54

My late brother was contacted by someone on landline number operated by a carrier in Australia and which displayed on caller ID. I traced the number to a company and though they did call him on a number of occasions from this number over a couple of days, they did not make the particular call in question which occurred in the same time frame.

This has left me asking, is it possible someone could hack in and use their telephone number to phone my brother?

The company is a financial services company and they were set up to make outbound calls using various landline numbers programmed into an auto dialler machine or possibly cloud-based phone system. They have been very cooperative and I am confident they did not make the call in question. I have also established the identity of the person who made the call to my brother, but how on earth did he get one of the company landline numbers to show in caller ID? This has me stumped.

  • 8
    "or possibly cloud based phone system" If this is the case, then – presumably – any other company could be using the same cloud-based system, and the land-line number belongs to the cloud company and not the financial services company. – TripeHound Jun 13 at 9:22
  • 2
    Not a full answer but an interesting listen on a piece that Reply All did about this topic gimletmedia.com/shows/reply-all/awhk76 – VerasVitas Jun 13 at 17:07
  • 7
    Related tidbit from the FCC's website: "[S]poofing is not always illegal. There are legitimate, legal uses for spoofing, like when a doctor calls a patient from her personal mobile phone and displays the office number rather than the personal phone number or a business displays its toll-free call-back number." I know you're asking about how, but their article mentions some of the why it can be faked which visitors to this question may want to know about. – Davy M Jun 13 at 18:27
  • 1
    Also see Caller ID (CID) on Wikipedia. The article provides the details, including the protocols used by the telephone company. It also discusses some of the scams, like Dip Fee Fraud. You really need access to the Automatic Number Identification (ANI) data. That's the information telcos use for billing purposes. ANI is accurate, unlike CID. When call traces are performed the ANI is recorded, not the CID. – user29925 Jun 13 at 21:52
  • 1
    Does anything of this has to do with your brothers death? Otherwise I would suggest to remove the 'late' – Kami Kaze Jun 14 at 8:17
101

Ars Technica did a superb piece on this a couple of years ago. A woman who is a real estate agent and publishes her cell phone, was inundated with junk calls. What was odd about these was

  • They were fully automated calls
  • They never played a message
  • They used a different number every time

They detailed her nightmare

On the first night, France went to bed, slept for 7.5 hours, and woke up to 225 missed calls, she said. The calls continued at roughly the same pace for the rest of the five-day stretch, putting the number of calls at somewhere around 700 a day.

France installed robocall blocking tools on her phone, but they didn't stop the flood. Unfortunately, anti-robocall services that rely primarily on blacklists of known scam numbers generally don't block calls when the Caller ID has been spoofed to hide the caller's true number.

They included this quote from a security researcher (emphasis mine)

Because it's an old, circuit-switched network, none of the switches along the way need to know who actually is placing the call. I was shocked to find out that the Caller ID is just an optional part of the original address message that gets sent along. You don't need it, and nobody is checking it along the way for authenticity, and, really this means you can put that to be whatever you want. To top it off, there are a lot of online services that allow you to send out phone calls and specify exactly what Caller ID you want them to come from.

I've had to explain this to numerous family and friends. The pinnacle there was my father-in-law, who called me up one day to ask how he got robo-dialed from his own number. I even get random calls sometimes from people saying "I'm returning your call" when I have no idea who they even are, let alone know how to call them.

Caller ID is never verified. That is hard to explain to most people, because their cell phone sends a proper ID and they can't easily spoof it. But the rise of VOIP, combined with the plummeting cost of phone calls in general and turnkey software that makes spoofing a breeze, has made this an incredibly cheap way to spam and scam people, especially from abroad. The FCC is proposing some changes to address this, but those changes are likely years off.

  • 13
    Try one of those caller-id spoofs on 911 (actually don't). They aren't fooled. The debate is now why can't everybody have that. – Joshua Jun 13 at 18:21
  • 8
    @Joshua That's probably due to the fact that 911 centers tend to get more call data overall anyways (they have a legitimate need to know where you are) – Machavity Jun 13 at 18:29
  • 28
    @Joshua, Caller ID is spoofable because businesses need it to be spoofable: every physical line has a different phone number. Businesses want their outgoing calls to all show as coming from their published/"official" number rather than the number of whichever wire it happened to end up on. There's a second phone number also associated with every call: the one used for billing purposes. This one is impossible to spoof, and is the one that 911 gets (because they need to know which physical location to dispatch to, not which organization is calling them). – Mark Jun 13 at 19:37
  • 7
    @Mark While that's true, VOIP has made that process a lot harder to track down. In this case here the numbers came from a VOIP server, which had been connected to a VPN. You can eventually find the people, it's just time consuming and difficult. – Machavity Jun 13 at 19:46
  • 4
    @Mark: Not each physical line has its own number; businesses typically have a PBX (Private Branch Exchange). That PBX has far more numbers than physical lines. E.g. a common physical office connection was a T1 - 24 physical lines, which might support a block of 100 numbers, and the association was entirely dynamic. The Central Switch would route any number in the block to the PBX, using any free line. Now it is also clear why you need CLIP - the PBX needs to send which internal phone was used as the physical line is meaningless – MSalters Jun 13 at 20:50
30

Security of the PSTN is horrifically poor. It's very easy to spoof anyone's number on Caller ID, without having to hack into any of their systems. As such, Caller ID provides no real assurance of who actually called you. There are even services available that the general public can use (for a small fee) to spoof any number they want.

  • 1
    That is supposed to change soon, at least in the US. Also see Caller ID Authentication and the SHAKEN and STIR protocols. My guess is, the authentication will get stronger but carriers like Verizon will still let the viral calls pass to subscribers. Verizon has no economic disincentive to stop them, and an economic incentive to allow them (like when providing service to the spammer). I also project carriers won't provide the information to subscribers, so the subscribers will be just as ignorant to who is calling. – user29925 Jun 15 at 21:54
28

The CallerID displayed on the phone was never designed to be secure. Most VoIP (telephone over the internet) providers will allow the end user to set the outgoing number to be whatever they want. There's good reasons for this, one of which is your incoming provider doesn't have to be (and often isn't) your outgoing provider.

This is commonly seen in spam calls in the US, where robo-callers will set their callerID to be in the same local calling area, or sometimes also the first three digits after the area code, to be the same as the called party number in an attempt to fool the caller into thinking it's a neighbor, or someone they might know rather than a Long Distance caller.

  • 22
    "There's good reasons for this." No, there really aren't. Plenty of bad ones, though. – Mason Wheeler Jun 13 at 14:43
  • 7
    @MasonWheeler Not exactly. What I said about the incoming and outgoing carrier is true. How is the outgoing carrier supposed to verify that you "own" the phone number your callerID is set to? There is a new very recent verification framework in the works that attempts to verify the callerID, but it'll take years to implement across carriers. The problem isn't diss-similar to verifying the from: address in SMTP. – Steve Sether Jun 13 at 15:34
  • 12
    "It'll take years to implement across carriers." No, it really won't. See the promoted comments in the Ars article you linked to: set up a deadline and say "if you don't have this implemented by this day, you will be cut off from the network," and I guarantee you every provider will dedicate the necessary resources to get it implemented on time. Also, this has been a known problem for a long time; there's no good reason why they shouldn't have started on this over 20 years ago! – Mason Wheeler Jun 13 at 15:39
  • 6
    That's what I mean when I say all the reasons for this are bad ones: it's entirely due to bad decisions on the part of the telephone companies that things got to be the way they currently are. They chose to be lazy, they chose not to make needed upgrades in order to save money, they chose to let their customers suffer. None of it was necessary, and none of it was legitimate. – Mason Wheeler Jun 13 at 15:40
  • 9
    @MasonWheeler That's how all utilities are since they're regulated monopolies. They won't do anything until forced. That's why we need regulatory agencies like the FCC. The recent legislation is encouraging, but given how slowly things happen, I wouldn't hold my breath. – Steve Sether Jun 13 at 15:49
1

The simile I generally use for less technical people is that the caller ID is like the return address on a envelope sent through the post, and you shouldn't trust it any more than you trust that. Most people don't fake it because they're interested in getting back, but anybody can write anything they want in that spot.

(I provide no technical explanation here because the other answers already do a great job of that.)

1

There are even Android apps (example) which allow spoofing the caller ID. You can enter pretty much anything in them, including a landline number or even a number which can't be dialed.

0

Very much similar to the way that an email's from and reply-to headers can be spoofed (but worse because at least you can inspect an email's headers and see what's going on). I recently had to block my own phone number because someone was spoofing calls to my phone from my own number. Anyone with an asterisks box and an IQ -gt 90 can make calls with fake CID info.

-1

There are three possible methods:

The least likely is that someone splices into a landline. Yes, this is extremely low probability, but the possibility remains.

Second, which is easier is to hack into the robocaller system and add an extra call. Unlikely in your brother's case if he spoke to a live person, not just received a message.

The VoIP is the simplest method and doesn't take much effort. No effort at all if the VoIP provider neglects to restrict the calling party ID. Mine did when I was initially working on VoIP programming and I had lots of fun spoofing my friends.

See: https://www.tripwire.com/state-of-security/featured/caller-id-spoofing/

and: https://www.spoofcard.com/

  • 1
    Even if the VoIP provider is restricting the caller ID they let you (the VoIP account holder) set to show to a number you've demonstrated control over, it's trivial to spoof caller ID using any VoIP provider that lets you forward incoming VoIP calls to a phone number. You just setup the forwarding to target the number you want to call, and place a purely-VoIP (sip protocol) call from outside your provider's service into it, putting whatever number you want in the SIP headers (same as From: spoofing for email). – R.. Jun 14 at 1:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.