Normally, punching *67 should block Caller ID informationbeing passed through to a receiving caller. But, as security consultant Kevin Mitnick has demonstrated and DigiumCTO Mark Spencer explains, it's not 100 percent foolproof.
At The Last HOPE hacker conference over the weekend, Mitnickdemonstrated how an appropriately configured Asterisk box and a suitable SIPtrunking service can be used to deliver Caller ID information even on inboundcalls that have a "Private" flag set.
"There are legitimate reasons why you need to set the CallerID to normal [and carry that information forward,]" said Digium CTO MarkSpencer. "If, for example, I'm in an enterprise environment and I want to havecalls forwarded [from my office number] to my cell phone, [the PBX] needs thatinformation."
Mitnick used the "enterprise class" VoIP/SIP trunkingprovider FlowRoute to get a phone number (DID) and service that would deliverall of the call information to an Asterisk server. The Asterisk server is simply setup/scriptedto pass along all Caller ID information for inbound calls regardless of thesetting of the privacy flag on the call.
Spencer also noted that Caller ID information is alsocarried along and recorded for "private" calls to toll free numbers; theinformation is necessary for proper billing.
Mark is not happy with the use of Asterisk for questionableuses, but since it is open source, there is little he can do about it. "I hate to say it, but the same reasons whyAsterisk is attractive to a lot of businesses, it's low cost, it can be easilytweaked, it's more flexible, make it easy for using it for an illegitimatepurpose," said Spencer. "It's a very powerful platform. I'm not thrilled aboutit being used for fraud and I'm not thrilled with companies who build productson it in competition with Digium, but there's not a lot I can do about it."
For more:
- Engadget snags
Mitnickdemo video from The Last HOPE conference
Related articles:
Last Hope Launches
SecuritySeason
VoIP Security and the
Circleof Trust
More...
VoIP Forum
Digium CTO parses unblocked Caller ID hack
Linear Mode
