Technology facilitates Caller ID spoofing

[Sam]

Becareful out there!!! and take this as a heads up!!!
From buying tickets to whatever. Keep yourself and your families safe.
Too bad we just don't shoot these BLEEPS or hang them or use them for medical research or something and eliminate them from the gene pool.
Unfortunately they seem to have the reprocuction capabilities of cockroaches.


*************************************************************





*************************************************************

http://www.businessweek.com/ap/financia ... wn&chan=tc

Associated Press/NEW YORK
By PETER SVENSSON
AP Technology Writer

Technology facilitates Caller ID spoofing

MAR. 1 1:56 P.M. ET Last fall, U.S. Rep. Tim Murphy's office started getting phone calls from constituents who complained about receiving recorded phone messages that bad-mouthed Murphy.

The constituents were especially upset that the messages appeared to come from the congressman's own office. At least, that's what Caller ID said.

"People thought we were making the calls," Murphy said.

The calls, which the Pennsylvania Republican estimated in the thousands, were apparently placed with fake Caller ID. That has been possible for a long time, but it generally required special hardware and technical savvy.
In the last few years, Caller ID spoofing has become much easier. Millions of people have Internet telephone equipment that can be set to make any number appear on a Caller ID system. And several Web sites have sprung up to provide Caller ID spoofing services, eliminating the need for any special hardware.

For instance, Spoofcard.com sells a virtual "calling card" for $10 that provides 60 minutes of talk time. The user dials a toll-free number, then keys in the destination number and the Caller ID number to display. The service also provides optional voice scrambling, to make the caller sound like someone of the opposite sex.

Caller ID spoofing appears to be legal, though many of its uses are not. The Federal Communications Commission has never investigated the issue, spokeswoman Rosemary Kimball said.

Lance James, chief scientist at security company Secure Science Corp., said Caller ID spoofing Web sites are used by people who buy stolen credit card numbers. They will call a service such as Western Union, setting Caller ID to appear to originate from the card holder's home, and use the credit card number to order cash transfers that they then pick up.

Exposing a similar vulnerability, Caller ID is used by credit-card companies to authenticate newly issued cards. The recipients are generally asked to call from their home phones to activate their cards. Some card companies maintain, however, that they use additional means to confirm new cards.

Two spoofing services contacted by The Associated Press, Spoofcard.com and Telespoof.com, did not return messages seeking comment about their business. However, some of the five or so Web sites in the business don't appear to be completely unscrupulous: James said he had been hired by a few of them, which he would not name, to help stop the Western Union scam.

Also, both Spoofcard.com and SpoofTel.com say they will surrender call logs to authorities in response to subpoenas. Spoofcard.com's site says the service is "intended for entertainment purposes only."

Telephone companies can trace calls to their origin regardless of the Caller ID information they carry, but the process is laborious, especially since a call may be carried by several companies before reaching its destination. The fragmented nature of the telephone network also makes it technically difficult for the carriers to prevent spoofing.

At Verizon Communications Inc., security manager John Lewandowski said the company often gets complaints about fake Caller ID after a telemarketer has spoofed his number to cover his tracks.

In a typical case, someone will be jarred in the middle of the night by repeated telemarketing calls. He checks Caller ID, calls the number -- which is false -- and starts "cussing out" the person at the other end of the line, Lewandowski said.

"And that poor guy was asleep. It wasn't him at all," Lewandowski said. The company investigates and tracks down the callers, he added.

Apart from fraud and telemarketing, Caller ID spoofing can be used for pranks and spying.

In one case, SWAT teams surrounded a building in New Brunswick, N.J., last year after police received a call from a woman who said she was being held hostage in an apartment. Caller ID was spoofed to appear to come from the apartment.

It's also easy to break into a cell phone voice mailbox using spoofing, because many systems are set to automatically grant entry to calls from the owner of the account. Stopping that requires setting a PIN code or password for the mailbox.

In a slightly more complicated fashion, spoofing was part of the technique used by a hacker who broke into Paris Hilton's cell-phone voicemail in 2004, according to an interview with security consultant Kevin Mitnick on CNN. The hacker apparently called the celebrity socialite posing as a technical-support person from the carrier, and lured the password from her.

That is known as a "pretext" call -- someone poses on the phone as a customer, employee or even a regulator to obtain personal information from companies and individuals. And indeed, while Spoofcard.com contends that its service is for "entertainment purposes," it also notes that "Private Investigators will find Caller ID spoofing valuable for pretext calls."

Robert Douglas, a privacy consultant in Colorado, testified before Congress last month that pretexters trade tips on finding the best spoofing services.

Pretexters generally claim their practices are legal, as long as they don't involve financial information. A bill introduced in the Senate would make it illegal to pose as someone else to obtain phone records, or to buy records from phone company insiders.

Douglas would like legislation against Caller ID spoofing as well, but there appears to be little interest in Washington.

"If I'm paying extra for Caller ID, which I do ... there should be some ability on my part to believe what I'm getting," Douglas said.

In Alaska, State Representative Bob Lynn has introduced a bill to make spoofing a misdemeanor. "False caller identification is more serious than pranks, or the annoyance of intrusive telemarketing," Lynn writes. "It facilitates fraud, and can be potentially deadly."

However, it is unclear what effect the bill would have. As Lynn notes, Caller ID is a federal issue

[ragtopW]

I don't know about the last part Sam. I would think the Phone company
would have a Vested interest. I payfor Caller ID I expect
the right info. if I am not getting it, that may be a fraud issue.

just my .02 cents.

[Capt.Flock]

nope not fraud
I used to work for a company that did this

[ragtopW]

nope not fraud
I used to work for a company that did this

I mean as far as the fact, I am paying for Caller ID not Caller Whatever
they want me to believe.. I do not kn ow if it's on the books now
I am just thinking in the future

to me it's kind of like buying milk.. only to find out it's Goats milk
not Cows..

[Sam]

I don't know about the last part Sam. I would think the Phone company
would have a Vested interest. I payfor Caller ID I expect
the right info. if I am not getting it, that may be a fraud issue.

just my .02 cents.

Bro, I just don't really know about it but I have had toll free numbers come in with some different things on like "DUI TASK FORCE" during the Holidays and some telemarketer on the other end.
Personally would like to get the company's owners home phone numbers and call them up during supper or all hours of the night and ask them if they know what the temperature is and tell them I can sell them thermometers and save them big money or some such.

either that we dould take them all out and line them up with an apple on thier head and take a shot for each time they called somebody with their inane BS. Would be a great way to break in that 6mmR you are going to get and give me some pactice with my .270. ( Of course we get to bill them for the ammo and our time and for the apples...Hmmmmm maybe we should start off with pumkins and gradually work our way down to cherries or those itty-bitty tomatoes...... what do ya think? )
Wonder if we could get the samething or something similiar done with SPAMMERS ???

[thegoatgod]

http://www.spooftel.com/
and

http://www.camophone.com

this is all to popular with my drunking buddy

[Lastplaneout]

I once got a call from 911 which was a buddy...and another the next day from 4:20....I thought it was pretty funny...as much as i'm on teh interweb I didn;t knowe about this.

[Lundah]

I'm a phone geek for a living, this is actually really simple to do. Depending on how the connection to the phone company is set up, it is possible for the subscriber to tell the phone company what number to display. This is usually used for companies that may have people spread among several different locations, yet all using the same "trunk" connection back to Ma Bell. Also, my cell phone allows me to edit the caller-ID sent out on a per-call basis.