Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How can scam callers fake a mobile phone number?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 156 posts

Re: Ask HN: How can scam callers fake a mobile phone number?

#71

Post by bigmattystyles »

cryptonector wrote: post #46

Signalling system 7 has no authentication. That's the bottom line. Adding authentication is pretty obviously not trivial, not just because of protocol upgrade issues, but also because end-to-end authen. won't be easy to add at all, and hop-by-hop authen. w/ something like "egress filtering" won't work in the age of phone number portability. What might work is a TCP-like return routability test. I.e., have the network…

What about charging a penny or 5cents per call? Nominally cheap for regular users, would put a dent in scammers. And don’t let the phone company keep the money, put it towards the infrastructure.

Re: Ask HN: How can scam callers fake a mobile phone number?

#72

Post by litgab »

I just got a call from the Microsoft Security Team. They informed me my computer was highly infected. I spent 1 hour with them executing all cmd commands they wanted & told them the output.

In the end i told them my wifi was broken and the technician should come by soon to fix it. She turned very aggressive and told me to call my brother Internet provider right now, as this is urgent because the hackers are already in my system. I told her to call me again the next day.

I might have forgot to mention i am using a mac (and had to google the result of all commands & screens). I wanted to setup a VM and trace them or maybe even let them execute a manipulated cmd.exe to create a reverse shell. But after my attempts to buy some time so i could set everything up, they gave up and never called again.

So sad, i am still scared of all the „viruses of very dangerous hackers“…

Re: Ask HN: How can scam callers fake a mobile phone number?

#73

Post by throwawayboise »

noneeeed wrote: post #45
smeej wrote: post #16

Hoping this is something that doesn't need to be said here, but just in case: This is why you should NEVER provide personal information over the phone if you didn't initiate the call. It doesn't matter if your caller ID says it's your doctor's office or your bank or whatever. Hang up and call them back at the number you normally use to reach them, from their website or the back of your credit/debit card for example.…

Also, if you were rung on a landline, ring back on your mobile. I'm not sure if it's always the case, but I believe that a call to a landline only terminates when the caller hangs up. This certainly used to be the case. This allows scammers to ask you to hang up and call them back on the number on your card (for example), but they just mimic the dial-tone and ring, then they have another scammer answer the phone. Thi…

Or if you can't use a different line or mobile phone, intentionally dial a different number, if it rings through to "the bank" then you know they have hijacked your line.

Re: Ask HN: How can scam callers fake a mobile phone number?

#74

Post by encryptluks2 »

egberts1 wrote: post #33
encryptluks2 wrote: post #14

Earlier quoted context omitted.

STIR/SHAKEN hasn't worked correctly or stopped robocalls like promised. Congress basically told everyone that this was the answer and would stop robocallers for good, but in reality did barely anything at all. The real solution is to label robocallers as terrorist and sanction countries with large amounts of robocalls for sponsoring terorrism. Before long, everyone will be too scared to even consider working in a rob…

And if they do not comply, to follow through with a Hellfire missile, right? /s

I mean, think about how many people scammers are killing prematurely as is. Once these countries that we previously let shit on Americans for a long time have some serious sanctions, I'm sure they'll find ways to deal with the problems themselves.

Re: Ask HN: How can scam callers fake a mobile phone number?

#75

Post by wbobeirne »

litgab wrote: post #72

I just got a call from the Microsoft Security Team. They informed me my computer was highly infected. I spent 1 hour with them executing all cmd commands they wanted & told them the output. In the end i told them my wifi was broken and the technician should come by soon to fix it. She turned very aggressive and told me to call my brother Internet provider right now, as this is urgent because the hackers are already i…

You'd probably enjoy the content of Jim Browning, a guy who tries to flip the tables on these kinds of tech support scams: https://www.youtube.com/channel/UCBNG0osIBAprVcZZ3ic84vw

Re: Ask HN: How can scam callers fake a mobile phone number?

#76

Post by throwawayboise »

xwdv wrote: post #70
ceejayoz wrote: post #48

Earlier quoted context omitted.

> No, that's the public portion of a social security number. It really isn't.

It is, and you must set aside your personal feelings and treat it as public info. If people think these digits are like some secret password, they will be treated as such and used to gatekeep access to even more restricted info and accounts. Which would be a disaster because many people have had these last four digits exposed over time. Knowing them does not prove identity. They are public.

You might as well assume your entire SSN is public. Most of them have been leaked someplace or other, and for anyone who was an adult before about 2000 it was common to have them pre-printed on your personal checks. It's only in the past few decades that they have suddenly become "secret."

That someone who called you on the phone happens to know your SSN last four or even the entire number should not confer any trust on your part.

Re: Ask HN: How can scam callers fake a mobile phone number?

#78

Post by downrightmike »

bufferoverflow wrote: post #69
downrightmike wrote: post #7

Caller id is just a user settable field. There are two numbers, ANI which is how telcos are supposed to keep track of who to charge. NO one uses it, because users don't like it. And caller id is sent out on the second ring, but again, user can set that to anything. Corps have to adhere to the TCPA, others don't and SIP calls are cheap and globally routable. https://www.fcc.gov/sites/default/files/tcpa-rules.pdf

That's a ridiculous system design.

Brought to you by Ma Bell

Re: Ask HN: How can scam callers fake a mobile phone number?

#79

Post by icedchai »

Caller ID is for "presentation" only, not billing. Anyone with the appropriate access can set their caller ID to whatever they want. Some VOIP providers don't do any validation that you "own" the number you are providing. Years ago, when I had an Asterisk PBX set up using a super cheap SIP provider, you could put anything you wanted in for a caller ID.

There are legitimate use cases for this. Imagine if you are a company with 1000's of physical locations. You want them all calls to appear that they are coming from the corporate headquarters.

Re: Ask HN: How can scam callers fake a mobile phone number?

#80

Post by colejohnson66 »

bufferoverflow wrote: post #69
downrightmike wrote: post #7

Caller id is just a user settable field. There are two numbers, ANI which is how telcos are supposed to keep track of who to charge. NO one uses it, because users don't like it. And caller id is sent out on the second ring, but again, user can set that to anything. Corps have to adhere to the TCPA, others don't and SIP calls are cheap and globally routable. https://www.fcc.gov/sites/default/files/tcpa-rules.pdf

That's a ridiculous system design.

It’s remnants from a time where security wasn’t a concern. The original intent of the From: field in email was that it’s definitive, but now it’s just a legacy field that many systems ignore because it’s fakeable.
Post reply on HN