End-to-End Detection of Caller ID Spoofing Attacks Hossen Mustafa, Member, IEEE, Wenyuan Xu, Member, IEEE Ahmad-Reza Sadeghi, Member, IEEE and Steffen Schulz Abstract—Caller ID (caller identification) is a service provided by telephone operators where the phone number and/or the name of the caller is transmitted to inform the callee who is calling. Today, most people trust the caller ID information and some banks even use Caller ID to authenticate customers. However, with the proliferation of smartphones and VoIP, it is easy to spoof caller ID information by installing a particular application on the smartphone or by using service providers that offer Caller ID spoofing. As the phone network is fragmented between countries and companies and upgrades of old hardware is costly, no mechanism is available today to let end-users easily detect Caller ID spoofing attacks. In this article, we propose a new approach of using end-to-end caller ID verification schemes that leverage features of the existing phone network infrastructure (CallerDec). We design an SMS-based and a timing-based version of CallerDec that works with existing combinations of landlines, cellular and VoIP networks and can be deployed at the liberty of the users. We implemented both CallerDec schemes as an App for Android-based phones and validated their effectiveness in detecting spoofing attacks in various scenarios. Index Terms—End-user Security; Caller ID Spoofing; ! 1INTRODUCTION the US government passed the legislation Truth in Caller ID Act of 2009 [5] making it illegal to transmit “What’s worse than a bad authentication system? misleading or inaccurate caller ID information with A bad authentication system that people have the intent to defraud. learned to trust” [1]. However, the legislation does not stop the misuse or Caller ID services transmit the phone number fraud, and today spoofing caller IDs has become much and/or the name of a caller to the recipient (callee) easier, because many VoIP providers allow anyone to as caller ID intending to provide informed consent to claim arbitrary caller IDs through VoIP client software the callee before answering calls. However, Caller ID (e.g., x-lite [6]), and fake ID providers allow their has been increasingly used to authenticate the iden- customers to claim any caller ID by simply dialing a tities of callers, or to verify their physical locations special phone number or by utilizing readily available in several systems, ranging from 9-1-1 emergency Apps on smartphones (e.g., Caller ID Faker [7]). Thus, services, automatic telephone banking systems, credit in this paper, we focus on detecting caller ID spoofing card activation systems, to voicemail services. Unfor- attacks. tunately, existing caller ID protocols do not provide Caller ID spoofing is possible because caller IDs real authentication and hence are untrustworthy for are transmitted in plaintext with no authentication authenticating callers’ locations or identities, because mechanisms in place. When a call is routed between caller IDs are vulnerable to spoofing attacks; i.e., an different carriers, the callee’s carrier will simply accept attacker can easily send a fake caller ID to a callee. the caller ID claimed by a caller’s carrier. Given the This vulnerability has already been exploited in a lack of authenticating the caller ID between carriers, variety of misuse and fraud incidents: In the US, caller IDs could be trustworthy if (a) the telephone thousands of people were victimized by credit card service providers do not manipulate caller IDs, (b) the fraud with the help of caller ID spoofing [2], causing telephone infrastructure is tightly controlled, and no a loss of more than $15 million dollars annually; caller intruders could tap into the infrastructure to create an ID spoofing is also a common technique used for arbitrary caller ID. These conditions were true in the swatting, which is an attempt to trick an emergency early days as the telephone network used dedicated service with false reporting of an incident — for in- lines operated by a monopoly. Today, with current stance, police officers were tied-up in responding to a converging phone/data networks and diversity of non-existent robbery reported by pranksters [3]; drugs telephone service carriers, neither holds any more. were misused as a result of spoofed pharmacists’ Moreover, telephone carriers may not be able to solve phone numbers [4]; other incidents include identity the problem even if they can redesign the protocols. theft, purchase scams [1], etc. Due to the proliferation This is because the entire telephone infrastructure of detrimental incidents caused by caller ID spoofing, comprises several telephone carriers with their own 'LJLWDO2EMHFW,GHQWL¿HU7'6& ,(((3HUVRQDOXVHLVSHUPLWWHGEXWUHSXEOLFDWLRQUHGLVWULEXWLRQUHTXLUHV,(((SHUPLVVLRQ 6HH KWWSZZZLHHHRUJSXEOLFDWLRQV VWDQGDUGVSXEOLFDWLRQVULJKWVLQGH[KWPO IRU PRUH LQIRUPDWLRQ 2 trusteds domains, and a carrier can at most verify calls originated in its own network but not from other net- works. To the best of our knowledge, no mechanism is currently available to users for detecting caller ID spoofing without answering the call first or without a special interface (and agreement) provided by the carrier, as used by commercial solution TrustID [8]. Challenges and contributions. We propose to de- sign end-to-end solutions to detect caller ID spoofing. Designing such a practical mechanism is challeng- ing: First, only limited information and resources are available at end users. The route of call signalling is Figure 1: An example telephone network architecture, unknown. Second, a large deviation from the regu- where different carriers are connected using peering archi- lar calling procedure is unlikely to be accepted by tecture. Here, each telephone network follows there own most people. Thus, naive solutions such as rejecting protocol for internal communication, but uses SS7 or VoIP an incoming call and then calling back, are not an for inter-network communication. option. The detection mechanisms should be mostly networks, and Voice over Internet Protocol (VoIP) automated and require little user input. Third, a few providers. In all these telephone networks, creating legitimate services provided by telephone compa- a phone call typically involves two types of channels: nies allow the caller IDs to be different from the an end-to-end control channel for signalling, and an calling numbers, making those caller IDs appear to end-to-end voice channel for transmitting voice data. be spoofed. However, those scenarios should not be In addition, all telephone carriers support caller ID classified as caller ID spoofing attacks. We address all which works as follows. When a caller dials a num- these requirements and design two end-to-end caller ber, the carrier first authenticates the caller, and then CallerDec ID verification schemes that we call : generates or looks up the associated caller ID. Finally, (1) SMS-based CallerDec uses SMS services, and (2) the caller ID is forwarded to the callee, possibly from Timing-based CallerDec utilizes a covert timing chan- one carrier to another. nel that is constructed between the caller and the In the following, we discuss the popular caller callee leveraging the traditional phone call services. ID standards used within each type of carrier and We summarize our contributions as follows: between different carriers with the goal of under- CallerDec i. We propose , end-to-end caller ID standing the feasibility of injecting spoofed caller IDs. verification schemes that require no modification to the existing telephone infrastructure. CallerDec can 2.1 Traditional Telephone Network detect spoofing even if a caller ID is not in the contact 2.1.1 Architecture list or is unreachable. Both the PSTN and cellular telephone networks gener- ii. We present two use cases of CallerDec, one for ally follow a hierarchical architecture [9], as illustrated an emergency call scenario (e.g., 9-1-1 call) and the in Figure 1. The upper level entities control the lower other for a regular call scenario. In both cases, the end level ones in both networks. users, (e.g., a 9-1-1 service or an individual customer) In PSTN when a customer subscribes for the tele- can utilize CallerDec to verify caller IDs. phone service, a switch port in the local exchange iii. We implement CallerDec as an App for Android- (LE) is assigned with the corresponding caller ID, based smartphones where we tackle several technical i.e., the customer’s phone number, possibly with a challenges caused by the limited API support for name. When a customer dials a number, the LE sends controlling calls. We examine the CallerDec per- the pre-configured caller ID in the outgoing call. On formance in various scenarios, and show that it can the other hand, in Cellular networks, each customer detect spoofed caller ID effectively and efficiently (i.e. gets a Subscriber Identity Module (SIM) and inserts incurring almost no extra energy overhead). We stress it in a mobile station (MS). An MS is authenticated that, while we implemented CallerDec on Android based on the SIM information. When an MS makes a smartphones as a case study, our solution can also be phone call, the call setup process always goes through integrated in any other telephone devices. BTS, BSC, and MSC. Then, the MSC obtains the caller The above contributions apply to both SMS-based ID associated with the MS from the Home Location and timing-based CallerDec. Both mechanisms use Register (HLR) and encodes it in a control packet for end-to-end principle but different communication call setup. channel and protocol for verification. 2.1.2 Protocols 2BACKGROUND There are several caller ID standards in PSTN, e.g., Three categories of telephone carriers are in service: Bellcore FSK, SIN227, DTMF, V23, ETSI FSK, etc. We Public Switched Telephone Network (PSTN), cellular introduce one popular standard, BellCore FSK [10], 3 30B of 55H 130+/-25ms 1B 1B 15-18B 4B (a) Channel Seizure Signal Carrier Signal Msg.