1

If we assume that the human element is unable or not skilled enough to discover a phishing attempt (or some other malicious endeavor that can be perpetrated verbally), what forms of defense can be deployed to aid in the authentication of a telephone call?

Specific example - if a telephone call is coming from a spoofed number:

  • Can it be detected?
  • Can it be prevented?

Primarily interested in the userland (or the equivalent enterprise) context, meaning "below" the provider. Although any musings or explanations that involves or references the provider would certainly be interesting, even if not directly useful.

Media where I live enjoys claiming you can't "defend" against these types of attacks/spoofs using strictly technical means -- are they right?

Improve this question
  • Not currently available AFAIK, but I'm sure someone could automate the normally human action of "hangup and call back the number you just read off the caller-ID". That way, if the number was spoofed the receiving line would just dial out to the real number it just read. – WorseDoughnut Mar 31 '16 at 14:31
  • @WorseDoughnut - unless the caller subverted the switching equipment... – Deer Hunter Mar 31 '16 at 15:05
  • @DeerHunter You're right, but I'm assuming you've got a much bigger issue at hand if the attacker has physical access to that degree... – WorseDoughnut Mar 31 '16 at 15:07
  • 2
    @WorseDoughnut - could be a tap at the box near you, FWIW. – Deer Hunter Mar 31 '16 at 15:24
1

In the plain old telephone system (and also avionic communication systems) authentication is built into the communication.

Key exchange is also done previously by meeting people. (In case of avionics by meeting pilots and the command center operators).

Authentication itself is done by human ear by recognizing the human voice.

(I am pretty serious. You cannot encrypt safety-critical hardware in avionics. A malfunction may happen in the air. The "safest" way is not to encrypt at all.)

Improve this answer
0

The "regular" phone calls are not capable of that unless you are willing to ask the other person a password every time they get in touch with you. Using VoIP and various apps you can involve asymmetric key cryptography and such to authenticate and secure calls.

Improve this answer
0

By the time your phone has received the call, "authentication" has already happened and failed to catch the spoof. Your phone trusts your phone company, which is telling it that the caller is calling from a number. Other than that, phones don't perform authentication against the other number, simply because there is no system in place that actually proves a number's "identity", like certificates for internet connections. The only technical deterrent for scam callers I am aware of is downloading an application with a blacklist of numbers that either warns the user or automatically drops the call if it is coming from a blacklisted number. It seems that scammers tend to spoof one number and use that for their cold calls, so this is actually pretty effective, but probably would not work against a scam targeted at the particular phone user (since they would use a fresh spoofed number).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.