Hacker News Reader

Comment by fyfy18 | Hacker News Reader

A few years ago my parents were getting a lot of spam calls on their landline. Basically all of them were automated calls, either a recorded message or you were connected to a person shortly after the call was connected. I bought an OBi100 [0], which is a small device designed to be a VOIP adapter, but you can setup rules on how calls (incoming or outgoing) are handled.

I setup a rule that if the call was from a withheld or foreign number, it would play an automated message asking the user to press the number 1 to be connected. This alone stopped basically all the spam calls. I'm surprised how well it actually works, I assume the caller detects it as a voicemail message so just hang up.

I imagine most carriers could implement something like this relatively easy. Sorry Google, no AI needed here.

[0] https://www.callcentric.com/support/device/obihai/obi100

View on HN

This is the kind of solution that only works because basically nobody is doing it. If a big provider deployed it, it would take five seconds for it to be defeated.

The OP didn't exhaust their solutions. They found a simple solution which works (for them), and shares it. Once the solution gets widely adopted, it will also get more attack surface. In the meantime, the solution works well because the risk (getting spam calls once more) is worth the small investment. Its essentially a no-brainer to implement this, if you suffer from this issue (I don't, I'm eagerly waiting for a fun phone call with Miclosoft customer support despite owning no such products).

I just love the thought of identifying a CAPTCHA-like obscured audio everytime I am calling someone.. :D

"Laurel" "Sorry, the expected answer was Yannie."

I love the idea of using that to train my new speech-to-text AI.

Google Voice offers this as an option; they're fairly big.

They have a "Press 1 to be connected" option? Where?

Not who you're replying to, but I just looked and the only option I see is you can turn on screening and so when you pick up, you hear the person's name and can decide to take the call or not.

Yeah, plus spam filtering, which AFAIK doesn't work like the GP's solution. I think the other commenter was just confused.

And you can choose to disable screening for numbers that are already in your contacts.

This is hacker news so this kind of solution is cool. And whatever the big guys are doing this user can always change his approach to defeat the spammers. Not globally but just for himself.

I agree.

Yeah. This is so much like greylisting for email, but simpler. Greylisting has been around since at least 2007 and most spammers still don't bother getting around it.

Exactly. With phone number spoofing, all the scammer needs is the phone number of someone on your list. With social media how long do you think it would take to generate such a list, and to get propagated to every scammer?

This would need to be spoofed for every individual though. I imagine this would be cost prohibitive enough that it would at least in the short term kill most spam phone calls.

On the contrary, it represents a revenue opportunity for the first person who can generate a list of matching pairs of phone number and friend phone number. I wouldn't expect the list to be prohibitively expensive because it will be resold thousands of time.

In UK some of the call centres use a fake local number.

It seems to me that phone companies can detect that, but they don't want to reduce the number of calls, do they?

Can you explain phone number spoofing to me? Is there truly phone spoofing that is more than faking the dialer on the client?

You should read the book "Ghost in the Wires" by Kevin Mitnick. It will really open your eyes as to what is possible with phones.

can I borrow your copy? I will pay shipping to and fro' :)

Sure! But honestly, it will probably be cheaper for you to just buy it from Amazon for $8. Or, read it for free using Overdrive (if you have a Kindle/ereader).

But this way I get to bug you about my discoveries and compare interpretations with yours... the knowledge comes with instruction hehe

There is no way for you to verify whether the caller's phone number is actually the real source. Anyone can impersonate anyone. It's like the source address in an IP packet. You can put whatever you want in there.

This is mostly a US problem though. In Europe, the operators tend to be more strict on this, AFAIK.

How is a spammer going to figure out phone numbers of people on my list from social media? I don't know about you, but I don't have my Facebook friends publicly viewable.

And that's an awful lot of work just to cold-call someone to try to sell them insurance or whatever.

With a handy-dandy facebook bug that allows them to scrape such data at scale?

This has happened multiple times before, at least two separate incidents have made the news.

This doesn't seem like a reliable way of running a business: just hoping that you can exploit a bug in Facebook (which will surely be fixed before long) so you can grab people's friends, try to figure out their phone numbers, then spoof them, then cold-call them trying to sell them crap insurance.

I'm sorry, this just sounds far-fetched to me. History seems to have shown that when hurdles are just a little too high, the spammers just don't bother.

Why just facebook? Spammers have been exploiting bugs like this in everything for years. The data gets scraped and then sold and resold.

While I agree, if you randomize the number that needs to be pressed to get by the prompt it could become a serious roadblock for most autodialer systems.

Go the ReCaptcha route and have them listen to 9 sounds and tell you which one of them are store fronts.

I like the idea of using a 'enter code' (where code is pseudo randomly generated) to request your number be added to the white list. This could be done for all users not in your contacts. Then, the user could leave, say a voicemail, which is converted to text that goes into a list that you could later scan for valid requests.

I currently use the "Should I Answer" app, mentioned below, which is about as good as it gets in terms of pissed off people working together to fight the good fight I think.

However, all of this crap is still jist a bandaid for a lack of our governmental ability (at least in the U.S.) to hold phone utilities accountable for the illegal use of phone numbers.(1) Fine the phone companies hard and the problem goes away.

1. https://www.consumerreports.org/consumerist/phone-companies-...

I did something similar for myself nearly 20 years ago with Asterisk, and it was amazingly effective for my home phone. I'd whitelist numbers of friends and family, everyone else had to dial a number to get the phones in the house to ring.

I stopped doing it when I basically switched over to a cell phone as my only phone.

For a while 5 years ago I was getting a ton of spam calls, mostly the "Rachel from Credit Card Services" ones. One to two a day.

After trying the "Press 1 to be put on our do not call" and speaking to a person and asking to be put on their do not call, filing those FTC complaints, and still getting a few a day, I started using a "fake person generator" and just stringing them along. After a couple weeks of this I got one that went along with me for a few minutes and then said "Thank you for playing <my phone number>, you will continue to get calls." and hung up.

This was fantastic, because at the time I had 3 phone numbers associated with my cell phone, and I didn't know which one was getting the calls. I shortly after switched to Google Fi, and ditched the number that they had been calling, and the calls dropped way off.

Yeah I got the OBi device as I intended to use it as a VOIP gateway to connect to Asterisk, but in the end I was able to do everything I needed on the device.

I do exactly this today, using Phone.com as my home VoIP provider. One "universal" number rings both my cell and the VoIP land line determined by my travel schedule. Not on my whitelist? A prompt asks the caller to dial 7. No robocall has gotten through since.

Of course if this were widely available for people who can't write five lines of code, it would be defeated. For HN readers, some of whom scripted checking into Continental flights right at the 24 hour window to game the upgrade list, this is child's play that works.

Cool idea, but you're talking about a landline though aren't you?

The implication from the OP is that it's a question about mobiles. It's not 100% clear, but in my experience people rarely bother to have contact lists on landlines, which themselves are increasingly less popular.

Sure, but the point is that with this greylisting approach you don't need them.

iPhone or Android. We don’t have a landline.

Great workaround.

"Please press 1" reminds me of the recent CCC talk on automating hacking mobile voicemail to get access to online account recovery codes.

Some websites required a key press before speaking the code so he simply recorded the DTMF tone on the voicemail greeting message.

https://media.ccc.de/v/35c3-9383-compromising_online_account...

Many landline handsets sold in the UK now have this as a feature.

What I've found is that whist it does stop a lot of spam calls they now fake local numbers. Worse they fake them with a missing digit. The phone companies could definitely spot that. I've wondered previously if international telecoms treaties stop the phone companies from acting to block these calls.

The whole reason why I did this was because I was playing around with Asterisk and VOIP, and wanted to connect a PTSN line to it (which the OBi device was marketed as), but it turned out I could do everything on the device.

Anyway, at the time I was traveling a lot so had my VOIP number forward to whatever local number I had in that country. That worked great, except on my phone it just displayed my VOIP number as the caller ID, so I had no idea who was calling.

In Asterisk I saw you could set the caller ID, but it didn't work for outgoing calls via my SIP trunk, so I assumed it was disabled by my provider (makes sense). I contacted them, and they said they had unlocked that feature, after which I could make a phone call with any caller ID. I expect there is something fundamental about how the telecom system works that prevents them from blocking these calls, but I'm really surprised at how easy they gave me access to it.

My brother used a nice addition to this that worked quite well -- the message started with the obnoxious three-tone sound that usually precedes a failed call ("beeep-boooop-beeep this call cannot be completed as dialed..."), then just went into the "please press 3 to be connected to ..."

Seemed to automatically take them off most lists pretty quickly.

When I had a landline, I set my voice mail message to the 'we're sorry, your number cannot be completed as dialed' message. Worked great.

Hard to see any downsides to that plan.

Truecaller is a spam blocking service that may help

https://www.truecaller.com/

First time I heard about a voice captcha.

All the captcha systems I know about have a voice option for the blind. I end up using it fairly often because the image obfuscation techniques a lot of them use now makes the text nigh unreadable for humans.

What do you mean by foreign number? Most spam calls I get are from the same area code as my phone number?

Some of the spam calls I received were from US phone numbers (I'm in the UK), but when I answered I ended up connected with someone with a Southern Asian accent speaking rather bad English.

Reply on news.ycombinator.com