VoIP Mailing List Archives

[jra at baylink.com]

On Mon, May 12, 2008 at 11:00:22PM +0200, Trixter aka Bret McDanel wrote:

[jra at baylink.com]

On Mon, May 12, 2008 at 11:10:00PM +0200, Trixter aka Bret McDanel wrote:

[trixter at 0xdecafbad.com]

On Mon, 2008-05-12 at 17:26 -0400, Jay R. Ashworth wrote:

[stotaro at totarotechn...]

Setting up a drone Asterisk box to take hundreds of thousands of FTP
.call files at 3AM (by each time zone) and play pro Hillary Clinton
campaign messages (or whoever you don't like), obviously spoofing
her/his campaign headquarters caller ID and ANI.

Obtaining a new credit card from someone's mailbox with the sticker to
call from your home phone to activate the card. Spoof their Caller ID
and ANI, activate, and buy some cool gadgets or whatever people do
with cards that don't belong to them.

Setting CallerID/ANI to clients', girlfriends', bosses' cell phone and
call until voicemail picks up, if no PIN is set, I have full control
of their voicemail (and could possibly call out, I will have to test
that with the call back option. Then someone could really have some
fun depending on what messages they have saved)

So many exploits.....

Thanks,
Steve Totaro

_______________________________________________
--Bandwidth and Colocation Provided by http://www.api-digital.com--

asterisk-biz mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-biz

[stotaro at totarotechn...]

On Mon, May 12, 2008 at 6:22 PM, Steve Totaro
<stotaro@totarotechnologies.com> wrote:

[cbvance at msn.com]

<?xml:namespace prefix="v" /><?xml:namespace prefix="o" /><![endif]--> each of those scenario's involve either fraud or intent to do harm and are already prohibited
in FCC regs even absent the "Truth in Caller ID Act"

[trixter at 0xdecafbad.com]

On Thu, 2008-05-29 at 18:40 -0400, Charles Vance wrote:

[nk3569 at yahoo.com]

Yes, we know there are security problems.

As a VoIP carrier - I do *not* let my customers set their own CID exactly for those reasons. However, I absolutely have to be able to set CID *myself* if I want to have any chance of surviving as a carrier.

Now, how do you suggest we fix it without wiping out most small VoIP carriers out there? simply saying "we gotta ban it" is not going to magically fix things. It's just going to create more problems.


--- On Mon, 5/12/08, Steve Totaro <stotaro@totarotechnologies.com> wrote:

[nk3569 at yahoo.com]

Yep. True.

So the issue is not needing more regulation - but just how to be able to enforce existing regulation. Not something that more regulation by itself will resolve!

Of course for all these cases, there WILL be records allowing law enforcement officials (***who know what they're doing***) to trace back the calls. Even if you spoof ANI/CID - your call has to come from somewhere.

Let's take your 3AM campaign suggestion for example: the way the call will go is:

Culprit -> VoIP carrier who lets set CID/ANI -> ILEC or CLEC -> terminated to PSTN.

Tracing it back should not be a problem if you have the proper court orders, just find out with the terminating party which ILEC/CLEC they got the call from, then find out with the ILEC/CLEC which VoIP carrier they got the call from - and then finally get the customer records from the VoIP carrier.

Sure, it's not as easy as it used to be, and I may be over simplifying it - but it is possible and much better than trying to regulate who can and can't set CID. Punish the CRIMINALS - not the PROVIDERS.

--- On Thu, 5/29/08, Charles Vance <cbvance@msn.com> wrote:

[cbvance at msn.com]

<?xml:namespace prefix="v" /><?xml:namespace prefix="o" /><![endif]--> Speaking of Law Enforcement...they are absolutely exempt from any anti-spoof laws

Seems both the Congress and the Senate believe there are some legitimate law enforcement reasons for spoofing.

----- Original Message -----

[trixter at 0xdecafbad.com]

On Mon, 2008-05-12 at 16:18 -0700, Nitzan Kon wrote:

[jra at baylink.com]

On Mon, May 12, 2008 at 04:05:32PM -0700, Nitzan Kon wrote:

[jra at baylink.com]

On Mon, May 12, 2008 at 04:18:32PM -0700, Nitzan Kon wrote:

[abalashov at evaristes...]

PSTN call routing isn't magic. There are ways to track this sort of
thing down if necessary, and neither ANI nor caller ID play an
indispensable role in the anatomy of such investigative endeavours.

There is a whole host of data dumped into internal CDRs accessible via
switch craft interfaces and softswitch / big-iron EMSs that admits of
internal PRI trunks and cross-connects, TCICs from private and ILEC
tandem interconnection SS7 IMTs, and various other such things.

Steve Totaro wrote:

[bill at cosi.com]

I use a pool pool of VoIP providers to dial out from a pool of legitimate business numbers with different ID's. Also on occasion, I set caller ID to my cell phone number. When my asterisk box forwards a call to my cell, I have it set caller ID to the originator.

Your service would not be useful to me.

Nitzan Kon wrote: