[ISN] VoIP hackers gut Caller ID

[InfoSec News]

http://www.theregister.co.uk/2004/07/07/hackers_gut_voip/

By Kevin Poulsen
SecurityFocus
7th July 2004 

Hackers have discovered that implementation quirks in Voice over IP
make it easy to spoof Caller ID, and to unmask blocked numbers. They
can make their phone calls appear to be from any number they want, and
even pierce the veil of Caller ID blocking to unmask an anonymous
phoner's unlisted number.

At root, the issue is one of what happens to a nugget of
authentication data when it leaves the tightly-regulated realm of
traditional telephony, and passes into the unregulated domain of the
Internet.

On the old-fashioned phone network, Caller ID works this way: your
local phone company or cell phone carrier sends your "Calling Party
Number" (CPN) with every call, like a return address on an envelope.  
Transmitted along with your CPN is a privacy flag that tells the
telephone switch at the receiving end of the call whether or not to
share your number with the recipient: if you have blocking on your
line, the phone company you're dialing into knows your number, but
won't share it with the person you're calling.

This arrangement relies on telephone equipment at both ends of the
call being trusted: the phone switch providing you with dial tone
promises not to lie about your number to other switches, and the
switch on the receiving end promises not to reveal your number if
you've asked that it be blocked. In the U.S. that trust is backed by
FCC regulations that dictate precisely how telephone carriers handle
CPNs, Caller ID and blocking. Most subscribers have come to take
Caller ID for granted, and some financial institutions even use Caller
ID to authenticate customers over the phone.

Despite that, the system has long been open to manipulation. "A lot of
times you can offer any number you want, and carriers won't validate
that," says Lance James, chief security office of Secure Science
Corporation. But in the past, the power to misrepresent your number
came with a high price tag: you typically had to be a business able to
pay the local phone company for a high-volume digital connection. On
the other side of the equation, companies who pay for toll free
numbers can often access an incoming caller's phone number even if
it's blocked.

VoIP networks, currently outside FCC regulation, place those
capabilities in the hands of ordinary netizens. In a telephone
interview with SecurityFocus, 21-year-old phone hacker "Lucky 225"  
demonstrated how he could spoof his Caller ID to appear to be phoning
from the reporter's office. In another demonstration, the reporter
phoned Lucky's associate "Natas" from a residential phone with Caller
ID blocked. Natas was able to rattle off the unlisted phone number.

As described by Lucky, who's scheduled to give a talk on the subject
at the DefCon hacker convention later this month, much Caller ID
chicanery can be accomplished by taking advantage of implementation
quirks in Voice over IP networks that try, but fail, to implement
Caller ID properly. "There are little exploits that you can do," says
Lucky. But the most powerful tool for manipulating and accessing CPN
data is the open-source Linux-based PBX software Asterisk, used in
combination with a permissive VoIP provider. "It's fully configurable,
you can pretty much do anything you want with it," says Lucky. "That's
why Voice over IP is changing things."

Natas used Asterisk in conjunction with the NuFone Network for his
demonstration of Caller ID unmasking. NuFone chief Jeremy McNamara
didn't return phone calls for this story.

Privacy advocates, who had reservations about Caller ID when it was
introduced in the 90s, aren't happy that it's becoming easier to
subvert. "A worse case scenario is if you have a blocked number, and
you're a victim of stalking, and you're duped into calling a number
the stalker set up that was routed through a VoIP line," says Jordana
Beebe of the San Diego-based Privacy Right's Clearinghouse. "It could
put their life in danger."

Callers with life-or-death anonymity concerns might consider spoofing
just to get a little privacy. For now, Lucky says pranks among friends
are the most common use that he's seen of VoIP spoofing, but he
believes that identity thieves and other swindlers could have a field
day. "I've used it myself to activate my own credit cards, because I
never give credit card companies my real number," he says. "One simple
spoof, and it's like saying, if you have the guy's phone number, that
piece of information is more important than his mother's maiden name
and date of birth. If you have the phone number, you don't need
anything else."