SHAKEN Protocol Will Stop Scammers from Exploiting a Caller ID Loophole
Total Page:16
File Type:pdf, Size:1020Kb
How to Shut Down Robocallers The STIR/ SHAKEN protocol will stop scammers from exploiting By JIM a caller ID McEACHERN & ERIC loophole BURGER ave you ever received a phone call from your own number? If so, you’ve expe- rienced one of the favorite techniques of phone scammers. • Scammers can “spoof” numbers, making it seem as though the phone call in question is com- ing from a local number—which can include your own—thereby obscuring the call’s true origin. If you answer the call, you’ll most likely be treated to the sound of a robotic voice trying to trick you into parting with some money. • One of us (McEachern) is a principal technologist for the standards organization Alliance for Telecommunications Industry Solutions (ATIS), and the other (Burger) was until recently the chief technology officer for the U.S. Federal Communications Commission. But you don’t need us to tell you that robocalls are a pandemic. According to a report by the caller ID company Hiya, there were 85 billion robo- calls globally in 2018. → H46 | DEC 2019 | SPECTRUM.IEEE.ORG PHOTOGRAPH BY Dan Saelinger GUTTER CREDIT GOES HERE GOES CREDIT GUTTER PHOTOGRAPH BY Firstname Lastname SPECTRUM.IEEE.ORG | DEC 2019 | 47 Call for Directions CENTURY AT&T LINK LONG DISTANCE CALLING A FRIEND isn’t as simple as transmitting data from point A to point AT&T VERIZON B. Along the way, the call is routed through telephone infrastructure that may be operated by two, three, or more phone companies, or carriers. These routes are part of the reason it’s so time NODE consuming to identify the points where scammers CALLER’S VERIZON INTELIQUENT RECEIVER’S place their calls. PHONE LONG DISTANCE PHONE RoboKiller, one company that has cre- Today, when you make a call, your If it all works out, robocalls could ated an anti-spam-call app, estimates phone company, or carrier, knows become as manageable as email spam. that Americans received 5.3 billion robo- whether or not you’re spoofing your num- You’ll be less likely to be tricked into calls in April 2019 alone, or nearly 4,000 ber to make it appear that the call is com- answering a scam call, and you’ll receive every second. And not only are scam calls ing from a different number. But what the far fewer in the first place. annoying, they’re costly. In 2018, phone company doesn’t know is if you’re allowed scams tricked Americans out of an esti- to spoof that number, nor does it have a Spoofing numberS iSn’t new—it’s mated US $429 million. Sadly, these num- way to securely send that information to been possible for half a century. Tele- bers are on an upward trend. the carrier delivering the call to the person phone switching equipment known as Spoofing phone numbers is just one you’re calling (there are legitimate reasons private branch exchanges (PBXs), which way phone scammers trick their victims. why callers might spoof their numbers; many businesses use, preassign the num- Scammers are also very good at reading more on that in a moment). ber that will be displayed on the recipi- people, gaining their confidence, and The upshot is that when you see the ent’s phone when it receives a call from playing to their fears. But spoofing num- number of an incoming call, you have the business. There are legitimate rea- bers is an often-effective opening gam- no way of knowing if the number dis- sons for businesses to spoof numbers. bit. The first thing a spoofer has to do is played on your caller ID is legitimate or For example, they may want to display get someone to pick up the phone in the spoofed. STIR/SHAKEN will give phone a toll-free number for calls from the mar- first place, and people are more likely companies a secure method of commu- keting, sales, or service departments. to answer a call if they think it’s from a nicating a caller’s number to a recipient Women’s shelters are another example local number. So, preventing the abuse of when a call is placed. This capability is of the need to disguise numbers, as they call spoofing, along with making it much vital to establishing the caller’s reputation often replace the shelter’s actual number harder for anyone to place huge numbers so that scammers and other bad actors with a national number to avoid tipping of robocalls, are two of the most impor- can be reliably identified and blocked off a domestic abuser. tant challenges to reining in robocallers before you waste any time on the bogus The problem is not spoofing itself. The and scammers. call. And should an illegitimate robo- problem is that in the last decade or so, The telecommunications industry has call still get through, STIR/SHAKEN sim- three things have changed to create the been developing a network-based system plifies the process of tracing a call back mess we see today. that would meet both of these challenges. to its source. Hopefully, simpler trac- First, phone calls are a lot cheaper. In It goes by an unwieldy name: “Secure Tele- ing will make it feasible for law enforce- many countries nowadays, unlimited phone Identity Revisited/Signature-based ment agencies to prosecute scammers nationwide calling is standard in basic Handling of Asserted information using for illegal robocalling. The technology phone plans. Second, the Internet has toKENs.” Let’s just call it STIR/SHAKEN, will also securely provide information to reduced the costs of running a scam to which is a lot easier to remember. STIR/ call-blocking apps, allowing the apps to almost nothing. The PBX of choice for SHAKEN is a technique for providing more more accurately identify spam calls and fraudsters is an Internet-enabled I P-PBX reliable call-display information by clos- inform you with a notice such as “Spam to further lower the price per call. With ing a loophole that scammers exploit in likely” or “Unverified number” before the Internet, scammers don’t even telephony infrastructure. you answer a call. have to be in the same country to place 48 | DEC 2019 | SPECTRUM.IEEE.ORG ILLUSTRATION BY Mark Montgomery robocalls, and they can use live agents the phone companies on each end of tocol’s flexibility made it easy for each in countries with low-cost labor. Third, a phone call. phone company to implement it in its anyone can place hundreds of calls per The Internet Engineering Task Force network. However, as a general rule, the minute with the small investment of an (IETF), which works on issues related to more flexible a protocol is, the more inexpensive PC, a hundred-dollar Voice secure telephone identity, began work likely it is that different implementations over Internet Protocol (VoIP) expansion on STIR in 2013. The IETF designed the won’t play well together. So when two card, free open-source software, and a STIR protocol to be very flexible. The different service providers implement few days of assembly. basic mechanism is a certificate issued the protocol on each of their networks, Put it all together and you have the rec- to authenticated callers. However, STIR a caller ID sent from one to the other ipe for a potentially lucrative business requires individuals to be proactive about might not make it through intact. The with very low risk. These scammers are authenticating themselves and managing task force’s goal was to create a precisely fundamentally playing a numbers game: their personal key, which confirms their defined subset (known as a profile) of While most people won’t answer their identity. STIR’s downside is that very few STIR, called SHAKEN. Because the task calls, a small percentage will, and some of people have the expertise to do either. The force specified the SHAKEN profile of the those people can be conned into sending good news is that STIR’s flexibility allows STIR protocol, you might see it referred money or revealing their bank account phone companies to implement it in their to as “STIR/SHAKEN.” information. Robocall scams are so cheap network with minimal hassle. SHAKEN starts with the information that even one success among hundreds In 2015, ATIS also began studying that the originating phone company— or thousands of calls can still make scam- mechanisms to reduce unwanted robo- the carrier—knows about the call. For mers money. The Internet can cheaply calls. A joint task force between ATIS example, mobile phones and residen- connect a U.S.-based IP-PBX making hun- and the SIP Forum, an industry associa- tial landlines transmit their phone num- dreds of calls per minute with call agents tion, built upon the IETF’s work on STIR. bers whenever they originate a call. For in another country to talk to any victims As it turned out, STIR’s extreme flex- businesses, where legitimate spoofing is who fall for the spoofed call. Meanwhile, ibility was a problem. Indeed, the pro- commonplace, the carrier also assigns the carrier has no way of know- to the call a unique key, called ing that this is an illegal robocall an “orig-id,” or origination identi- operation until unsuspecting vic- fier, in order to identify the busi- tims complain. Only after receiv- ness placing the call. In all cases, ing complaints is the carrier aware the carrier creates a digital sig- that it should trace back the calls nature using the available infor- and identify the illegal caller. mation and transmits it with the Before STIR/SHAKEN, individual call.