Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm performing a penetration test against a company. Part of my social engineering procedure is to contact the IT department and try to convince them to that I'm an employee in the company and get them to reveal some sensitive information including passwords.

How can I make my call more convincing by making it appear as if it came from some employee's phone number?

[This is a hypothetical question, created to preserve my deleted answer on this question]

share|improve this question
    
While it is possible to spoof caller ID information, it is a lot less likely that you are going to be able to convince a local PBX that you are an internal caller. Since their internal system likely has control of internal extensions and they are probably not directly on external lines when calling internally, your call would appear from an outside number through the trunk with a number that should be an internal extension. You might have better luck if you use a home phone number though and claim to be from a sick employee who is trying to connect in remotely. –  AJ Henderson Jun 5 '13 at 13:30
    
@AJHenderson Or you're currently at the customer's premises calling from your cellphone, or you're the boss on vacation and you want to check your email, or or or... –  Adnan Jun 5 '13 at 13:33
    
Yeah, I was just highlighting that you would want to use a number that isn't internal. Just an observation that wasn't in the original question and thought was worth noting. –  AJ Henderson Jun 5 '13 at 13:46
1  
Adnan already answered this from the technological perspective, so I will just heap on the following. If you're in the United States, be advised of the "[Truth In Caller ID Act][1]" [1]: fcc.gov/guides/caller-id-and-spoofing –  munkeyoto Jun 5 '13 at 14:48
1  
@EricG That's a different question, and exactly because of that I asked this question. That one asks about forwarding a call through the other phone and make it appear in the other phone's internal logs and the phone's provider's logs. –  Adnan Jun 5 '13 at 16:41

1 Answer 1

up vote 15 down vote accepted

There are many VoIP services that provide ID-spoofing functionality

  • Jumblo: Create an account and add some credit to it (10 Euros minimum excluding VAT), then install their Android app, login, the go to Settings and choose "Add Caller ID" then add the number. (Requires SMS verification) *

    enter image description here

  • Skype: You can create an online number (15 Euros minimum) then add some credit to it (10 Euros minimum). Then go to the Caller ID page, and add the number you want. (Requires SMS verification) *

    enter image description here

  • SpoofCard (10 U.S. Dollars minimum) (No SMS verification required)

  • SpoofTell (0.10 U.S. Dollars per call) (No SMS verification required)

* One way to acquire the SMS verification code from the target phone is by configuring the Caller ID number at the time the employee has left their phone unattended at a restaurant or a bar. Another possibility is by stopping the employee in the street and asking them to borrow their phone for an urgent call.

share|improve this answer
1  
Adnan has some good examples here, but basically to spoof the caller ID you need a VoIP provider that will let you enter a CID number (basically all of them) and a VoIP phone or app that lets you enter the Caller ID name. ....or access to a PBX with a digital connection to the POTS (T1 or other PRI), the phone company will trust the CID given to it by a PBX. –  Rod MacPherson Jun 6 '13 at 3:20
    
thank you very much! I started using Jumblo and it really helped me –  Green Fly Jun 11 '13 at 11:52

protected by Gilles Jul 21 at 11:34

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.