VoIP Mailing List Archives

[asterisk at wideideas.com]

This isn't a unique situation, I'm sending this out via a large ILEC,
and have tested it with two major ILECs if you want to see the case in
point just give me two numbers and a time and I'll use them to
generate the call for you.

On May 9, 2008, at 10:22 AM, Jay R. Ashworth wrote:

[beckman at angryox.com]

On Fri, 9 May 2008, Charles Vance wrote:

[andres at paglayan.com]

On Fri, 2008-05-09 at 11:46 -0400, Steve Totaro wrote:

[nk3569 at yahoo.com]

--- On Fri, 5/9/08, Peter Beckman <beckman@angryox.com> wrote:

[nk3569 at yahoo.com]

--- On Fri, 5/9/08, Steve Totaro <stotaro@totarotechnologies.com> wrote:

[jra at baylink.com]

On Fri, May 09, 2008 at 11:31:45AM -0700, Nitzan Kon wrote:

[stotaro at totarotechn...]

On Fri, May 9, 2008 at 2:31 PM, Nitzan Kon <nk3569@yahoo.com> wrote:

[asterisk at wideideas.com]

I'm sorry but your experience is entrenched in the switched based PSTN
type facilities/termination. Quite a few years ago major carriers
(Verizon, ATT, Qwest, Level 3 etc) have allowed termination to them
via IP. This is for customers that don't even have any DID with the
carrier (termination only). How do you propose the carrier would be
able to verify the correctness of the CID being passed to them? All
of these carriers simply pass along the CID/ANI which the customer
provides, and there is nor can their be any way to verify it.

Welcome to IP baby, you really can't lock it down using the
traditional methods. As much as you would like to think that the
entity converting the IP to PSTN should/would/could/does correctly
specify the absolute correct ANI/CID it is quite the opposite on a
large scale. Unless someone dreams up a new way to enforce or
efficiently verify CID/ANI and the big boys actually implement it this
isn't likely to change.

BTW there are actual telemarketing laws that will get you slapped if
you use CID spoofing in marketing. Not sure who but someone just got
slapped with a $500k fine for doing it. Google around I'm sure you'll
find it.

Miles

On May 9, 2008, at 11:40 AM, Jay R. Ashworth wrote:

[nk3569 at yahoo.com]

--- On Fri, 5/9/08, Jay R. Ashworth <jra@baylink.com> wrote:

[abalashov at evaristes...]

Miles Scruggs wrote:

[stotaro at totarotechn...]

On Fri, May 9, 2008 at 5:03 PM, Alex Balashov <abalashov@evaristesys.com> wrote:

[jra at baylink.com]

On Fri, May 09, 2008 at 01:03:29PM -0400, Charles Vance wrote:

[abalashov at evaristes...]

Steve Totaro wrote:

[jscully at isipi.com]

OK - A few people here have touched on the right answer, but I am going to
say it more bluntly:

No limit on ability to "spoof" outbound callerid/ANI is possible without
crippling the ability to aggregate traffic from customers. An aggregator
has zero ability to determine what PSTN numbers a customer of a customer has
right to use. You have a PBX with PSTN numbers, I have a wholesale customer
who sells you IP trunking for outbound LD. You set your switch to use the
proper ANI so people who call back some in on your PSTN lines.

Your direct "LD company" may have no switch, and your PBX may be trunked
directly to me, but I do not know who you are. So I have no one to contact
and verify ANI, the company who does know who you are has no way to verify
what ANI you send, and in any case, it is none of our business.

You may be an outbound call center making calls for a different company, and
using their ANI so their customers see the calls as coming from them.

Now, how about our upstream carriers? We have maybe 30 CLECS over whom we
can terminate traffic. Should they all ask us if your ANI is legit?

You see the issue - this one has to be handled with a big stick used to beat
people who commit abuse, not by blocking the ability of us all to do legit
business.
John Scully
www.isupportisp.com
614-372-6511
Residential and Business VoIP solutions
Hosted and on Premise IP-PBX systems
Advanced Voice Applications and IVRs

----- Original Message -----
From: "Steve Totaro" <stotaro@totarotechnologies.com>
To: "Commercial and Business-Oriented Asterisk Discussion"
<asterisk-biz@lists.digium.com>
Sent: Friday, May 09, 2008 5:54 PM
Subject: Re: [asterisk-biz] ANI

[stotaro at totarotechn...]

Again, you are confusing ANI with Caller ID. It is not callerid/ANI
it is caller ID and ANI, they are not the same!

Here is a nice little article that sums up the differences and how to
use spoofed ANI to call premium 900 numbers and bill it to someone
else. It also mentions 911. I am going to try both. If in fact, if
911 has the spoofed location and there are no 900 bills on my PRI,
then there MUST be legislation and regulation.

I will report back with results.

I don't want to hear "It is not possible", anything is possible,
especially if made public via Fox News, CNN and other popular news
outlets.

http://www.totse.com/en/phreak/introduction_to_telecommunications/cid_ani.html

Thanks,
Steve Totaro

On Fri, May 9, 2008 at 8:13 PM, John Scully <jscully@isipi.com> wrote: