Free Newsletters

   All InfoWorld Newsletters
ITXtreme with Paul Ryan » Outlaw Caller ID!

April 06, 2006 | Comments: (0)

Outlaw Caller ID!

In another misguided attempt to stop some dubious behavior, the House of Representatives is trying to outlaw caller ID spoofing. This is another example of legislation that will not achieve the desired outcome (i.e. getting the baddies to stop using spoofing techniques in their social engineering games), and could possibly hurt unsuspecting companies.

Why? It is a trivial task to change your caller id these days to be any arbitrary value that you want. With the advent of widespread VOIP providers that actually let you do this explicitly, even the script kiddies can do this. Those savvier folks can either reprogram their phone switch (with VOIP switches like the NBX 3000 from 3com at less than $2k these days), or program their Asterisk switch (open source -- free) to present any caller ID you want to.

Caller ID should never be used as a form of security. For example, there is a HUGE security loophole for most people's cell phone voicemail. I've tested both Cingular and T-Mobile -- both of these providers at least in southern California use caller ID as an authentication mechanism for voicemail. What does this mean? If you set your call ID to be somebody's cell number, then dial that cell number, you get thrown into voicemail without any authentication. Wow. What a security problem. The easy work-around is to put a password on your cell phone voice mail (how many of us do that?)

My point is that the easier the work-around/hack to let you do something, the more silly/infeasible/stupid a legal remedy becomes. It's reminds me of the issues with copyright and shared music -- if the workaround is trivial, then the legal remedy is foolish and irrelevant (but more on that for a later entry).

The danger here is that certain company practices might fall afoul of this new law. Say, for example, that I am selling products to people in San Diego. I might want the caller ID presentation to my company's outbound calls to be a local San Diego number (that forwards to the main company number). Is this spoofing? Who knows? With telephony advances (and commoditzation of 800 numbers and local number call forwarding), these types of practices will become more common. They are beneficial to the consumer/customer (they get to call a local number), as well as the business (you have a local presence).

So stop using caller id for any form of security authentication, and put a password on your cell voicemail. And merely use caller ID as a suggested number that you might call back on. You've been warned.

Posted by Paul T. Ryan on April 6, 2006 05:03 PM


RATE THIS ARTICLE:





 

  •  
  • COMMENTS




This is aimed at tele-marketers that do not abide by the "Do not call" list.
Passing more laws will not keep them from breaking
them.
As always, we need to enforce the laws and
send CEOs to prison. Have them picking up trash on Wall Street in orange jump suits.

Posted by: Sir Lanse at April 7, 2006 07:27 AM

My point is that the easier the work-around/hack to let you do something, the more silly/infeasible/stupid a legal remedy becomes.

Driving drunk is ridiculously easy to do - no workaround needed at all. So laws banning it makes no sense then?

A law is a signal about what is and is not acceptable behavior. Just because breaking it is easy in a technical sense doesn't mean the law is sily or stupid. Quite the opposite - we don't need any laws banning things that are impossible to do anyway, after all.

Of course, whether caller-ID spoofing should be acceptable or not is a different question - but a question we, as a society resolve through debate, passed and revoked laws, and through the legal system, not on the basis of how easy it is to do.

Posted by: Janne at April 17, 2006 03:17 AM

>My point is that the easier the work-around/hack to let you do something, the more silly/infeasible/stupid a legal remedy becomes.

This is absurd. How easy it is to break a law is not a reason to create or not create that law. There are small towns where people leave the doors unlocked and cities where people put multiple locks on the doors. The same laws about breaking and entering exist in both places. It is extremely easy to push down on the gas pedal and go faster down the highway yet no one says that because it's easy to break the speed limit that speed limits should be abolished.

As it gets easy it is to do something dubious then the law/penalty beccomes the single factor restraining the activity.

Posted by: Warren at April 17, 2006 12:59 PM

Wow. Yes -- how easy or hard it is to enforce laws should factor into the lawmaking power -- creating laws that people agree do not promote the common good (or a reasonable person doesn't) REDUCES THE RESPECT FOR ALL LAWS. Remember prohibition in the US? Using analogies like drunk driving, breaking and entering is a fatuous exercise in extreme examples. Let's talk about things where the common good is not necessarily so apparent -- like if I want to listen to my music on my iPod. Laws that:

1 - Have weak or no linkage to the common good, and
2 - Are easily circumvented

hurt rather than help the rule of law.

Posted by: Paul T. Ryan at April 18, 2006 08:02 AM

As a red card-carrying member of your aforementioned rabble, I suggest even more laws be redacted and discussed ad nauseum. More for the ego anointed elite to mentally masterbate over as hoi polloi (usage of "the" beforehand is redundant, as hoi refers to the article "the" in greek) plan myschief and general skulduggery at the time of their choosing.

Posted by: Peregrinus at April 26, 2006 08:54 PM

Imagine someone used this technology to contact someone using your phone number.

Imagine the person who did this was your boss using your personal phone number to bother a former employee of yours who was ducking calls from your boss.

Imagine your boss was a company executive so not only was one call not enough to press harassment charges but your company never took action to punish your boss because they don't know how he did it and don't really want to because their equipment may have been used.

This happened to me and a former employee of mine. It's not so innocuous a prank.

Posted by: kinda ticked at December 16, 2007 10:51 AM

Technology White Papers

 

InfoWorld Technology Marketplace

  • Protect Your Data with SSL - Discover how to increase customer confidence in your site with the latest solution in SSL, Extended Validation (EV) SSL ...
  • Need simple, low cost server virtualization? - Do more with less. Support fewer servers. Simplify disaster recovery. Implement proven, easy-to-use server virtualization...
  • Virtually Limitless Virtual Storage - Do you need virtualization space savings of 50% or more with virtually no performance impact? You might be able to get storage...
  • Invisible IT? - The goal of IT is to become an invisible entity within a larger organization. Eliminating visibility and road blocks IT ...
  • It Really Is Easy to be Green - "Green IT" is a popular concept. And IT organizations are learning the influence that IT purchase decisions have on data...
  • Key Strategies For SOA Testing - SOA requires a unique approach to testing. Unless you're willing to reorient your testing procedures and technology now,...

» Technology White Papers Library

Technology White Papers by Topic

Technology White Papers E-mail Alert

Find out when the latest white paper is available:
 
 
» BUY A LINK NOW

Sponsored Technology Links