- Is Microsoft Is Doomed? (ver. 2)
- Is Google Enterprise For Real?
- Cozying Up to Dictators and Hooligans
- Where Have All The Good Product Managers Gone?
- Same As It Ever Was
- 10 Really Bad Ideas
- 'Net Neutrality' Nonsense
- Bye Bye Scott -- Don't Let the Door Hit You On The Way Out
- Why Is Everyone Illiterate?
- CIOs Should Be Technologists
April 06, 2006 | Comments: (0)
Outlaw Caller ID!
In another misguided attempt to stop some dubious behavior, the House of Representatives is trying to outlaw caller ID spoofing. This is another example of legislation that will not achieve the desired outcome (i.e. getting the baddies to stop using spoofing techniques in their social engineering games), and could possibly hurt unsuspecting companies.
Why? It is a trivial task to change your caller id these days to be any arbitrary value that you want. With the advent of widespread VOIP providers that actually let you do this explicitly, even the script kiddies can do this. Those savvier folks can either reprogram their phone switch (with VOIP switches like the NBX 3000 from 3com at less than $2k these days), or program their Asterisk switch (open source -- free) to present any caller ID you want to.
Caller ID should never be used as a form of security. For example, there is a HUGE security loophole for most people's cell phone voicemail. I've tested both Cingular and T-Mobile -- both of these providers at least in southern California use caller ID as an authentication mechanism for voicemail. What does this mean? If you set your call ID to be somebody's cell number, then dial that cell number, you get thrown into voicemail without any authentication. Wow. What a security problem. The easy work-around is to put a password on your cell phone voice mail (how many of us do that?)
My point is that the easier the work-around/hack to let you do something, the more silly/infeasible/stupid a legal remedy becomes. It's reminds me of the issues with copyright and shared music -- if the workaround is trivial, then the legal remedy is foolish and irrelevant (but more on that for a later entry).
The danger here is that certain company practices might fall afoul of this new law. Say, for example, that I am selling products to people in San Diego. I might want the caller ID presentation to my company's outbound calls to be a local San Diego number (that forwards to the main company number). Is this spoofing? Who knows? With telephony advances (and commoditzation of 800 numbers and local number call forwarding), these types of practices will become more common. They are beneficial to the consumer/customer (they get to call a local number), as well as the business (you have a local presence).
So stop using caller id for any form of security authentication, and put a password on your cell voicemail. And merely use caller ID as a suggested number that you might call back on. You've been warned.
Posted by Paul T. Ryan on April 6, 2006 05:03 PM
RATE THIS ARTICLE:
-

- COMMENTS
This is aimed at tele-marketers that do not abide by the "Do not call" list.
Passing more laws will not keep them from breaking
them.
As always, we need to enforce the laws and
send CEOs to prison. Have them picking up trash on Wall Street in orange jump suits.
My point is that the easier the work-around/hack to let you do something, the more silly/infeasible/stupid a legal remedy becomes.
Driving drunk is ridiculously easy to do - no workaround needed at all. So laws banning it makes no sense then?
A law is a signal about what is and is not acceptable behavior. Just because breaking it is easy in a technical sense doesn't mean the law is sily or stupid. Quite the opposite - we don't need any laws banning things that are impossible to do anyway, after all.
Of course, whether caller-ID spoofing should be acceptable or not is a different question - but a question we, as a society resolve through debate, passed and revoked laws, and through the legal system, not on the basis of how easy it is to do.
Posted by: Janne at April 17, 2006 03:17 AM>My point is that the easier the work-around/hack to let you do something, the more silly/infeasible/stupid a legal remedy becomes.
This is absurd. How easy it is to break a law is not a reason to create or not create that law. There are small towns where people leave the doors unlocked and cities where people put multiple locks on the doors. The same laws about breaking and entering exist in both places. It is extremely easy to push down on the gas pedal and go faster down the highway yet no one says that because it's easy to break the speed limit that speed limits should be abolished.
As it gets easy it is to do something dubious then the law/penalty beccomes the single factor restraining the activity.
Posted by: Warren at April 17, 2006 12:59 PMWow. Yes -- how easy or hard it is to enforce laws should factor into the lawmaking power -- creating laws that people agree do not promote the common good (or a reasonable person doesn't) REDUCES THE RESPECT FOR ALL LAWS. Remember prohibition in the US? Using analogies like drunk driving, breaking and entering is a fatuous exercise in extreme examples. Let's talk about things where the common good is not necessarily so apparent -- like if I want to listen to my music on my iPod. Laws that:
1 - Have weak or no linkage to the common good, and
2 - Are easily circumvented
hurt rather than help the rule of law.
Posted by: Paul T. Ryan at April 18, 2006 08:02 AMAs a red card-carrying member of your aforementioned rabble, I suggest even more laws be redacted and discussed ad nauseum. More for the ego anointed elite to mentally masterbate over as hoi polloi (usage of "the" beforehand is redundant, as hoi refers to the article "the" in greek) plan myschief and general skulduggery at the time of their choosing.
Posted by: Peregrinus at April 26, 2006 08:54 PMImagine someone used this technology to contact someone using your phone number.
Imagine the person who did this was your boss using your personal phone number to bother a former employee of yours who was ducking calls from your boss.
Imagine your boss was a company executive so not only was one call not enough to press harassment charges but your company never took action to punish your boss because they don't know how he did it and don't really want to because their equipment may have been used.
This happened to me and a former employee of mine. It's not so innocuous a prank.
Posted by: kinda ticked at December 16, 2007 10:51 AMTOP STORIES
ADDITIONAL RESOURCES

- Virtualization: A Step by Step Approach to Success
- Dialing up Agility with Business Transformation
- 5 Things You Need to Know About Storage Virtualization

- Is your smaller organization ready for High Availability?
- Is system maintenance doing more harm than good?
- Virtual Test Lab Automation: Manage development infrastructure





