Caller ID Spoofing Research Articles

Spoofing Against Spoofing: Toward Caller ID Verification in Heterogeneous Telecommunication Systems

Caller ID spoofing is a global industry problem and often acts as a critical enabler for telephone fraud. To address this problem, the Federal Communications Commission has mandated telecom providers in the U.S. to implement STIR/SHAKEN, an industry-driven solution based on digital signatures. STIR/SHAKEN relies on a public key infrastructure (PKI) to manage digital certificates, but scaling up this PKI for the global telecom industry is extremely difficult, if not impossible. Furthermore, it only works with IP-based systems (e.g., SIP), leaving the traditional non-IP systems (e.g., SS7) unprotected. So far the alternatives to the STIR/SHAKEN have not been sufficiently studied. In this article, we propose a PKI-free solution, called Caller ID Verification (CIV). CIV authenticates the caller ID based on a challenge-response process instead of digital signatures, hence requiring no PKI. It supports both IP and non-IP systems. Perhaps counter-intuitively, we show that number spoofing can be leveraged, in conjunction with Dual-tone Multi-frequency, to efficiently implement the challenge-response process, i.e., using spoofing to fight against spoofing. We implement CIV for Voice over Internet Protocol, cellular, and landline phones across heterogeneous networks (SS7/SIP) by only updating the software on the user’s phone. This is the first caller ID authentication solution with working prototypes for all three types of telephone systems in the current telecom architecture. Finally, we show how the implementation of CIV can be optimized by integrating it into telecom clouds as a service, which users may subscribe to.

Insecurity of Operational IMS Call Systems: Vulnerabilities, Attacks, and Countermeasures

IMS (IP Multimedia Subsystem) is an essential 4G/5G component to offer multimedia services. It is used worldwide to support two call services: VoLTE (Voice over LTE) and VoWiFi (Voice over WiFi). In this study, it is shown that the signaling and voice sessions of VoWiFi can both be hijacked by a malicious adversary. By hijacking the signaling session, s(he) gains the ability to make ghost calls to launch stealthy DoS (Denial of Service) or caller-ID spoofing attacks against specific cellular users. Such attacks can be carried out without any malware or network information, and require only the victim’s phone number to be known. It is shown that phones vulnerable to the call DoS attacks can be detected at run time by exploiting a vulnerability of cellular network infrastructures referred to as call information leakage, which is exposed based on a machine learning method. Especially, the call DoS attacks can prevent victims from receiving incoming calls for up to 99.0% time without user awareness. Moreover, by hijacking the voice session, an adversary can launch stealthy free data transfer attacks based on phone numbers alone rather than IP addresses. The identified vulnerabilities/attacks are validated in the operational 4G networks of four top-tier carriers across Asia and North America with seven phone brands. The study concludes by presenting a suite of solutions to address them.

PREVENTION OF TELEPHONE FRAUD (CRIMINOLOGICAL ASPECT)

The problems of committing fraud using telephone communication are updated. The relevance of issues related to the prevention of telephone fraud, first and foremost caller ID spoofing and phishing, is substantiated. The article analyzes the methods of preventing telephone fraud, such as the possibility of establishing the number of fraudsters through electronic search services, special free services, Viber and WhatsApp messengers, Sberbank Online, caller ID for incoming calls on "Avito" and "Yula", through applications for iPhone and Android, caller ID from "Kaspersky Lab" – Kaspersky Who Calls, through the Internet search engine "Yandex" and other applications. It is recommended to use the methods of victimologic counter-strategy in relation to telephone fakers, such as psychological self-defense, criticality (prudence) in their own actions (mainly those of a financial nature), safe behavior in a non-standard situation, a critical level of trust, awareness of possible risks. It is necessary to take precautions not to become a victim of telephone fraud, not to lose self-control and vigilance, to use all opportunities to check the source of telephone fraud, to report such cases to law enforcement agencies. Personal interest in maintaining personal security, the desire for self-defense and timely informing law enforcement agencies will become an obstacle to the spread of telephone fraud.

ДОСЛІДЖЕННЯ СПУФІНГУ ІДЕНТИФІКАТОРА АБОНЕНТА ПРИ РЕЄСТРАЦІЇ: ВИЯВЛЕННЯ ТА ПРОТИДІЯ

Caller ID parodying produces the valid Caller character, in this manner deciding seem to start from another client. This apparently basic assault strategy has been utilized in the developing communication fake and trick calls, bringing about significant financial trouble. Unfortunately, callerID spoofing is easy to implement but yet it is difficult to have protection against it. In addition, there are not effective and defense solutions available right now. In this research it is suggested the CIVE (Callee Inference & VErification), a compelling and viable guard against Caller ID spoofing. This way it is described how it’s possible to lunch call spoofing and between line describe how CIVE approach method can help to prevent somehow this kind of attacks. Caller ID Spoofing could cause huge financial and political issues special nowadays, when many things even sometimes authentication and verification are available by phone call, like banks approving transactions or two factor authentications and many other things. We believe critical industries specially banks and payment service providers should be protected against such vulnerabilities with their system and make an approach to prevent it, also it is very important to learn people specially who has special social place like politicians or celebrities to know such kind of attack are already exist. For this paper we implemented a call from white house to show there is no limitation and no matter whom you try to spoof, but destination which is the victim receive the call and that make this attack vector dangerous. And even modern communication and even devices like 4G and smart phones are not able to prevent or even detect this kind of attack. This study is a demonstration of the vulnerabilities available. All experiments were conducted on isolated mock-ups.

Research on the Vital Non-Technical Factor in Telecommunications Fraud: Social Engineering

Technical factors such as pseudo base station technology, VoIP technology, Caller ID spoofing technologies are usually considered to be the key problems in telecommunications fraud. In this paper, from thousands of telecommunications fraud cases we found that social engineering attack is the vital non-technical factor behind telecommunications fraud. From appeal to authority, appeal to greed and appeal to vanity, and so on, telecommunications fraudsters (also are social engineers) usually exploit human weakness so as to influence the person to take an action that may or may not be in their best interest. And, we found the three main procedures of social engineering attacks in telecommunications fraud. Also, we provided suggestions to prevent social engineering attacks.

Analysis of Security Issues in VoIP

The most common way of communication is obviously through voice exchange. There are mainly two ways by which voice can be easily transmitted over a network: PSTN (Public Switched Telephone Network) and VoIP (Voice over Internet Protocol). The VoIP is relatively new and is gaining more and more popularity as it offers a wide range of features and is much more cost effective as compared to the traditional PSTN. But the VoIP brings with it certain security threats which need to be resolved in order to make it a more reliable source of communication. One of the most concerning security threats of VoIP technology is VoIP Spoofing. Caller ID Spoofing is a technique in which a person takes the identity of a different person to make a call to a third party, thereby hiding his/her original identity. None of the existing protocols so far have been able to prevent Spoofing of calls. This research explains the fundamentals of the Session Initiation Protocol and the Asterisk Server. Also, a new system is proposed which makes use of Public Key Infrastructure which can be used to create digital certificates for the VoIP, thereby helping us to make VoIP calls which are more secure. The PKI is a form of Cryptography which is used to create and manage digital certificates. The PKI mainly consists of (i) a certificate authority that issues the certificates (ii) registration authority which helps in verifying the identity of users (iii) central directory to store the certificates. Also, this paper gives a brief overview of the Asterisk Server which is used to make calls over the Internet. The basic idea is to implement the SIP with the Asterisk Server and using the concepts of Public Key Infrastructure to provide the Asterisk Server with the desired Digital Certificates so as to authenticate the user which in turn will make calling over the Internet more secure.

The Telephone Consumer Protection Act of 1991: Adapting Consumer Protection to Changing Technology

In the late 1980’s, spurred on by advances in technology, the telemarketing industry began aggressively seeking out consumers in the hundreds of thousands. Companies began using machines that automatically dialed consumers and delivered prerecorded messages (“robocalls”). Marketers also took advantage of another new and increasingly available piece of technology known as the facsimile machine (“fax machine”). With the fax machine, marketers could now send tens of thousands of unsolicited advertisements (“junk fax”) each week to consumers across the nation. Consumers and businesses became overwhelmed with unsolicited telemarketing calls and advertisements. Calls for action grew louder. States enacted laws, but could not reach the interstate practices of telemarketers. After reviewing and debating ten different pieces of legislation, Congress enacted the Telephone Consumer Protection Act of 1991 (“TCPA”). The primary focus of this report is the Telephone Consumer Protection Act of 1991. The TCPA was born out of abusive telemarketing practices, made more intrusive by advances in technology. Originally, the TCPA imposed restrictions on the use of telephones for unsolicited advertising by telephone and fax. The TCPA has since been expanded and adapted by administrative rule, judicial interpretation, and congressional amendment. The original purpose of the TCPA was to regulate certain uses of technology that are abusive, invasive, and potentially dangerous. The TCPA effectively regulates these abuses by prohibiting certain technologies altogether, rather than focusing specifically on the content of the messages being delivered. The expansion of the TCPA into areas outside of telemarketing and new technologies over the years is consistent with its original purpose. Private parties are largely responsible for the enforcement of the TCPA, and have done so primarily through the class action mechanism. While this has drawn some criticism because of the provision of high statutory damages, the threat of class action has provided a significant deterrent to violators. Historically the government has only enforced the TCPA to a limited extent, yet the statute has been relatively successful in reducing the conduct it was enacted to regulate. Technology is again rapidly changing and a number of trends are emerging. The number of entities that are operating in intentional disregard of the TCPA are growing, and they are using technology to help evade detection and enforcement. According to the FTC, about 59% of phone spam cannot be traced or blocked because the phone calls are routed through “a web of automatic dialers, caller ID spoofing and voice-over-Internet protocols.” Although the traditional scheme of TCPA enforcement, with its strong reliance on the private right of action, has been successful in the past, two main issues are becoming clear. The private right of action is limited in both incentivizing lawsuits against, and deterring the actions of, intentional violators; and FCC enforcement is limited by its slow process. In order for the TCPA to stay relevant over twenty years later, certain modifications and improvements can be made. We recommend improving government enforcement efforts and increasing the uniformity of interpreting the statute. The FTC's recent contest for a technical solution to robocalls is commendable, and should be followed with respect to other types of media currently exposed to unsolicited commercial messages such as text messages and e-mail. In order for the TCPA to continue to remain relevant going forward, this report recommends: 1. Increase government enforcement of the TCPA by providing State Attorney Generals with a larger incentive to bring TCPA cases, and empowering the FTC to bring suit under the TCPA; 2. Increase uniformity of application of the TCPA by encouraging more frequent and quicker FCC rule making procedures; 3. Continue to protect cell phones by requiring prior express consent for any communication (call or text) made to a cell phone; 4. Place a time limit on the Junk Fax Established Business Relationship; 5. Create incentives for fax broadcasting companies to determine whether the faxes they are sending on behalf of clients are in violation of the TCPA; 6. Rebuff efforts to remove or otherwise modify the private right of action; and 7. Place additional restrictions on entities that enable caller ID manipulation.