'Robocall Strike Force' Proposal Could Stop Caller ID Spoofing (onthewire.io) 97
This summer the FCC convened a "Robocall Task Force" to help consumers fight unwanted automated telemarketers, and Wednesday the coalition finally delivered a report recommending a "Do Not Originate" list so carriers could spot spoofed numbers which should be blocked.
A trial of the "DNO" list that's been running for the last few weeks on some IRS numbers has resulted in a 90 percent drop in the volume of IRS scam calls, officials from AT&T, which leads the strike force, said during the FCC meeting Wednesday. The carriers on the strike force, which include Sprint, Verizon, and many others, plan to continue testing the DNO list in the coming months, with the intent to fully implement it some time next year...
The strike force members also are working on a system to classify calls into categories, such as political or charity, as a way to give consumers more information before they answer calls from unknown numbers. And, the group said it has developed a working solution for authentication between VoIP applications and traditional landline networks as another way to defeat spoofing from callers in foreign countries.
Early next year they're planning larger tests -- and the strike force has also created a new site describing how to block and report robocalls.
The strike force members also are working on a system to classify calls into categories, such as political or charity, as a way to give consumers more information before they answer calls from unknown numbers. And, the group said it has developed a working solution for authentication between VoIP applications and traditional landline networks as another way to defeat spoofing from callers in foreign countries.
Early next year they're planning larger tests -- and the strike force has also created a new site describing how to block and report robocalls.
yes, and (Score:1)
It pays for itself (Score:2)
Re: (Score:2)
the task force pays for itself... from the untold billions the carriers made on every spam / scam call they put thru to you.
Pretty sure they don't make billions per call.
Much needed (Score:1)
Re: (Score:1)
I would say about 90% of all landline calls are spam at this point.
I put the political calls in that category too - and they're all robocalls.
And for some reason, a lot of them think that a robocall with their wife on it actually makes a difference. And if those robocalls actually make a difference, well my opinion of the American people cannot get any lower.
My opinion of the US Electorate is at an all time low and I finally realized the genius of our Founding Fathers for making us a Republic and not a Democracy. Just look at most of the comments to that poll to the right
Thank you, CrimeCast. . . (Score:2)
. . . .thanks to your crappy VoIP service, we shut down our landline **just prior** to the blizzard of political robocall spam. Because that's what it is: Unsolicited and Commercial. . .
Of course, that won't stop them from trying to call our cell phones, but the target is at least more diffuse.
As for the Republic, I fear that it is dead, but don't worry, the American Empire has replaced it.
Ave, President-Imperator, nos morituri te salutabat. . . . .
(evil grin)
Re: (Score:2)
Re: (Score:1)
It's bitztream, the autism-hating, custom-epiPen-hating Slashdot troll!
Re: (Score:3)
Spoofing is a relative term. As TFA uses it, you are not spoofing since you are sending out a number that actually belongs to you. The ones they're talking about spoof the number of a legitimate business of government agency that does not belong to them.
Re: (Score:1)
I have toyed with the idea of turning my land line into a 1-900 number so that the robocallers have to pay me to talk to the box.
Why are they messing about? (Score:5, Funny)
Why are they even messing about with this?
Require mandatory jail sentences for anybody installing/operating this equipment and the problem will disappear overnight.
The same goes for a lot of other crap the people have to put up with. Start throwing more scumbags in jail and the scumbags will stop doing it.
Maybe a general "scumbag" law that can be applied retroactively to people who try to beat the system. If a jury decides that somebody is being a 'scumbag' then anybody with a history of the behavior being judged can have the law applied to them.
Vote for me in the next election!
Comment removed (Score:4, Interesting)
Re: (Score:1)
Because all those scumbag murderers already in jail has stopped people from committing murders. The same with rapists, child molesters, animal abusers, financial fraud and so on.
It would be much cheaper to simply execute them since it serves two purposes.
1) The criminals would be gotten rid of rather than being coddled by taxpayer money. They wouldn't be able to get out and go back to their criminal ways.
2) It woul
Re:Why are they messing about? (Score:5, Informative)
Re: (Score:1)
Yeah. I'm in favour of all cold calling being made a crime. For me death alone is not enough, I would give them a choice between impalement and crucifixion. Since most of them are abroad in places like India or Pakistan I would be in favour of using drone strikes to take out the call centres.
That would teach them.
We get a lot of cold calls..
Re: (Score:2)
Re: (Score:3)
Yep. If you're installing a call center then you should make sure of the credentials of the people asking you to do it.
This will be done by that person giving you a copy their installation permit and you looking up the permit on the government website to see if it checks out (correct person, correct address, correct installation date, etc).
I may be cruel, but I'm just.
Re: (Score:2)
Re:Why are they messing about? (Score:5, Insightful)
The problem is that most of these scam calls are originating from outside the United States. Our laws can't do much outside the US without a lot of legal paperwork -- and in most cases it won't be worth it.
One easy solution is to give consumers access to the BTN or Bill-To phone number. This is the number that is being billed for the call -- essentially pinning down the place where the call is being switched into the PSTN. If you get the BTN, you get the person behind the call -- regardless of what their Caller ID is. Unfortunately, right now, the only way to get access to the BTN is via the SS7 protocol (not available to consumers), or to compel your phone company to give it via a subpoena. Enough abuse from a single BTN -- cut them off until they can clean up their act.
Re: Why are they messing about? (Score:2)
Then they can find a way to make it available.
Re: (Score:1)
"Our laws can't do much outside the US"
Who says you have to do anything outside of the US? Require that all interconnections telcoms routing calls into the US either provide a legitimate caller ID, or a specific "unknown number"/"private number" code that consumers can block calls from if they desire. Any interconnection telcom that doesn't conform to this requirement gets blocked from the US telephone network.
IRS scam (Score:1)
The seemed to find a way to nail people under the "IRS scam" that was going around. I'd imagine that they could do something about this if they were so inclined.
My first thought is that a non-local-originating caller should not be able to display a local number. If they want a North American # then they should have at least a local satellite office.
Why is that legal in the first place? (Score:3)
We're all too happy to outlaw things that have no legal purpose, even if they do. Care to inform me what legal purpose spoofing caller ID could possibly have?
Re:Why is that legal in the first place? (Score:5, Informative)
Re: (Score:3)
You explanation is perfectly valid for why a business might assert a particular CID that is valid within the company, but not what carriers allow people to assert any CID not registered to that individual or company.
The only way to solve this problem is to make the carriers accountable for allowing such behavior. To be clear, I am less concerned about unwanted calls and much more concerned about scammers. If a carrier allows scammers to forge their identities then the carriers are complicit in the scammer
Re: (Score:2)
You explanation is perfectly valid for why a business might assert a particular CID that is valid within the company, but not what carriers allow people to assert any CID not registered to that individual or company.
Because when the system was put in place no one foresaw VOIP and the extremely low barrier to entry for doing this. So they didn't design the system with misuse of the CID assignment from a PBX in mind. So they went with the simpler implementation and then technology happened.
Re: (Score:3)
VoIP is actually irrelevant; there is still a hand-off from a customer to a carrier in order for the call to be connected outside of a local network. There will either be a voice gateway with PRIs or some sort of SIP trunk. The carrier has the option of restricting CIDs but few do.
Re: (Score:3)
I was given the option by my local carrier for the company PRI. I chose to only allow the DIDs that we lease. Not that I was going to spoof, but if someone got in via SIP to our system at least it would get back to me so I could investigate and fix.
Re: (Score:2)
Re: (Score:2)
Maybe read the entire reply first before getting all indignant. The existing protocols carry sufficient information for carriers to lock customers into displaying only CIDs that the customer is authorized to display. Carrier equipment has had the ability to lock PRIs to customer CIDs for the past 20 years that I am aware of, likely much longer. VoIP still relies on a carrier unless you are talking about a limited VoIP deployment within a contained network. At the point of ingress a carrier can block una
Re: (Score:2)
Re: (Score:2)
Only the people behind closed doors know why the telcos did not require this, but in my experience it is likely for a few reasons:
1) Without a good architecture and integrated process managing CIDs requires an amount of administrative overhead
2) Telcos could not figure out how to charge customers for locking down CIDs
3) Locking down CIDs reduces call volumes and exchange fees
Re: (Score:2)
There would have to be some manual verification process to cover cases where several companies share a number (for example, a contract customer service call center) or one company uses numbers from several providers, since these would not appear on the same bill. That should be as simple as di
Re: (Score:2)
Well said!
Re: (Score:2)
Incidentally, I just got a call from my local DMV office to remind me of an appointment I have later this week. I didn't answer because they user the international format for their DID, so I assumed it was a scammer because, well, most calls from 800 numbers are scams and this one made itself look extra suspicious. If they hadn't left a message, I wouldn't have known who called in order to call back to c
Re: (Score:2)
You are very welcome. I have not seen your other posts.
I agree with you on the CID spoofing. I never answer calls unless I know the number. People can leave a message. If it is legitimate then I'll add them to my address book.
Re: (Score:2)
That's the one valid use for this, but that could be implemented without allowing general spoofing. Between that and allowing people to block caller ID altogether (which most normal people wouldn't do and would guarantee that a telemarketer call wouldn't be answered), are there any other cases that warrant allowing the caller to arbitrarily set their own ID?
Re: (Score:2)
I'm not the the OP, oh ye of poor reading skills, so my first question was for a list of compelling reasons to keep a clearly broken design that only benefits telemarketers and some businesses and presents constant problems for every other user of the system.
We here are the sort of people who design systems, so we need to design a system that doesn't facilitate arbitrary ID spoofing. Your "look up how VOIP works" comment makes me think that you're not a designer of systems, but a lever-pulling operator monk
Re: (Score:2)
All businesses use it to make the call appear to come from the general office number. So if an employee calls someone they don't get the direct number to that employee, just the general business number.
The sensible thing to do would be to have a "callback" number as well as a "from" number. The "callback" number could be set to the business' general office number, but it should be impossible to change the "from" number.
Re:Why is that possible in the first place? (Score:2)
Why is it possible in the first place?
If I were to design a protocol of this kind, one of the first measures I would take, in the protocol itself if relevant and in any implementation, would be to check that peer-provided source addresses match the routing system, making spoofing impossible. I cannot fathom that the people who designed this particular protocol did not do the same from the beginning, and even more so that they did not fix it since then.
Re: (Score:2)
Then your protocol would be broken, my PBX routes calls via the best carrier for a given destination. The CID might be the main 800 line an extension DID or an individuals cellphone (which tend to call forward into DID's for VM and desk phone roll over). Many of those carriers I dont have any DID's with nor do I want any.
It would be fairly easy to require LOA's the same as IPv4 just a nightmare to administrate where once you get big enough the requirement goes away. Looking for odd DID origination is als
Re: (Score:2)
Re: (Score:2)
You dont seem to get how the PSTN works. Foreign you mean oversea's? so get few buck a month VM via bitcoin and you look like a US PBX now. These guys are not using indian/russian telco's to do this they are back hauling to the US via VoIP as they dont realy care about call quality only cost. It's not uncommon for them to hack legit PBX's to save costs either.
People keep thinking a hack system like we put in place for ipv4 will work but there are billions of DID's ipv4 doesn't work well with only million
Re:Why is that possible in the first place? (Score:5, Informative)
The PBX predates caller ID.
The PBX was fed with trunk lines which actually phone numbers, usually unrelated to the called number. When an inbound call was made to 555-1000, telco switched that call at the CO to one of the trunk lines. Outbound calls worked basically in reverse, the call went to the PBX which chose an open trunk and completed the call.
Direct Inward Dial (DID) involved buying a block of numbers which had no physical line associated with them and these were programmed to be switched to a trunk at telco with signaling that passed the called party number to the PBX so it could complete the call to the internal extension.
This system had to be adapted to caller ID. Early outbound calls often showed the trunk's phone number, but IIRC you could get telco to basically rewrite those calls to a customer specific number, usually the main number, if your switch lacked the software or signalling to pass the calling extension out.
PBX software eventually got the ability to pass an extension's DID to telco, so caller ID passed to the called party would see the number the call came from, even though it may have passed over an analog trunk with a completely different assigned phone number.
Basically, caller ID has, for anything other than single POTS or cell lines where telco handled all the switching, been a kludge on a system that wasn't built for caller ID, and spoofing was a necessary feature.
The problem all along has been lazy and/or greedy telcos who never bothered to implement sanity testing on spoofed calling party info and just accepted all of it rather than build in checks that the calling party info actually represented numbers assigned to the calling party.
And I'm sure much of it was made worse by call centers, for whom number spoofing was a business feature -- doing business for a company who WANTED call center calls to come up as their numbers. And VOIP vendors who wanted to use IP networks to route calls and unload them onto POTS at the cheapest point, terminating a call from a DID block leased from telco A using circuits leased from carrier B.
Re:Why is that possible in the first place? (Score:5, Informative)
Actually, since digital switching began in the 60's and 70's, there have been three fields transmitted with every call (well, a lot more, but these are relevant)
BTN = Bill To Number -- this is the number that the call is billed to. This is actually validated by the connecting carrier, and still is today. In most cases it will be the circuit number, SPID, or an account number for really large customers.
CPN = Calling Party Number -- this is the number that the call is presenting itself as -- the Caller ID if you will. A long time ago, this was always validated by the phone company against the customer's record of DIDs. In the early 90's the LECs started charging companies to open up this field so that they could hide call center numbers, etc. and to make their phone number their brand. In the late 90's some LECs started offering this as a standard feature as a differentiation against other CLECs.
RTN = Route To Number -- this is the number the call is destine to.
This biggest problem is that we started getting a lot of smaller CLECs that didn't understand the technology well enough and started giving everybody closer access to the PSTN (for example, by not watching the CPN they were sending). The problem was exacerbated when VoIP became a thing and CLECs started allowing anybody access to the PSTN with no restrictions and no regard to their physical location.
These scams are hard to track down. I'd venture to say that 80% of them are running on stolen credit cards, on AWS (or other cloud provider) EC2 instances, connected to some VoIP provider that is billing another stolen credit card. They connect their SIP phones from anywhere to the PBX in the cloud and they start. Labor is cheap in other places in the world and with everything being in the cloud they can be pretty much anywhere. If they get shut down, they just use another stolen credit card and launch another EC2 instance and they are back in business a few minutes later.
Re: (Score:1)
I used to work for a company that would make automated calls on behalf of our clients to people with existing business relationships or optins (club memberships, renewal notifications, etc.). One of the selling points was that we would spoof the caller id to make it look like it was coming from the store/location that they had made a purchase from or had registered at, that way they would a) know who was calling them and b) could use redial to call back and get that store/location.
Everything was legit, thi
Re: (Score:2)
Trust (Score:2)
Why did we design systems which implicitly trust the information provided by a sender? Why are packets that claim they are from an IP address that doesn't belong to that ISP or phone numbers that don't below to a specific service not immediately blocked at the first router?
SIT trust (Score:2)
The PSTN/POTS trust design is likely older than both of us combined.
Fortunately, autodialers also must trust "Special Information Tones" (SIT) that announce a disconnected number [lifehacker.com]. I put this SIT tone on my voicemail.
Because I ported my longtime landline number, "Rachel from card services" was leaving me messages several times per day. With my SIT tone trick, she is now long gone. I really don't miss her.
Re: (Score:2)
Sure, autodialers, by law are supposed to trust those tones. Guess what -- the people making these scam calls don't care, and often don't respect them.
Re: (Score:1)
The trust model predates most people on this site. In the olden days calls cost money, long distance calls cost lots of money, spam calls were therefore not profitable. Without an incentive to exploit it, the broken trust model wasn't an issue.
Today spam calls are profitable, and the carriers have an incentive to let as many calls as possible complete so that they can skim some revenue off the top. The "enumerated prohibition" model of the do-not-originate list is clearly intended to have as many gaps as po
Re: (Score:2)
Have fun getting that to work I have hundreds of DID's for the work PBX. I have multiple carriers. Any DID might go out any carrier. Ever sales monkey seems to want thier company cellphone as their outbound CID from their desk phone.
Now take my home PBX I make 800 calls out as my work phone because I actualy make money doing so. I use my cell phone as my outbound CID because that is the number people know been the same since the 90's and frankly voip sms is not fully baked yet.
Blocking the scammers with
Re: (Score:2)
An appropriately accountable system could be designed, even if it ultimately ended up costing businesses some money or flexibility in their setup. Keeping an obviously broken system because you actually make money using it does not typically register as a valid reason to everyone else.
Re: (Score:2)
Replacing an existing system that spans the world is a massive task Your still going to need trust points and IPv4 has shown us that those will fail. Optionally requiring authentication to use particular CID's is far more sensible and incremental. Hell's laying it on top of DNS actualy make pretty good sense as country codes and TDL's match up pretty well.
Re: (Score:2)
That's a great idea.
Qestioning their statistics (Score:2)
How do we know, the drop is not explained by one such big scam operation getting busted [slashdot.org]?
The scam-calls I'm getting, for example, — 2-3 times per day — do not pretend to be from the IRS' numbers at all...
Another Revenue Source for Carriers? (Score:3)
I didn't read them all, but T-Mobile's solution is an app which you install on your smart phone. The description says that it's a free trial and they state up from that it is a paid service. So if you want protection from spam/scam calls you need to pay extra. I get tired of the various carriers nickle and diming you to death.
Re: (Score:3)
AT&T is pulling that shit too, apparently My mother said something like "My caller ID names are gone, and it's just numbers now. It said something about the free trial being up." that must be what she was talking about, she just got a new Galaxy 7 Edge with AT&T service.
I'm on Verizon and I get names and numbers as part of basic caller ID service, AFAIK.
Re: (Score:2)
Re: (Score:2)
That gives you local caller ID names, kind of a local whitelist. With landlines there is a "name service" that provides a number AND a name, usually (when not blocked, spoofed, etc.) but that doesn't get sent to the cell network, apparently. So, the latest version of Android has it half-baked in as a paid service feature or something.
Re: (Score:1)
On mobile phones this isn't a big deal, since anyone in your contact lists is automatically matched up with the number. Heck, it's on things I give Kudos to Apple for, since apparently in IOS the answer "button" is different for recognised/non-recognised callers.
Re: (Score:2)
The database that does the CLID -> Name lookup is owned by a company called NeuStar. They charge the telephone companies roughly a penny for each lookup they perform for each call. That's why there is a charge for pretty much every company to provide this data...
simple solution.... (Score:5, Insightful)
force all call routing tables that all telcos use to be authenticated. Yes that means poor poor multi million dollar businesses will have to pay $100 a year to have their giant VoIP system to be verified and validated. home VoIP is forced to be sent through a certified telco that locks the CID information and disallows ANY changes.
Honestly it could be fixed in only a couple of months if people got off their asses.
What about hiding behind open VoIP/Proxy boxes? (Score:2)
This does nothing to handle those that bounce their calls off of vulerable VoIP or other devices. This happened to me recently; the ID was of some girl in a local city that has (had, hopefully) an Android phone that has obviously been hacked. It's unlikely someone is going to spend the kind of money required to trace them in this manner, unless they suspect it's a Big Fish they're going to catch.
Best incentive yet improvement is cell phones (Score:3)
As long as there is no better alternative, landline telecoms see no downside to a lax stance on robocalls. But if I cancel my land line and just use my cell, because I can control how my cell phone responds better, then the landline industry has motivation for attacking the problem. I am going call my telecom and tell them they will lose my business if the industry doesn't get serious on this. I include political calls, surveys, the whole set of unsolicited calls.
Use ANI, not CLID (Score:2)
CLID (standard Caller ID) is sent out by the sending phone/PBX, and is not trustworthy. ANI (Automatic Number Identification) is used by telcos for billing info, and it works, Otherwise telcos would be in financial trouble. Yes, it is available, but telcos want to "monetize" it, so they charge an ar and a leg for anybody who orders it.
Re: (Score:2)
CLID and ANI are the same thing. The BTN is what you are really looking for (The Billing Telephone Number)... Field 0x71 on SS7, according to Telcordia...
Are companys like trackphone excluded? (Score:2)
You can lie (Score:2)
The real problem with call-id is that you can lie. You can identify the calling party number as any collection of 10 digits (in the US). There is no check. Even this 'Do Not Originate' is a blacklist approach, which as we know has its limits. Rather the system should only allow you to say you are one of the numbers you own, as in those assigned to the line being used, or assigned to the organization which owns the line. Case in point, when a DID enabled desk phone calls out for pizza, the caller-id giv
Correlation != causation (Score:2)
That drop in IRS calls could also be due to the recent bust of the Indian scammers behind it all. As for the DNO, what's to stop some company setting up an automated phone routing center in BFE South Dakota? VOIP from India to the routing center where the calls would originate.