Re:FCC will require phone carriers to authenticate calls by ...
by anon9001 on Wednesday April 01, 2020 @01:51AM
(#22746091)
Neat job.
Question you might know the answer to: I've noticed it's a pretty common practice to get appointment reminders with caller ID from the doctor's office. I like that feature. I'd imagine there are plenty of other legitimate use cases for caller ID spoofing as well. Do you have any idea how that's going to work with STIR/SHAKEN?
I'd guess it's going to be some kind of oauth for your phone number, where you own it and can grant spoofing access to other entities?
Google seems to be supporting it: https://ecfsapi.fcc.gov/file/1119583115056/2018-11-19%20Goog... (via https://www.fcc.gov/call-authentication)
Re:FCC will require phone carriers to authenticate calls by ...
by emiliosic on Wednesday April 01, 2020 @08:47AM
(#22748004)
It's going to be a problem for some systems for sure, but as the STIR framework is used to attest the number, the caller itself doesn't need to do anything. The originating carrier then attests with a level certainty A, B or C who the caller is, and adds a crypto signature to the signaling.
The key here is the attestation. If the calling carrier (usually the provider of the DID in retail but in commercial, not necessarily the same carrier) can attest by the caller, then the call will go through regardless. So tele-center company can agree with the calling carrier that, basically, tele-center company really owns the number (A) or it's more or less certain of it (B) and the call will be sent attested.
Re:FCC will require phone carriers to authenticate calls by ...
by TuringNYC on Wednesday April 01, 2020 @02:55AM
(#22746360)
The case you are citing is not the one I would be most concerned about -- it is the spoofed numbers that should have been top priority. I get calls for different numbers (almost like they have been selected randomly) every single day selling cruises.
If you call the missed call back, you realize the person picking up didnt make the call.
Re:FCC will require phone carriers to authenticate calls by ...
by anon9001 on Wednesday April 01, 2020 @03:21PM
(#22752578)
Be careful calling the numbers back. There's another scam where they use the equivalent of a 900 number to do billing to anyone who calls. The scammers use country codes with 3 digits to try and trick you into thinking it's a US number and hope that you attempt to return the call.
I work with phone systems. It's usually determined by how long they hear a continuous sound at the start of a call. If it's relatively short (and it can be adjusted by settings), it assumes it's a live voice (like someone saying "Hello?" is usually pretty short). If it's continuous for a certain period of time, it assumes it's a voicemail.
For our speech applications we have different behaviors depending on which call disposition is detected (that's the term for this, also determines things like invalid phone numbers).
Sometimes when testing speech applications I'll pick up and scratch the receiver continuously or speak without taking a pause until the voicemail disposition is triggered so I can test a voicemail message without having to check voicemail.
We make these calls on behalf of health insurance companies for health reminders and surveys, so our calls are more legitimate than most, but we do use an autodialer to reduce the load on our live agents.