Stop The Caller Id Fraud!

How do you trace spoofed calls  attempts?

You are eating your dinner, and all of an abrupt a SWAT team busts down your door and you’re simply immediately handcuffed. This happened because someone spoofed your number and told the neighborhood police department there is a burglar alarm within your house.

I realize this may be prevented with a 2 call system, meaning the cops would phone you to verify the number, but this would not be realistic. I read an article explaining local police departments don’t have a powerful enough budget to aid spoof detection technology.

What technology today allows a police department to follow an online based telephone call back to the origin IP? Would I have the ability to “ping” an internet based caller, or would the IP be lost in the audio conversion process? During my own tests, I spoofed a call and called my 800 number. In some instances, the spoofed number came as the display number, as well as the source. In other cases, I would get the spoofed number and a different phone number listed since the source. The source number would normally be either busy or disconnected. It appeared this number was a “fingerprint”, and possibly put in place for service identification legally enforcement.

My best guess at this time, is the fact that police force is sending blanket subpoena’s to spoof providers, commanding these phones provide their outgoing call list. I am not paranoid, but I would not be whatsoever bit surprised if law enforcement had full access to spoof records through the voluntarily compliance of web site owners.

Government: We are able to either hit you with 3,000 subpoenas each day, or else you makes it possible for us a back door to watch suspicious activity.

Site Owner: You could have use of the database.

What would function as the least expensive way to trace these calls? Could these methods help private citizens? So what can the telecommunication sector caused by bring back caller ID credibility, without alink to this question out of your blog or site, copy and paste the URL below.

Share This
Answers (2)
Todd V.

Technician at Pinnacle Communications Corp

see all my answers

Being from the network side of the home, and believing you are speaking specifically about VoIP, the easy response is tracing the IP. I don’t want to appear oversimplifying this, because it is still by no means, easy, but this is actually the answer. The telephone has to have an exclusive IP about the network once the call was made, so finding the IP is when you locate the caller.
Links:

* http://www.ajc.com/services/content/news/stories/2009/02/04/malicious_911_c…

posted February 5, 2009
Dustin D. T.

Principal at VBI LLC

see all my answers

Best Answers in: Information Security (1)

I have been tracking the facts in Caller ID Act (originally of 2006) since it tries to make it’s way through the U.S. Congress. Legislation may help, but it doesn’t appear to be a large priority.

Tracing the calls within the data network entirely depends upon what protocols are now being employed for the signaling and media channels. UDP protocols like RTP (media) could be hijacked and/or spoofed, and practical attacks have been demonstrated ( by myself, as well as others). Other protocols that are TCP based are more reliable in regard to divulging the real parties of the session, but if you don’t have visibility into the network between the calling parties you must get that information from the VSP or even the ISP.

Currently, when i mentioned above using the stalled legislation, spoofing Caller ID is *NOT* illegal. However, using spoofed Caller ID to authenticate for an information system most certainly is under most state’s computer fraud and abuse legislation, such as should you access someone’s voicemail or utility billing system by bringing in to the system from that person’s telephone number. That scenario is basically unauthorized access to an information system. I’m sure using law enforcement to harass innocent victims as you describe likely is against the law too, but I don’t know the specific statutes.

My opinion of the most effective current means of individual citizens to employ would be to use VoIP equipment that uses TCP protocols like IAX ( as opposed to SIP/RTP) and ensure how the equipment keeps a log of what remote systems initiate connections with it.
Links:

* http://voipsa.org/blog/category/voip-legislation/