Slashdot Mirror
'Robocall Strike Force' Proposal Could Stop Caller ID Spoofing (onthewire.io)
This summer the FCC convened a "Robocall Task Force" to help consumers fight unwanted automated telemarketers, and Wednesday the coalition finally delivered a report recommending a "Do Not Originate" list so carriers could spot spoofed numbers which should be blocked.
A trial of the "DNO" list that's been running for the last few weeks on some IRS numbers has resulted in a 90 percent drop in the volume of IRS scam calls, officials from AT&T, which leads the strike force, said during the FCC meeting Wednesday. The carriers on the strike force, which include Sprint, Verizon, and many others, plan to continue testing the DNO list in the coming months, with the intent to fully implement it some time next year...
The strike force members also are working on a system to classify calls into categories, such as political or charity, as a way to give consumers more information before they answer calls from unknown numbers. And, the group said it has developed a working solution for authentication between VoIP applications and traditional landline networks as another way to defeat spoofing from callers in foreign countries.
Early next year they're planning larger tests -- and the strike force has also created a new site describing how to block and report robocalls.
The strike force members also are working on a system to classify calls into categories, such as political or charity, as a way to give consumers more information before they answer calls from unknown numbers. And, the group said it has developed a working solution for authentication between VoIP applications and traditional landline networks as another way to defeat spoofing from callers in foreign countries.
Early next year they're planning larger tests -- and the strike force has also created a new site describing how to block and report robocalls.
the task force pays for itself... from the untold billions the carriers made on every spam / scam call they put thru to you.
I would say about 90% of all landline calls are spam at this point.
Why are they even messing about with this?
Require mandatory jail sentences for anybody installing/operating this equipment and the problem will disappear overnight.
The same goes for a lot of other crap the people have to put up with. Start throwing more scumbags in jail and the scumbags will stop doing it.
Maybe a general "scumbag" law that can be applied retroactively to people who try to beat the system. If a jury decides that somebody is being a 'scumbag' then anybody with a history of the behavior being judged can have the law applied to them.
Vote for me in the next election!
No sig today...
We're all too happy to outlaw things that have no legal purpose, even if they do. Care to inform me what legal purpose spoofing caller ID could possibly have?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Why did we design systems which implicitly trust the information provided by a sender? Why are packets that claim they are from an IP address that doesn't belong to that ISP or phone numbers that don't below to a specific service not immediately blocked at the first router?
Why is it possible in the first place?
If I were to design a protocol of this kind, one of the first measures I would take, in the protocol itself if relevant and in any implementation, would be to check that peer-provided source addresses match the routing system, making spoofing impossible. I cannot fathom that the people who designed this particular protocol did not do the same from the beginning, and even more so that they did not fix it since then.
That sounds way too much like a government censorship program by stealth. We all know that will be abused.
A better solution is just to digitally sign telco traffic along physical routes. No more spoofing and complete tracability. Enev signing packets statistically would be fine and cause minimal overhead.
DNO is a hack. I guess it might be worthwhile because it could be implemented on the receiving end of the call (either the final switch or even the telephone set). On the other hand, the correct approach would be for originating telco offices to require that the originating caller-id belong to their customer. Of course, that might jeapordize telco revenues, so is a non-starter.
The PSTN/POTS trust design is likely older than both of us combined.
Fortunately, autodialers also must trust "Special Information Tones" (SIT) that announce a disconnected number. I put this SIT tone on my voicemail.
Because I ported my longtime landline number, "Rachel from card services" was leaving me messages several times per day. With my SIT tone trick, she is now long gone. I really don't miss her.
Then your protocol would be broken, my PBX routes calls via the best carrier for a given destination. The CID might be the main 800 line an extension DID or an individuals cellphone (which tend to call forward into DID's for VM and desk phone roll over). Many of those carriers I dont have any DID's with nor do I want any.
It would be fairly easy to require LOA's the same as IPv4 just a nightmare to administrate where once you get big enough the requirement goes away. Looking for odd DID origination is also not that hard.
No sir I dont like it.
How do we know, the drop is not explained by one such big scam operation getting busted?
The scam-calls I'm getting, for example, — 2-3 times per day — do not pretend to be from the IRS' numbers at all...
In Soviet Washington the swamp drains you.
I didn't read them all, but T-Mobile's solution is an app which you install on your smart phone. The description says that it's a free trial and they state up from that it is a paid service. So if you want protection from spam/scam calls you need to pay extra. I get tired of the various carriers nickle and diming you to death.
The PBX predates caller ID.
The PBX was fed with trunk lines which actually phone numbers, usually unrelated to the called number. When an inbound call was made to 555-1000, telco switched that call at the CO to one of the trunk lines. Outbound calls worked basically in reverse, the call went to the PBX which chose an open trunk and completed the call.
Direct Inward Dial (DID) involved buying a block of numbers which had no physical line associated with them and these were programmed to be switched to a trunk at telco with signaling that passed the called party number to the PBX so it could complete the call to the internal extension.
This system had to be adapted to caller ID. Early outbound calls often showed the trunk's phone number, but IIRC you could get telco to basically rewrite those calls to a customer specific number, usually the main number, if your switch lacked the software or signalling to pass the calling extension out.
PBX software eventually got the ability to pass an extension's DID to telco, so caller ID passed to the called party would see the number the call came from, even though it may have passed over an analog trunk with a completely different assigned phone number.
Basically, caller ID has, for anything other than single POTS or cell lines where telco handled all the switching, been a kludge on a system that wasn't built for caller ID, and spoofing was a necessary feature.
The problem all along has been lazy and/or greedy telcos who never bothered to implement sanity testing on spoofed calling party info and just accepted all of it rather than build in checks that the calling party info actually represented numbers assigned to the calling party.
And I'm sure much of it was made worse by call centers, for whom number spoofing was a business feature -- doing business for a company who WANTED call center calls to come up as their numbers. And VOIP vendors who wanted to use IP networks to route calls and unload them onto POTS at the cheapest point, terminating a call from a DID block leased from telco A using circuits leased from carrier B.
from the billions of American dollars that don't get scammed.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
force all call routing tables that all telcos use to be authenticated. Yes that means poor poor multi million dollar businesses will have to pay $100 a year to have their giant VoIP system to be verified and validated. home VoIP is forced to be sent through a certified telco that locks the CID information and disallows ANY changes.
Honestly it could be fixed in only a couple of months if people got off their asses.
Do not look at laser with remaining good eye.
Checking foreign calls to ensure they don't have a local caller ID would go a long way to stopping this. Or you could display "Foreign" before the caller ID for any call that originated outside the trusted network. You could do this for email and text messages as well. Or you could bill the phone company for scam and spam calls so stopping them pays money instead of costing them money.
This does nothing to handle those that bounce their calls off of vulerable VoIP or other devices. This happened to me recently; the ID was of some girl in a local city that has (had, hopefully) an Android phone that has obviously been hacked. It's unlikely someone is going to spend the kind of money required to trace them in this manner, unless they suspect it's a Big Fish they're going to catch.
While a good idea, I am not sure it would be very efficient due to the flow of calls. I could be in woozoo land and use a proxy. Also, due to the way voip traffic is routed, I could use a local provider. I could even rent equipment in the country I am calling if it is a big enough operation
As long as there is no better alternative, landline telecoms see no downside to a lax stance on robocalls. But if I cancel my land line and just use my cell, because I can control how my cell phone responds better, then the landline industry has motivation for attacking the problem. I am going call my telecom and tell them they will lose my business if the industry doesn't get serious on this. I include political calls, surveys, the whole set of unsolicited calls.
Don't step on the baby.
CLID (standard Caller ID) is sent out by the sending phone/PBX, and is not trustworthy. ANI (Automatic Number Identification) is used by telcos for billing info, and it works, Otherwise telcos would be in financial trouble. Yes, it is available, but telcos want to "monetize" it, so they charge an ar and a leg for anybody who orders it.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
You dont seem to get how the PSTN works. Foreign you mean oversea's? so get few buck a month VM via bitcoin and you look like a US PBX now. These guys are not using indian/russian telco's to do this they are back hauling to the US via VoIP as they dont realy care about call quality only cost. It's not uncommon for them to hack legit PBX's to save costs either.
People keep thinking a hack system like we put in place for ipv4 will work but there are billions of DID's ipv4 doesn't work well with only millions of possible networks. Something more analogous to SPF for email is needed.
No sir I dont like it.
Actually, since digital switching began in the 60's and 70's, there have been three fields transmitted with every call (well, a lot more, but these are relevant)
BTN = Bill To Number -- this is the number that the call is billed to. This is actually validated by the connecting carrier, and still is today. In most cases it will be the circuit number, SPID, or an account number for really large customers.
CPN = Calling Party Number -- this is the number that the call is presenting itself as -- the Caller ID if you will. A long time ago, this was always validated by the phone company against the customer's record of DIDs. In the early 90's the LECs started charging companies to open up this field so that they could hide call center numbers, etc. and to make their phone number their brand. In the late 90's some LECs started offering this as a standard feature as a differentiation against other CLECs.
RTN = Route To Number -- this is the number the call is destine to.
This biggest problem is that we started getting a lot of smaller CLECs that didn't understand the technology well enough and started giving everybody closer access to the PSTN (for example, by not watching the CPN they were sending). The problem was exacerbated when VoIP became a thing and CLECs started allowing anybody access to the PSTN with no restrictions and no regard to their physical location.
These scams are hard to track down. I'd venture to say that 80% of them are running on stolen credit cards, on AWS (or other cloud provider) EC2 instances, connected to some VoIP provider that is billing another stolen credit card. They connect their SIP phones from anywhere to the PBX in the cloud and they start. Labor is cheap in other places in the world and with everything being in the cloud they can be pretty much anywhere. If they get shut down, they just use another stolen credit card and launch another EC2 instance and they are back in business a few minutes later.
i use tracfone they don't have a system the even tells you whos calling unless you save the number to you address book.
Jack of all trades,master of none
The real problem with call-id is that you can lie. You can identify the calling party number as any collection of 10 digits (in the US). There is no check. Even this 'Do Not Originate' is a blacklist approach, which as we know has its limits. Rather the system should only allow you to say you are one of the numbers you own, as in those assigned to the line being used, or assigned to the organization which owns the line. Case in point, when a DID enabled desk phone calls out for pizza, the caller-id given is typically the facility main number, not the DID of the phone. They own that number. Scammers lie. They tell the PSTN that they are ogininating from a number they don't own, sometimes a random number. It would not be difficult to put into place a system which screened caller-id to those numbers associated with the owning account, since after all someone is still paying the bill for the line being used. That wouldn't end dialing robots, but at least then when we file a complaint with the Do Not Call registry we would have the information of the actual offending company.
Spoof call to the grandparents or a scam call? Need an option next to # sign to send a homing package of thermite to the source.
. . . .thanks to your crappy VoIP service, we shut down our landline **just prior** to the blizzard of political robocall spam. Because that's what it is: Unsolicited and Commercial. . .
Of course, that won't stop them from trying to call our cell phones, but the target is at least more diffuse.
As for the Republic, I fear that it is dead, but don't worry, the American Empire has replaced it.
Ave, President-Imperator, nos morituri te salutabat. . . . .
(evil grin)
(We'll say this as many times as we have to in order to get our message across.)
8 Simple Rules For NOT Dialing My Number:
1. If you're selling something don't call me. Period. If I want something I'll call you.
2. If you're a politician or a pollster don't call me. Period.
3. If I don't recognize your number you're going to voice mail. Get over it and leave a message.
4. If Caller ID is blocked, missing, or obviously spoofed you're going to voice mail. Get over that, too, and leave a message.
5. Every carrier should have the ability and facility in this day and age to "Back Bill" any call, anywhere. If a "boiler room," or even my own mother, calls me I should be able to dial "*BACB" (or something similar) and charge them some nominal amount for the call to the device that I'm paying the bill for if I don't want them contacting me.
6. Spoofing Caller ID information should be considered Wire Fraud and therefore illegal.
7. I'm paying for my air time on my cellular phone even when you call me, that makes it trespassing if I don't want you there and I should be able to prosecute you if you become a nuisance.
8. Unsolicited Text Messages are no different from Unsolicited Voice Calls and therefore no exception to the above rules.
9. Bonus Rule: Wireless carriers should enact voluntary number blocking/filtering systems with no arbitrary limits (like, say, MORE than 5 numbers, Verizon Wireless) with Opt-IN policies (NOT Opt-OUT) for scam services like Premium Text Messages.
That drop in IRS calls could also be due to the recent bust of the Indian scammers behind it all. As for the DNO, what's to stop some company setting up an automated phone routing center in BFE South Dakota? VOIP from India to the routing center where the calls would originate.
The seemed to find a way to nail people under the "IRS scam" that was going around. I'd imagine that they could do something about this if they were so inclined.
My first thought is that a non-local-originating caller should not be able to display a local number. If they want a North American # then they should have at least a local satellite office.
I want the people who call and harass me arrested and jailed.