Caller ID Spoofing Becomes Easy

objekt writes "According to an article in USA Today, Caller ID spoofing has become much easier in the last few years. Millions of people have Internet telephone equipment that can be set to make any number appear on a Caller ID system. And several websites have sprung up to provide Caller ID spoofing services, eliminating the need for any special hardware. For instance, Spoofcard.com sells a virtual 'calling card' for $10 that provides 60 minutes of talk time. The user dials a toll-free number, then keys in the destination number and the Caller ID number to display. The service also provides optional voice scrambling, to make the caller sound like someone of the opposite sex."

Just the obvious reasons

[TubeSteak]

Banks and cell phone companies, in particular, will insist you call from the phone number 'known' to be associated with your address.

Banks... need I explain?
Cell phone companies... how much easier could it be to get someone's records?

While many companies don't use the phone number as an "end-all form of identification," unfortunately, too many of them use it as a first line of ID.

Re:Not really...

[BlakeOPS]

ANI is a generic industry term. To be more specific, the "holy grail" of spoofing is the Charge Number field (in the SS7 IAM), which Greyarea explains how to do here: http://www.dailyphreak.com/2005/12/25/spoofing-cha rge-number/ [dailyphreak.com]

Re:Not really...

[AlterTick]

Actually, weren't ISDN customers fooling ANI in the past, because the service essentially jacks your circuit directly in to the telco switch? I seem to recall people spoofing caller ID info by feeding false ANI data through one of the carrier "D" channels on ISDN?

No, ANI and CID exist totally separate from one another. ANI is keyed directly to your circuit ID and is utterly beyond your reach there at the end of the pipe, be it POTS, ISDN, T1, or whatever. ANI is used for billing, and is basis for what law enforcement gets when they ask for call info. CID, though, is nothing more than a a consumer product. If you have a T1 channel bank, you can essentially define your caller ID name and number at will, as it originates from the channel bank.

Re:Not really...

[nuckfuts]

... I'll be impressed with something that can fool ANI.

As is discussed here [verizonfears.com].

Re:SS7 and Telco sanitising of CIDs?

[smellystudent]

That's certainly the way it works in the UK - while I can program any CID I like into the PBX, if it doesn't match one of the numbers the line provider has for me, it doesn't get transmitted.

Businesses who legitimately want to send a different number to the number of the line can request it, but you have to own both numbers.