Caller-ID Spoofing

• Tools:

• • Most soft-phones
  • Asterisk IPBX
  • VoIP to PSTN service providers that honor user-supplied Caller-ID information
  • • http://www.iax.cc/ - IAX VoIP provider
    • http://www.spoofcard.com/ - Calling-card based
    • http://www.telespoof.com/ - For “business” use
    • http://www.fakecaller.com/ - Text to Voice “prank” messages!

• Mitigation:

• • Don’t honor user-supplied Caller-ID information
  • Don’t trust Caller-ID information for user authentication