This is clearly the fault of the carrier. The problem is occuring at the IP/PSTN interface and it appears the VOIP carriers are letting caller ID be set by the PBX (in this case Asterisk VOIP.) No one could reasonably do this in their home because they'd be using a regular 1FB line that can't set it's own caller ID. You'd need some form of a DS1 to do this. When you start getting into that realm, it doesn't matter what kind of PBX you use - I have a piece of shit system, not much more than a key system, that will do it.

Of course, any real call center uses ANI rather than caller ID and that's controlled by the regulated telcos. I'd love someone to show how a VOIP system could spoof ANI.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/9061/27371#27371