Caller ID Spoof and Text Spams – How do they work?

Question

(Posted here after a comment/suggestion from: http://superuser.com/questions/254340/caller-id-spoof-and-text-spams-how-do-they-work. Apologies if deemed not appropraite)

A lot of people will have at some point received a spam text offering some sort of help via a debt settlement order, or help claiming for an accident that they have never had. I’ve noticed these are prevalent in both the US and UK, and expect other nationals will have similar stories. For those that haven’t, you receive a text message out of the blue from a seemingly ‘personal’ number, and are then encouraged to “text YES if you’re interested, or NO to stop”. It’s clearly a sham, but some people are inevitably drawn in.

After receiving one myself, I blogged about it (warning people not to reply), and within a month it was getting 1000+ hot and 50+ comments per day (staggering for a small independent blogger like me) – most respondents posting different originating numbers.

I’m keen on doing a follow up story, so, really, my broad question is, how on earth do they work? What I know is based on a lot of guesswork and assumptions, and may be wildly erroneous so something more concrete would be marvellous.

As far as I can tell, when you reply to a message it gets added to a database somewhere, and the record is sold to a company offering that line of business.

My research has lead me to one company (leadex.com – [deliberately unlinked]) that appear to specialise in this sort of harvesting. I’m guessing that their clients have some sort of online alert configured, upon which their operatives can then take action (i.e. call the number). Moreover, I’ve encountered some projects on freelancer.com, posted by people/companies that seem to want this sort of infrastructure set up (click for example project)

I’ve also come to understand that it’s possible the messages themselves are being sent from a single source, which is itself spoofing the numbers to ones that the company is able to monitor. Respondents to the article have also reported that when they call the number it goes through to a standard network provider voice mailbox.

But, I’m still not entirely sure. Can anyone help?

• What sort of equipment, infrastructure, software, etc will they require?
• How are they able to obtain such large batches of numbers – do the network operators sell them in this way?
• Given that they these ‘batches’ of numbers, so how are they able to setup and monitor them (is everything redirected to a single source).
• How permanent/transient is this setup? I.e. are numbers only ‘Live’ for a short period of time.

And absolutely anything else, which might be of relevance/interest

I’ll be linking back to this question from the post, and including any relevant links that people include as well – happy to link to personal blogs as well.

Many thanks for your help in advance.

James

Answer 1

I got one of these messages the other day and so did a few of my friends, so I know exactly what your talking about. I did not txt back and as I'm sure you know you shouldn't txt back unless you know its a legitimate service. Unfortunately one of my friends did txt back saying STOP and now he's getting loads of spam messages as they know his phone is active.

I previously worked for a phone company, so I have an idea of how a lot of this stuff is pulled off.

The answers to your questions all really depend on what scam they are trying to pull. Are they just interested in getting a list of active numbers for a sucker list of future scams or are they trying to actually scam them using this message.

• What sort of equipment, infrastructure, software, etc will they require?
  • You can spoof a CallerID to perhaps persuade the user that you are someone that you are not by using a voip account and a server running Asterik. See this article Caller ID Spoofing w/ Asterisk
• How are they able to obtain such large batches of numbers – do the network operators sell them in this way?
  • Depending on the numbers if they are actually mobile numbers and they need a reply as part of the scam, its more than likely that they have just got a hold of a load of SIM cards you can buy them in bulk from eBay and other places. Just have a google you can get sim cards for less than 50p a go.
• Given that they have these ‘batches’ of numbers, how are they able to setup and monitor them (is everything redirected to a single source).
  • Asterik again can be used to handle large volumes of numbers. They may also use a third party to redirect their calls.
• How permanent/transient is this setup? I.e. are numbers only ‘Live’ for a short period of time.
  • Dependant on how they get the numbers its most likely they will only be live for a short period as the network providers are usually quite hot on cutting off scammers.

Answer 2

Although its been answered, just to add a bit to Marks reply:

• What sort of equipment, infrastructure, software, etc will they require?

For outgoing voice calls, nothing more than a telephone switch (POTS, VOIP, ISDN - it doesn't really matter) the trick is finding an upstream provider that will let you push out CLIDs not within your allocation - AFAIK, this is very tricky in the UK - but trivial in a lot of other countries (particularly developing countries and Eastern Europe).

For incoming voice calls - yes, most providers will let you buy blocks of numbers - usually they are tied to a connection service but they don't have to be. And again, it just needs a telephony switch to route all the numbers to the end points you choose.

For SMS messages its a lot easier - most aggregators provide an API (often HTTP) through which you can send SMS messages - and even in the UK, they're usually not too bothered about the source address you put on them (it's common to have a premium 'shortcode' MO with one aggregator - they are difficult to transfer - and to shop around for the best rats for outgoing - MT - messages).

• How are they able to obtain such large batches of numbers – do the network operators sell them in this way?

Probably not - but there is a huge black market (even within the UK - although its a lot less high profile) in selling lists of numbers - how many companies have you provided your number to. Then there's harvesters targeting Outlook/hotmail address books, and plain old-fashioned war-dialling