Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Phone verification at no cost

github.com

Post reply on HN
Print view View original

21–30 of 64 posts

Re: Show HN: Phone verification at no cost

#21

Post by cantrevealname »

nmjohn wrote: post #10
wfunction wrote: post #8

Earlier quoted context omitted.

At the risk of sounding like I'm actually going to abuse this capability... if it's done "relatively easily", how is this done?

Basically, because there is no verification/validation surrounding caller id - https://en.wikipedia.org/wiki/Caller_ID_spoofing

What's known as "caller ID" is just an add-on that phone companies glued onto the system to have a feature to sell to the public. Another such feature is ANI[1] which was originally meant for billing purposes but is a feature sold with toll-free (800) numbers. It is much harder to spoof, but even ANI is not guaranteed to be present.

I would really love to hear a telecom engineer explain why the true origin info isn't accessible to the called person. A telephone call is a two-way connection -- the path in both directions must be known otherwise you won't have a two-way conversation.

A telephone call is not email or an old-fashioned letter. Both of those are one-way communications, so if the intermediaries don't carefully track the email or letter as it progresses through the pipeline, you have spoofed email or untraceable letters.

But at the lowest level of the telephony protocol, the true and correct path to the originating caller has to exist. Otherwise your voice won't travel to the other person. I'm curious to know why that really deep reverse route has never been made available to public (as an API or a purchasable feature or in any other form).

[1] https://en.wikipedia.org/wiki/Automatic_number_identificatio...

Re: Show HN: Phone verification at no cost

#22

Post by tonymillion »

gst wrote: post #6

It's relatively easy to change/fake the caller ID of phone calls so unfortunately this approach isn't really secure. That's why phone number verification usually places an outgoing call, to verify that you're actually able to receive calls on that number.

I came here to say this exact thing.

I've worked in VOIP quite a bit, and even built a product based on the fact you can fake caller id over SIP i.e. "keep your number but lower your outgoing call rates"

Re: Show HN: Phone verification at no cost

#23

Post by MichaelGG »

cantrevealname wrote: post #21
nmjohn wrote: post #10

Earlier quoted context omitted.

Basically, because there is no verification/validation surrounding caller id - https://en.wikipedia.org/wiki/Caller_ID_spoofing

What's known as "caller ID" is just an add-on that phone companies glued onto the system to have a feature to sell to the public. Another such feature is ANI[1] which was originally meant for billing purposes but is a feature sold with toll-free (800) numbers. It is much harder to spoof, but even ANI is not guaranteed to be present. I would really love to hear a telecom engineer explain why the true origin info isn't…

Outbound traffic (placing a call) is entirely separate from the inbound path. This is similar, in a way, to IP. You can send a packet with any source IP from basically anywhere on the Internet. The difference is that with IP, any return packets are routed separately, to the source IP. With a call, return voice just goes along the established channel. Each provider along the way will know who they received the call from, but cannot verify that the number belongs to them.

This is by design and used in many cases. Call forwarding, for instance. Or even just the basic case of using multiple providers to route outbound calls. Some might be cheaper than others, so you need to select on a call by call basis. Also, think of international calls. How is Idaho Telco XYZ supposed to be able to verify that this call from Zambia really belongs to ZambiaCom XYZ? And vice versa.

Also note that there's simply no requirement to even having a number. You could just be placing outbound calls (like SkypeOut). Or no one to one mapping: an office sharing one number for outbound calls, or a single telemarketer changing numbers call by call as they dial for different customers.

Re: Show HN: Phone verification at no cost

#24

Post by geocar »

cantrevealname wrote: post #21
nmjohn wrote: post #10

Earlier quoted context omitted.

Basically, because there is no verification/validation surrounding caller id - https://en.wikipedia.org/wiki/Caller_ID_spoofing

What's known as "caller ID" is just an add-on that phone companies glued onto the system to have a feature to sell to the public. Another such feature is ANI[1] which was originally meant for billing purposes but is a feature sold with toll-free (800) numbers. It is much harder to spoof, but even ANI is not guaranteed to be present. I would really love to hear a telecom engineer explain why the true origin info isn't…

> I would really love to hear a telecom engineer explain why the true origin info isn't accessible to the called person. A telephone call is a two-way connection -- the path in both directions must be known otherwise you won't have a two-way conversation.

Telephone isn't really like IP routing. If D wants to call P, the connection might get set up like this:

    D -> K -> H -> V -> P
P only knows that they are speaking to V, and D only knows that they're speaking to K.

See what happens is D sends a message called "Call Request". This creates a channel id (D,C1) between D->K. K will then create it's own "Call Request" with it's own channel id (H,C2) which tells H to bill K for this call. Only K will know both the channels C1 and C2 and will bridge them internally. When H makes a "Call Request" to V, it has it's own billing arrangement with V and they agree to simply count calls, so H doesn't actually forward anything except the channel id (nil,C3). V gets away with this because the wire is clearly marked with "K TELEPHONE INC". Eventually P gets an "Incoming Call" message with it's channel id (P,C4), and can accept the call or reject it. If he accepts it, then each party will send "Accept Call" messages back down the chain.

These channel ids are used to actually carry the phone call (or data packets, or whatever).

"Caller ID" isn't the "source of the message", just some data transmitted along with the ringing sound, and as you can see the circuit doesn't have a globally unique identifier. If someone doesn't transmit who to bill, then nobody will get billed for that call (and maybe nobody will be!) but V doesn't want to send bills for this call all over the country so V only sends bills to a few carriers and its own customers.

All the bills have the "correct calling numbers on them" because of some extra billing data that's included in the call. This billing data might be omitted (the bill says "NUMBER BLOCKED"), and it clearly isn't required to establish the call. People can ask their phone company to ignore calls that have a blocked number.

Phone companies used to trust each other not to spoof this information, and now that calls from certain numbers aren't usually billed differently than from any other numbers, this doesn't cause a problem with billing -- only with people who seek to use "making a call from" an authentication method.

Re: Show HN: Phone verification at no cost

#26

Post by pbhjpbhj »

geocar wrote: post #24
cantrevealname wrote: post #21

Earlier quoted context omitted.

What's known as "caller ID" is just an add-on that phone companies glued onto the system to have a feature to sell to the public. Another such feature is ANI[1] which was originally meant for billing purposes but is a feature sold with toll-free (800) numbers. It is much harder to spoof, but even ANI is not guaranteed to be present. I would really love to hear a telecom engineer explain why the true origin info isn't…

> I would really love to hear a telecom engineer explain why the true origin info isn't accessible to the called person. A telephone call is a two-way connection -- the path in both directions must be known otherwise you won't have a two-way conversation. Telephone isn't really like IP routing. If D wants to call P, the connection might get set up like this: D -> K -> H -> V -> P P only knows that they are speaking t…

>"Caller ID" isn't the "source of the message", just some data transmitted along with the ringing sound, and as you can see the circuit doesn't have a globally unique identifier. //

The companies could enforce the side channel info as the actual call origin, but they don't want to. Just like snail-mail spammers they're paying more money than residential customers will pay to require that info.

It's broken because it serves the purposes of the phone companies to keep it that way. This is what you get by detaching profit from ethics.

I'd settle for my phone company dropping calls with spoofed caller ID - like 0, my own number, foreign calls with local numbers, local numbers that don't even terminate, etc..

Indeed I think origin should be legally required even if it's "K phone network" - I don't mind blocking all calls via companies that service spammers.

Re: Show HN: Phone verification at no cost

#27

Post by geocar »

pbhjpbhj wrote: post #26
geocar wrote: post #24

Earlier quoted context omitted.

> I would really love to hear a telecom engineer explain why the true origin info isn't accessible to the called person. A telephone call is a two-way connection -- the path in both directions must be known otherwise you won't have a two-way conversation. Telephone isn't really like IP routing. If D wants to call P, the connection might get set up like this: D -> K -> H -> V -> P P only knows that they are speaking t…

>"Caller ID" isn't the "source of the message", just some data transmitted along with the ringing sound, and as you can see the circuit doesn't have a globally unique identifier. // The companies could enforce the side channel info as the actual call origin, but they don't want to. Just like snail-mail spammers they're paying more money than residential customers will pay to require that info. It's broken because it…

That you say it easily doesn't mean that it's easy to do.

The current telephone infrastructure wasn't designed. It grew: Verifying a call would involve either tying up an additional channel back (doubling the cost of the infrastructure), or replacing (parts of) the infrastructure with something better designed- like a TTL "ping" packet going backwards to verify the route on the original channel. Getting everyone to change their hardware is hard. Just look at how long it's taking to get IPv6 out.

Fortunately, tracing a call isn't like television: You do not have to "keep him talking". You can ask the phone company to research the calls made to your number at a specific time, and in the process of reconciling billing, the phone company can find out, and then you can use the judicial arm to deal with people who spoof the calling number.

Re: Show HN: Phone verification at no cost

#28

Post by wfunction »

finnn wrote: post #15
wfunction wrote: post #8

Earlier quoted context omitted.

At the risk of sounding like I'm actually going to abuse this capability... if it's done "relatively easily", how is this done?

My SIP provider passes whatever number I send, for most of the numbers. No talking to them required. Particularly fun for Android phones that do Google Maps lookups for caller ID, so calling from 2024561414 shows up as "The White House" Just for fun i went ahead and verified 2024561414 with the demo of this thing. It gave me a nice little check mark showing that I was definitely the White House

Sorry, what's an SIP provider? I've looked it up and still don't understand what it is. Is it a residential service? Can anyone get it? Is it some form of VoIP? Or a classical phone line? I've seen it in multiple places but don't understand what it is or which companies it relates to.

Re: Show HN: Phone verification at no cost

#29

Post by MichaelGG »

lucaspiller wrote: post #9
wfunction wrote: post #8

Earlier quoted context omitted.

At the risk of sounding like I'm actually going to abuse this capability... if it's done "relatively easily", how is this done?

I switched to a different SIP provider as they were cheaper, but my number was still held at the old SIP provider and couldn't be ported. I explained the story and asked if they could 'virtually' add that number to my account so outgoing calls would come from that number. They just switched on the feature to enable me to set the caller id to anything as it was easier for them.

This is also a fun attack. Find a provider that does this. Request to port a target number (a bank or an escort service or whatever). Port will stall for a bit, in the mean time, the service provider activates your number internally, so their own dialers route to their "version" of the number.

Now you get all the calls from that provider to that number. Forward them to the actual destination (using an unrelated provider) and no one will notice for a while. Except, you get all the calls and media.

Re: Show HN: Phone verification at no cost

#30

Post by HappyTypist »

wfunction wrote: post #28
finnn wrote: post #15

Earlier quoted context omitted.

My SIP provider passes whatever number I send, for most of the numbers. No talking to them required. Particularly fun for Android phones that do Google Maps lookups for caller ID, so calling from 2024561414 shows up as "The White House" Just for fun i went ahead and verified 2024561414 with the demo of this thing. It gave me a nice little check mark showing that I was definitely the White House

Sorry, what's an SIP provider? I've looked it up and still don't understand what it is. Is it a residential service? Can anyone get it? Is it some form of VoIP? Or a classical phone line? I've seen it in multiple places but don't understand what it is or which companies it relates to.

Twilio, Plivo, etc.
Post reply on HN