Leveraging Asterisk and a SIP Trunk to Unmask Private Calls

FierceVoIP has some coverage this morning of Kevin Mitnick’s presentation at the recent Last HOPE (Hackers on Planet Earth) conference where he utilized Asterisk and a SIP Trunk to “unmask” the CallerID of a private caller. If you don’t know who Kevin Mitnick is you can read more about him here. A video from YouTube detailing the exploit can be seen here.

Garrett Smith

Garrett is the former VoIP Supply CMO.

View Comments

  • Hey Cory, as the presentation shows, the calling number is provided by many SIP trunking and ISDN-PRI service providers, along with privacy flags to determine whether to display the number. Configuring Asterisk to disrespect the privacy flags and expose the calling number that's "hidden" in the call setup is an abuse of trust that service providers have in their customers, not a particularly clever hack.

    There are two quick security-related conclusions to draw from this demonstration: long term, service providers should adopt a security model that does not rely on the good behavior of their customers; short term, service providers that get burned by such abuses might respond by treating PBX endpoints as untrusted, which will limit their utility.

    Still, this is a good example of the unique power that Asterisk brings to telephony solutions -- and a big reason so many new products have Asterisk under the hood.

    BTW, thanks for the tour on Canada Day. I enjoyed visiting with you and Garrett.

    All the best,
    Rod Montgomery
    Director of Services, Digium, Inc.

  • True, many providers forward this information including my own. I came across this during unsuccessful privacy manager setups...Mitnick is not saying anything new, go back to "the well".

  • Anyone who sends me a call or a message has to identify themself. What needs to change is that Caller ID must be *required* and *accurate* from every caller. Fake or masked Caller ID is where the trust abuse is happening in that transaction you described.

    You invade my privacy with a call, you better at least identify yourself, whether or not you're welcome to connect to me. If you show up with a mask, don't expect me to respect your request that I not look under it.

  • @Matt:

    We weren't saying Mitnick was the first to discover, just the first to bring this "to the masses."

  • You guys are really behind the times. First let me admit that several years ago I discovered * while trying to find a way to spoof my callerid...my girlfriend at the time was a married woman...so you can guess the rest. Spoofing my callerid was kind of fun but it only worked when I used my IP phone through my VOIP provider. I would sometimes call her on my POTs line using *67. What I didn't know was even when using *67 before dialing her cell phone number, my real telephone # appeared on her cell phone display. Not my name, just my number. This didn't happen when I called her home phone. So apparently her cell phone company was doing this long before Mr. Mitnick's ploy.

  • @Bill:

    As I stated before, we didn't say Mitnick invented the wheel here, merely that he brought it to a public stage...there is a big difference between telephony guys knowing this stuff and say your average VoIP user...we felt it was newsworthy because it was one of, if not the, first public exposure for this sort of activity.

  • This is nothing new, CID privacy has never been something you can rely on. Between various cell phone providers never honoring the privacy flag, the fact that many VoIP providers also pass the info along during a SIP exchange, and the fact that my T1 trunks also get the info...I cant remember the last time someone called me, and I didn't "know" who the caller was well before answering the phone.

  • Hi Guys- I got a 'blocked' call into my iphone (att) that i really really need to get back to - but need to find the number behind ?
    how/where i can do this still?
    it still showing in my cell in the recent calls and the voicemail section of my phone
    please-thanks

Share
Published by
Garrett Smith

Recent Posts

Viking VoIP Emergency Phone E-1600-IP-EWP: Product Feature and How to Register with Sangoma PBXact

https://youtu.be/FE2kcF7KjgQ?si=inw4thEr2thxgGeL When it comes to security, you should never cut corners. Having something that you…

2 days ago

Watch Now: 2025 March VoIP News Update

https://www.youtube.com/watch?v=X2_HXAv73FI Your March VoIP News Update is out now! This month we showcase an awesome…

6 days ago

Did You Know:  New MS Teams-Certified Services, Products & Devices!

It is certainly no secret that leading platforms such as Microsoft Teams have grown in…

7 days ago

Snom M56 DECT Phone & M500 Base Station: Product Feature and How to Pair Devices

https://youtu.be/7_EIZKXqG3w?si=nvWqq8EAe58AJ6Dp Over the years, we have seen several advancements in DECT technology, and with that,…

2 weeks ago

How To: Prepare Your Business for Upcoming Tariffs in the VoIP Industry

With all of this talk about tariffs, we wanted to provide you with some information…

2 weeks ago

Fanvil i62 Outdoor Audio & Video Door Phone: How to SIP Register and Program RFID Card

https://youtu.be/y3X1PcrK6i8?si=qWPgzDNhhngcsk_a In today's world, security is one of the most important things to have for…

1 month ago