Hacker News Reader

> Part of the problem is the conceptual designs around the SS7 signalling network. Trust is all or none. If you allow a switch in {x} country to connect to your switches, then they can spoof calls.

Why does the problem have to be tackled from the direction of extending the wire protocol? It seems like it would be straightforward to tackle it from the business end first: a major phone company declares that it will block spoofing on calls originating in its network, and will only accept calls coming into its network from partners who make the same commitment to not allow spoofed calls onto their networks. This doesn't require any changes to the technology used to connect phone networks, just changes to the business arrangements (a threat of blacklisting).

(If you don't want to take quite such a hardline approach, then require that all calls either originate from a network that is trusted to have valid caller ID data, or the caller ID data is stripped from the call. And then give all end users the option of blocking calls with blank caller ID.)

I suspect it has to do with roaming. I have a phone in country X with company Y. If I travel to country A with company B and make a call, is it spoofed?

This is a good question. I think the problem lies in the fact you would have to include in your business decision to block roaming. Roaming is a money maker, so I think you would have a hard time convincing telcos to block that. There are laws around roaming as well that you would have to augment or remove internationally. If numbers were not portable and roaming did not exist; meaning, you have to acquire a local number through some form of authentication and your source country forwards the calls to that temporary number, then that might work. When you call people back, they won't see your number though. They would see the loaned local number. At this point we are reinventing the proposed shaken/stir but in a more cumbersome manor.

all calls either originate from a network that is trusted

That is also tricky. What does trusted mean? Does it mean that if someone on that network is abusing SS7, that they become untrusted? If so, every network would be untrusted within 10 minutes. Maybe a cost penalty to self regulate? You have to block your own reported abusers or lose peering? I like the idea, but I think that would put us back into that realm of legal and political quandaries. This would require a fairly significant addition in full time employees to police the abuse reports and entirely new reporting systems to log all the SS7 data, learn and report abuse patterns.

> I think the problem lies in the fact you would have to include in your business decision to block roaming.

Does roaming involve my cell phone having the same kind of unrestricted SS7 access on the telco's network that enables spoofed robocalls? If so, what the hell are SIM cards for?

> What does trusted mean? Does it mean that if someone on that network is abusing SS7, that they become untrusted?

Trusted here would mean the network enforces ingress filtering on caller ID data; that calls being placed by end users on that network have accurate caller ID attached by the carrier, and calls coming in from another network either have trusted caller ID data or blank caller ID data.

I don't know enough about how SS7 works to know how what degree of access to SS7 is used by various methods of placing calls, but it seems pretty likely that ordinary landline and cellular phones are not viable ingress vectors for spoofed robocalls, and filtering is only needed with more advanced services such as connecting your PBX to the carrier's network.

what the hell are SIM cards for?

SIM cards are for binding IMSI/MSISDN/IMEI, to authenticate you to the mobile network and update the HLR with your location. This data also traverses the SS7 network but does contain some authentication data specific to the wireless provider. The landline telcos have no knowledge of what this data means beyond the ability to route it. The mobile switches will route your MSISDN to the other SS7 networks.

accurate caller ID attached by the carrier

This goes back to the suggested shaken/stir method of authentication. There is really no other way to determine what is valid and what is not. The carrier can attach nearly any number and that number can be entirely valid.

Again, what the hell are SIM cards for? Skip the alphabet soup, please.

On some level, a SIM card must authenticate you to the local tower operator as authorized to place calls, and identify what other carrier gets billed for that if you're roaming. They also identify (in an authenticated manner) what the phone number is for your cell phone, so that the local tower operator can start routing calls to that number to your handset. This seems sufficient for the local tower operator to ensure that you aren't using your smartphone to place tons of robocalls with spoofed numbers, using only infrastructure that is already universally implemented.

I don't see where a landline telco on the receiving end of calls originating from your smartphone needs to know anything about any of that process; the mobile network operator that's connecting the first hop of your call can be and should be the one responsible for preventing you from abusing the network. I want my phone company to hold the mobile network to that standard before letting calls from that network make my phone ring.

> This goes back to the suggested shaken/stir method of authentication. There is really no other way to determine what is valid and what is not. The carrier can attach nearly any number and that number can be entirely valid.

This sounds again like you're deciding ahead of time that the problem can only be addressed by a technical solution that turns out to be basically intractable. You're saying that solving the spoofed robocall problem requires every telco to be able to fully validate in realtime who owns what number and is roaming where. I'm pointing out a relatively non-technical solution where each network is only responsible for restricting the bullshit the let into their network, at the boundaries where it seems practical to enforce without overhauling the entire protocol stack for the whole industry. And lax enforcement would get a carrier blacklisted, or at least make all calls originating from their network readily identifiable as suspicious and trivially blockable.

What I am saying is that mobile networks don't share any of this data with telcos. To do so would require overhauling the landline networks to support this. No such technical capabilities exist today. The business decision you are suggesting could not be implemented even if they wanted to. Mobile networks are another implementation of SS7 and the only thing common between them and landline networks is the routing. I am not deciding anything and I am just basing my opinions on my long past experience.

> What I am saying is that mobile networks don't share any of this data with telcos.

I'm not asking for any new data to be shared from mobile networks to landline telcos. You haven't explained why you think that is required in order for mobile networks to perform sanity checking (or sanitization) on the data they're already sending to other telcos during call setup.

Roaming is a concept in the mobile networks, that isnt really part of the problem here, that is robocalls. As LinuxBender says, the decision is to block the ingress link containing the robocalls. These calls generally dont come from mobile devices roaming abroad, but from voip switches that have access to the landline network and configure their own a-party afaik.

> It's a very ancient system, much older than the internet.

Actually, you could argue they're around the same age. ARPANET switched from NCP to TCP on 1 January 1983 [1] and the initial SS7 standard was released by the ITU in 1988.

[1] https://tools.ietf.org/html/rfc801

That sounds wrong to me? Surely you could do something like ingress / egress filtering of the numbers, and not allow an American number from India, for instance? Am I missing something in the setup.

I guess what you're really saying is that most phone systems are nowhere near that sophisticated?

Not my expert domain but; Roaming. How do you let someone with a cell phone make a call while on vacation half way around the world, without giving them most of a second of latency?

What you are saying totally makes sense, but numbers are portable as mjevans pointed out and b-number analysis is a bit more primitive. This requires cooperation from all the telcos and would require business changes, process changes and code changes to systems so that you could approve-list what is a mobile network NPA/NSX and deny-list what is not. This just means spoofers would only be spoofing mobile numbers. Now you have a game of whack-a-mole. Some of these systems are so old that the people that wrote code for them are long gone. I am not saying that is universally true of course. Some switches had fairly modern hardware. But unlike the internet where everything peers with bgp and information / routing information is freely shared, there is a lot more manual work and manual changes and coordination required. Even if you could update all of them, now you have to maintain yet another real time deny-list and that does not really solve spoofing.

Surely spoofed calls can be detected and infringements penalised i.e. you can’t lock the front door so instead of prevention you identify who walks through the door and punish thieves.

Detection seems like it is doable - either technically (detect spoofing which implies something impossible like a home phone in Nigeria) or consumer feedback (e.g. a short number to call which marks previously received call as a robocall). And some detection can be done with existing equipment and fails gracefully (it doesn’t need to be 100% reliable) unlike changes to core protocols/equipment.

The thing that gets me is that no matter what is on the line, spoofed Caller ID or no, telcos know exactly which account is paying for that outbound call to exist. The technology can't be quite as primitive as portrayed, since AFAIK there is absolutely no way you can spoof someone's number in CID and have something billed to them, such as a long-distance call from a landline (which still have LD plans). Telco is always going to know where the money is coming from for every volt and bit on their wires.

It's possible I'm clueless, but that's where I feel enforcement should be focused: on the money side.

> Even then, telco's have more lobbyists than all the silicon valley big tech combined, no exaggeration.

Very interesting, and certainly not the first time I've heard that. I wonder if and when Facebook is going to encroach on telco turf.

I would not imagine silicon valley wanting into the landline business. Mobile perhaps, Google dipped its toes in that one I believe through acquisitions. Landline operators today are the opposite of agile, move-fast-break-things. Change control in telco is draconian compared to anything SV tech have seen. New ideas almost never see the light of day. And all of this is codified in regulations. It's comparable to the banking industry, though each have their own quirks.

Ouch... if that's the case, how can the FCC do anything to find the scammers? It sounds like it's technically impossible (and maybe also politically, alas).

At best, they could require the U.S. to implement STIR/SHAKEN [1], maybe. There will be significant technical and legal challenges in this. Overhauling or upgrading the existing switches is non trivial. This is just my opinion, but I predict this will result in legal battles and legal stalling on the part of the telcos. Even if all the telcos agreed to do this, there would be a period of time that nothing is enforced and even then, this has no impact on anyone outside of U.S. jurisdiction unless laws with teeth require amended agreements between the U.S. and non-U.S. telcos. I am not a lawyer, but I don't need to be one to see some of the ways this will play out and how this can turn into political posturing, deflection of responsibility and saber rattling between the U.S. and other countries.

[1] - https://transnexus.com/whitepapers/stir-and-shaken-overview/

> It's a very ancient system, much older than the internet.

That seems an odd characterization.. they both were being developed at nearly the same time. SS7 developed faster and was put into use much more broadly than IP due to corporate need and support, but they're both about the same age.

So there needs to be a way to report them anonymously?