Hacker News Reader

Comment by ttul | Hacker News Reader

The issue, as I understand it, is that the SS7 telephone network is completely insecure assuming that you have the ability to connect to it. Shady gateway providers will allow you the privilege, and once you're in, you can do just about anything.

There is precious little within SS7 to prevent or respond to spoofing. It's a major nightmare for telephone companies.

View on HN

It seems that what changed is that sometime in recent years it became much easier for shady gateway providers to remain in business. In earlier times, it would appear that originators of fraudlent caller ID data where shut down rapidly.

The telecom "industry" has seen massive market compression, with players who rarely innovate. Its sad that Scam ID is considered groundbreaking IMO, the implementation is pretty crummy.

How did spoofing work vis-a-vis those with 1-800 inbound lines? I was under the (mis?)impression that those users were protected against spoofing because they were (are?) billed by inbound call duration.

> It's a major nightmare for telephone companies.

Disagree. It's a bug for the telcos, and a major nightmare for the rest of us.

Having spent a bit of time working on projects that touch the phone network, I think it is a 'major nightmare' in the Lovecraftian sense--I for one am forever changed by what I saw.

As for billing, it is usually based on the destination number, and your originating telco, unless I am misunderstanding your question.

Does this imply I should answer the 1-800 calls and keep them on the line as long as possible? :D

If you suspect a scammer called you, always keep them on the line as long as possible. Feed into the scam and act as gullible as possible, give them fake cc numbers, etc.

Best to extract as much iinfo as possible, business name, callback numbers, email addresses, etc. The more info, the easier it is for the FCC to bring enforcement action against fraudulent callers.

haha, "four-flag key" is still an inside joke with my family because of how many times we got a scammer to say it while they "provided tech support" to us :)

There's two means of number identification -- caller id (CID), and automatic number identification (ANI). ANI used to be a lot harder to spoof than CID; likely because ANI is always delivered out of band, and some early CID spoofing was done by just overplaying in-band CID. On the consumer side of things, you're allowed to disable CID on outgoing calls, but not to disable ANI.

Toll free routing may be less amenable to grey routes and things as well. International callers aren't "supposed" to be able to call US toll free numbers, which may make it harder to get to. I've seen some companies claim that they can use call routing information to toll free numbers to get accurate caller id information in some countries; but I would never trust it.

You also shouldn't trust the source IP, or the return address on a standard envelope in the mail, unless you have convincing evidence. It's hard to think of an example of a source address in communications that's really trustable.

If it's "completely insecure," then why aren't there reports of people correctly dialing their banks phone number and being connected to a scammer?

The insecurity comes from the fact that once a call is in the network, it is mostly passed off without validation or verification. You only need to find someone willing to carry your call in to the network, and the rest takes care of itself.

To change the routing of a call other than yours would require you to access a carrier's systems and change where the call is routed to--which is substantially more difficult.

Kind of like ip routing, email routing, or even physical mail routing.

It's completely insecure because someone could call you, spoof your bank's number, and claim to be your bank.

http - ISP injects sales/billing garbage in the response. Completely insecure!

phone - I dial the number my bank gave me and no man in the middle ever answers or interrupts. But still completely insecure!

Now imagine you see me trying to enter my credentials over an http connection to AwfulBank.com. "Stop! That's completely insecure!" you say. "Sure, but so is calling a bank using the phone number they gave me."

If both cases are already completely insecure, why am I wrong?

Reply on news.ycombinator.com