents a minute for any call, does that mean long distance rates are the same? I call East coast to West coast = $0.05/min?

Re:Long Distance capable???

[Ced_Ex]

I read that you have to pay for the service. What I should have said was, "Do you have to pay extra for long distance, or is that free?"

Re:Long Distance capable???

[Dahan]

$.05/min is significantly cheaper than some long distance rates, but it's trivial to get rates that low, or even lower. You can even get a flat monthly rate--all the long distance you want for $20/month or so; worth it if you do a lot of long distance calling.

So yes, I'm pretty sure it's $.05/min anywhere within the US.

Comment removed

[account_deleted]

Comment removed based on user account deletion

How to circumvent ANI

[yetanothermike]

Call the local operator and ask them to place your call to the toll-free number. Obviously this doesn't work with toll calls, but they'll do it for you on toll free calls. It's been a while since I tried it, since I have little reason to hide when placing calls, but it's surprising how often they have no trouble doing it for you. I was never even asked why I wanted them to place the call.

hello.....

[commo1]

Hello, this is Alec Baldwin from the Film Actor's Guild. If you don't believe it's me, look at the Caller ID. You'll see our acronym!

Excellent for Push Poolling

[Anonymous Coward]

Imagine having the Caller-ID "John Kerry Election Committee" and then completely fulfill the undecided voter's notion that John is a liberal weiner flip-flopper.

Or, calling up as a "Gallop" pool, and then ask the question: "Would your opinion of Howard Dean change if you knew about his history of spoucal abuse?" (an actual push-poll question designed to lead the callee to assume that Dean had a history of abuse, which he doesn't).

What great political fodder!

Re:Excellent for Push Poolling

[Anonymous Coward]

Well, this is exactly I'm doing today as part of a Democratic get-out-the-vote, calling campaign just north of Madison Wisconsin. Let's hope a few people switch to Bush.

Re:Excellent for Push Poolling

[Kiryat Malachi]

Push pooling, eh...

Do not trust the pusher robot. He will push you into the pool.

Camocaller?

[Peter Cooper]

I would have thought CAMEOCaller would be a cooler name.. I mean, look at it.. cameo?

Does anyone else think this is lame?

[ctime]

Maybe I'm just getting old, but doesn't this seem lame as hell? Sure it's fun calling up your buddies T-Mobile cell phone # and getting into his VM, changing his greeting to something ubscene..but..

Doesn't this just seem rather weak? It's only fun for about 5 minutes and has been around forever. For me, it's like the equivilent of spoofing smtp headers. MAN, THAT WAS FUN IN 1994...

I guess I'm just getting old and bitter.

PBX hijacking to 911 - can't do arbitrary #s

[davidwr]

If I'm hijacking a PBX with outgoing trunk lines 212-555-1000 through 212-555-1999, I don't know how to make my "outgoing" call to 911 or 1-800-hot-sexx look like it's from 303-987-6543 or any other arbirtrary number. If I knew what I was doing, I probably could make it look like it's from any of the #s the PBX typically shows on its outgoing calls.

Your point about internal calls is well taken. Hope someone mods it up.

Re:PBX hijacking to 911 - can't do arbitrary #s

[Monkeyman334]

You're correct that 911 and 1-800-hot-sexx would have a number for your PBX. That's because they don't use caller id. Caller id is sent with the phone number as extra data so your PBX can send whatever it wants. I forgot the name of what 911/800 uses, but it's completely different.

Re:PBX hijacking to 911 - can't do arbitrary #s

[AK Marc]

The phone company doesn't check the number coming in from the PBX. For example, the main line for your business could be 212-550-1212. That is the number associated with the physical lines that come in. Calls to 212-555-1000 - 1999 get routed in over those lines, but they are irrelevant to what goes out. So, when 212-555-1000 comes out on the line 212-550-1212, it is accepted. Additionally, 213-456-7890 could be sent out the same line, and the phone company wouldn't care.

It would take changes on the phone company side to prevent erronious numbers being passed, but because there are valid business circumstances for setting specific numbers, it would be nearly impossible to change the system at this point because of the disruptions it would cause.

terrorism or lawsuit potential

[davidwr]

As soon as some terrorist or financial scammer does major damange due in part to an unprotected switch, you'll see telcos start paying more attention.

Can you say "lawsuit?" I knew you could.

Re:terrorism or lawsuit potential

[Anonymous Coward]

I don't think caller id screening would have anything to with the term "unprotected switch" in the manner your speaking of. I mean they're hardly going to cause massive damage by sending out incorrect caller id display info.

This isnt true spoofing anyways.

[Anonymous Coward]

Well in the UK at least there is presentation caller id and true caller id. For withholding the number a null value is specified for presentation id, but the true caller id is the same. Similar for companies/PBX's - departmental lines can be configured to present the switchboard number for the presentation id to prevent customers from calling back on the internal line - instead they are forced to return the call to the switchboard. However true caller id can still be detected by the telco as it is used for billing purposes. Also this is necessary for law enforcement etc.

Anyway even if the number is withheld (presentation clid=nul) the true caller id is visible by the telco and by law enforcement (with specialist equipment and/or links to telco exchanges - unclear on that)

Anyway this is Uk stuff but the USA AFAIK have similar implementations. Anyway it wont be too difficult to find the true CLID in cases of serious abuses etc.

I dont see any merits of this service.

Question (as IANAL): is there any federal (or state) fraud / deception laws in the USA which could prohibit such activity.

***Irrelevant parentetical statement follows***

Or is fake CLID protected free speech like kiddy pr0n, spam, etc

***end of irrelevant parenthetical statement***

Please do not mod as troll due to the irrelevant and sarcasrtic parenthetical statement above.

PayPal

[DogDude]

I don't understand this whole PayPal thing. PayPal has repeatedly and maliciously (from what I remember) messed around with their customers' funds, they're expensive as hell, and it's very amateurish. 1. Why would ANYBODY use PayPal and more importantly 2. Why would ANYBODY give money to a company that only had PayPal as an acceptable payment method? It's very simple: if you want to buy a service from a company that only accepts PayPal: don't. It's gonna be either a scam or a tiny, fly-by-night company. Any legitimate business can accept credit cards. It's very easy to do (and much much smarter from a business perspective). And to all of those people who are convinced that PayPal is perfectly acceptable, just PayPal me $20 and I'll send you a great penis extender...

Re:PayPal

[mikefe]

It is pretty hard to tell the difference between the phishing scams impersonating and what paypal may have done with accounts.

I plan on using paypal in the future, but will only connect them with a bank account that does not have a lot of funds in it in case something does happens.

Re:PayPal

[multipartmixed]

I don't know about you, but I'd *way* rather give a potentially crooked company five bucks via PayPal, instead of my credit card number.

Re:PayPal

[Anonymous Coward]

Typically you don't give the company itself your credit card, but rather a 3rd party payment service that skims a percentage and deposits the amount in your account, or sends you a cheque at the end of the month. That is, until the company you're dealing with is bigger, in which case, they'd be well known and there's less risk...

*76

[Lossy]

Its *76 to block calls here.

Calling cards

[Thrakkerzog]

Some calling cards have a feature generally called 'pinless dialing', where you can set up a list of numbers. If you call from one of these numbers, you do not have to enter your PIN.

So, if you know someone who uses that, you might pay more per minute than they are paying for the calling card. :-)

Either way, pretty serious risk for people who use cards to call other countries.

Stole my idea..

[x.Draino.x]

I started doing this a week ago using Asterisk+NuFone.. hopefully NuFone doesn't have to change their rules any time soon. I thought about setting up a service, but was afraid of the legal consequences. Here's the easiest way to do this: Download and install this CD Xorcom Debian/Asterisk CD ( Linux+Asterisk Debian Distro ) Purchase a DID from Voicepulse Purchase $5.00 worth of minutes from NuFone.net Download the cidspoof.agi script Configure your extensions.conf in Asterisk.. fire it up, call the DID, enter the spoof number and outgoing.. voila. It will end up cost you like $15.00 for a month or 250 minutes worth of spoofing time. =)

Re:Stole my idea..

[n8twj]

You better read the Terms and Conditions.

Re:Stole my idea..

[x.Draino.x]

What do you consider abuse of CID or ANI by your terms?

Re:Stole my idea..

[n8twj]

Setting your Calling Party Number to a DID that you do not have legal rights to.

Re:Stole my idea..

[x.Draino.x]

I don't think anyone has the rights to "666". =) Is this ok? You have a great service, but you have to understand that a lot of your business comes from people who use it purely for this purpose. And from what I understand, everytime you guys get asked about why you still allow it, you give no comment. I figured you guys didn't care. Your service is mentioned in many articles pertaining to caller-id spoofing. I had to know if it really worked, so I tried your service. I don't plan on using it to do anything fraudulent other than maybe a practical ( harmless ) joke on a friend. It's fun to call up your friends with "31337" or "666" for your caller-id. If this is unacceptable, please cancel my account. I'm sure you know who I am. I don't need a refund, the caller-id spoofing was worth losing $5 over. Thanks. ( draino@gmail.com ) just to make it easier on you.

Fax calls in the middle of the night

[Thrakkerzog]

For some reason, someone thinks my land line is a fax machine. 2 or 3 times a month, I get a phone call in the middle of the night, which sounds like "Beep Beep Beep"

So, I hooked up a computer to receive faxes.. and got something trying to get me to invest in gold.

It was really bad one day, where my wife got 10 calls over the afternoon. She called Verizon using her cell right after the call had happened.. and they told her that they couldn't tell where the call was coming from. There is a * code to put a trace on a phone call, but of course.. it didn't work.

So, my question is this: How can the phone company not know who is calling me? Verizon's only offer was to change my phone number -- a move that they would charge me for.. and one that would make me wait 3 months to get back on the do not call registry.

Any telco experts out there?

Re:Fax calls in the middle of the night

[general_re]

Verizon's only offer was to change my phone number -- a move that they would charge me for..

I had the same problem, but VZ changed my number for free. You should at least get that much if it's truly interfering with your affairs. Keep after them about it - remind them that VZ has plenty of local competition these days, and if they won't help you, perhaps MCI or Sprint or AT&T will....

Re:Fax calls in the middle of the night

[Qbans]

Hmm interesting. If it gets really bad (which it seems to be at points) you can always do 1 of 2 (or both I guess) things: 1. Call your local public utility comission - It's usually located on your states website, there you can file a complaint against Verizon, and make them track that call for you. I guess due to the frequency and time of the calls, it could be considered harassing. 2. File a complaint with the FCC right here In my dealings with the PUC (at least in NJ), they seem to get stuff done.

1994??

[Gothmolly]

Geesh, where were you? We were doing that back in 1989.

Re:1994??

[Anonymous Coward]

I was seven years old and being a kid, you old fart.

ID Spoofing

[WoBIX]

I'd like to be able to block all incoming calls that spoof numbers. As they're invariably people I don't want to talk to anyway. There's usually two or three new calls a day on my phone's display that point back to bogus numbers. "The number you are calling is not in service. Please hang up and try your call again." With ID spoofing you can't even call them back and request to have your number removed. Not that it helps much. They just resell the info.

Want something that *IS* working, TODAY?

[isepic]

Like I posted with *38 came out, there is another company who has been doing this for YEARS now...

www.wildgate.com

Get a pre-paid account, and change your outgoing caller ID to whatever you want via the web - then when you dial out, that's the number.

Limits: not to 8xx numbers (of course, because that's ANI)
not to local to LA area (because of course, the LA Xchange will take over)....

I've had an account there for a while.. even spread the word to Mitnik back in the day b4 * came about.......

Obscene phone calls

[Anonymous Coward]

No one has mentioned that Caller ID and Star 69 pretty much eliminated the problem of women being harassed by obscene phone calls and threatening phone calls. Lots of pervs got their jollies threatening women. They'll do it again if they can spoof Caller ID and do it cheaply.

In the UK..

[Trevelyan]

...you only have to prepend 141 to the number your dialing to have your number blocked, also you can call BT and have them bar your number (which will also remove it from phone book listings) permantly.

For mobile phones there is and option in the phones menu to disable your ID.

I guess us silly british are just not as good at finding ways to extract money from people since all these services are free.

Tried the server, here's the results

[KnightMB]

Ok, I tried the service, basically cost $5.00 Results:

1) Payment by paypal only (no problem for me)

2) Service then lets you log in, but it's not secure (no encryption, wth!) so choose a temp password that you wouldn't mind someone stealing

3) You enter the "target" number, your number then 10 digit caller ID string

4) As soon as you hit submit, it does call you, calls the other number and bridge them together.

5) But!! The caller ID string does not work. I've tested this with several land line phones, cell phones, etc. I always show up as "unknown".

Conclusion:

Allows bridge calls but does not produce the caller ID string you put in. So this service is a bust in my opinion.

Case closed

worked for me...

[Anonymous Coward]

I just went through the steps and called my buddy. The conversation went like this:

My Confused Friend: "Hello?"
Me: (in disguised voice) "Do you know who this is?"
My Confused Friend: "Umm... no. Who IS this?"
Me: "Can't you tell from the number in your caller ID?"
My Confused Friend: "987-654-3210? What the..."
Me: "Muahahahahahah..." (I tell him who it really is)

I got a call to from the same number. Please don't DDOS it yet... I want to make use of my $5.00 and have some more fun! :)

accountability

[davidwr]

As soon as the FBI can't track down a terrorist due to bad or missing info, or a company can't sue to recover $billions due to bad or missing info, the telco's going to have a black eye.

THAT is what will make the telcos take notice.

Re:accountability

[Anonymous Coward]

the fbi isn't going to be using caller id info to track down a call. They will use ANI and active traces to track down people. The only way to avoid that is to have the original call fowarded via 3-way calling types set-up to make another call and even that cant be traced via AMA records retained in the switches

I told you Do not call list DOES NOT WORK!!!

[Anonymous Coward]

I told you so, but did anyone listen? Thanks to yet another spoofing technology, every telemarketer is going to exploit it!!! BOYCOTT DNC NOW!!!

Asterisk Can Also Handle Call Screening

[Murf In Wyoming]

I've submitted some upgrades to Asterisk that provide a databased Privacy, and a non-databased Call Screening. These can be done on a per-extension basis.

With call screening, you can set it up to ignore the CID and they are asked, every time, for their name. This is recorded and your extension is dialed. You answer and it tells you that someone introducing themselves as: wants to talk to you, and you can either talk to them immediately, send them to voice mail, or give them one of two sendoffs before it hangs up on them. (One slow and tortuous, the other quick and polite).

While they wait, they are serenaded with whatever Music on Hold you want to subject them to. If you want to use CID, you can database your decision, and it will be used in the future to decide how to handle the call. You can even store the recorded introductions they provide, and use them on a PA if you so desire.

CID can be fun to play with, but if its non-reliability goes over some threshold of pain, you can drop it and still avoid picking up the phone for callers whose voice you don't recognize.

These fixes have been submitted to the bugzilla database, and will most likely be included in Asterisk when the voice prompts are done in the same voice as all the others.

SO, I guess you could say that if Asterisk is being used to provide CID spoofing, it can also be used to thwart the anonymous caller!

Update: Service DOES work

[daveschroeder]

But their page never threw any errors if you didn't put the right stuff in...it turns out you can't set CID name, only the 10-digit number. They've now added some text to their page to that effect, and the service does indeed work.

NEVER liquidate pre-marital assets!

[Anonymous Coward]

'nuff said...

Better colours

[Anonymous Coward]

http://shit.slashdot.org/article.pl?sid=04/10/28/1 450205

DHS

[PenguinX]

Why isn't the department of homeland security questioning this instead of the stupid rubik's cube thing?

I'd drop you in a heartbeat

[lorcha]

My company uses different providers for incoming and outgoing VoIP calls. One was cheaper for outgoing calls and the other cheaper for incoming calls, so we just set the CID on outgoing calls to be our DID on the incoming provider.

In addition, we used to have a salesperson who wanted his outgoing CID info from inside the office to be his cellphone CID since he was out of the office so much.

If you didn't let me do this, I'd drop you in a heartbeat. There are legitimate reasons to change your CID.