[asterisk-biz] ANI

[Miles Scruggs]

I have an email into steve to setup a test case which he can watch to  
see if it is possible to spoof, but haven't heard back from him yet.   
I don't have access to a TF PRI to test it myself.  I'm fairly certain  
that ANI is completely able to be spoofed.

On May 9, 2008, at 9:07 AM, Mike Hammett wrote:
> Well, it wasn't really of spoofing, perse, but if the CNID received  
> on a
> toll free is the ANI, since toll free gets passed ANI, but from what  
> I can
> see it is not.
>
>
> ----------
> Mike Hammett
> Intelligent Computing Solutions
> http://www.ics-il.com
>
>
> ----- Original Message -----
> From: "Miles Scruggs" <asterisk at wideideas.com>
> To: "Commercial and Business-Oriented Asterisk Discussion"
> <asterisk-biz at lists.digium.com>
> Sent: Friday, May 09, 2008 10:41 AM
> Subject: Re: [asterisk-biz] ANI
>
>
>> I don't see how that wouldn't apply since there still exists a  
>> calling
>> party and receiving party, and carrier.  Since the question was of
>> spoofing it wouldn't make much sense to think of spoofing happening  
>> on
>> the receiving end.
>>
>> You simply have no assurance that the ANI/CID you are receiving is in
>> fact valid. It is suppose to be but that is as far as you can go.
>>
>> On May 9, 2008, at 8:30 AM, Steve Totaro wrote:
>>> Oh, I was speaking of inbound only LD (toll free) PRIs.  Maybe I am
>>> way off topic for this thread.
>>>
>>> Thanks,
>>> Steve Totaro
>>>
>>> On Fri, May 9, 2008 at 11:18 AM, Miles Scruggs
>>> <asterisk at wideideas.com> wrote:
>>>> This belief is limited to your experience with PRIs.  When you  
>>>> obtain
>>>> SIP termination services from ATT, Verizon, or Level 3.  They  
>>>> have no
>>>> way of verifying what ANI/CID you are sending.  It doesn't matter  
>>>> if
>>>> you are calling 800s or not, they bill it back to the CID that you
>>>> pass (not to say that your carrier won't bill you as well since  
>>>> they
>>>> see the calls go through their switches, but they more than likely
>>>> won't see the reciprocal billing from the receiving LEC).  Want a
>>>> proof of concept?  Setup an account with a small terminating  
>>>> provider
>>>> like Junction networks, send all your calls out with the ANI of  
>>>> your
>>>> cell phone. Last step will be to recoil in horror next time you  
>>>> open
>>>> your cell phone bill. I'm not saying they can't track you down, or
>>>> trace abuse back to you, since everything is logged, but very  
>>>> little
>>>> verification happens.
>>>>
>>>> If you are sending thousands of calls per day to a trunk that is
>>>> outbound only, from thousands of different parties, you don't  
>>>> have to
>>>> delve into to much logic to see the obvious result.
>>>>
>>>> Cheer
>>>>
>>>> Miles
>>>>
>>>> On May 9, 2008, at 7:33 AM, Steve Totaro wrote:
>>>>> I may be wrong here but I do not believe that ANI can be spoofed.
>>>>>
>>>>> http://en.wikipedia.org/wiki/Automatic_number_identification
>>>>>
>>>>> Thanks,
>>>>> Steve Totaro
>>>>>
>>>>> On Fri, May 9, 2008 at 10:03 AM,  <nigel.dennis at sympatico.ca>  
>>>>> wrote:
>>>>>> Mike... The reason why collection services, skip tracers and
>>>>>> private
>>>>>> investigators ask to call back on their 800 toll free is simply
>>>>>> because you
>>>>>> can not spood your ANI to a 800 #.
>>>>>>
>>>>>> ________________________________
>>>>>> From: "Mike Hammett" <asterisk-biz at ics-il.net>
>>>>>> Reply-To: Commercial and Business-Oriented Asterisk
>>>>>> Discussion<asterisk-biz at lists.digium.com>
>>>>>> To: <asterisk-biz at lists.digium.com>
>>>>>> Subject: [asterisk-biz] ANI
>>>>>> Date: Fri, 9 May 2008 08:29:48 -0500
>>>>>>
>>>>>> Is the CID of a call to a toll free number really the ANI,
>>>>>> therefore not
>>>>>> spoofed or blocked?
>>>>>>
>>>>>> Someone who's opinion I respect said it generally is, but he  
>>>>>> wasn't
>>>>>> sure.
>>>>>> Since I have a potential customer coming to me with an ANI
>>>>>> requirement, not
>>>>>> a CID requirement, I figured I should make sure.
>>>>>>
>>>>>>
>>>>>> ----------
>>>>>> Mike Hammett
>>>>>> Intelligent Computing Solutions
>>>>>> http://www.ics-il.com
>>>>>>
>>>>>>
>>>>>>
>>>>>>> _______________________________________________
>>>>>>> --Bandwidth and Colocation Provided by http://www.api-
>>>>>>> digital.com--
>>>>>>>
>>>>>>> asterisk-biz mailing list
>>>>>>> To UNSUBSCRIBE or update options visit:
>>>>>>> http://lists.digium.com/mailman/listinfo/asterisk-biz
>>>>>>
>>>>>> _______________________________________________
>>>>>> --Bandwidth and Colocation Provided by http://www.api- 
>>>>>> digital.com--
>>>>>>
>>>>>> asterisk-biz mailing list
>>>>>> To UNSUBSCRIBE or update options visit:
>>>>>> http://lists.digium.com/mailman/listinfo/asterisk-biz
>>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> --Bandwidth and Colocation Provided by http://www.api- 
>>>>> digital.com--
>>>>>
>>>>> asterisk-biz mailing list
>>>>> To UNSUBSCRIBE or update options visit:
>>>>> http://lists.digium.com/mailman/listinfo/asterisk-biz
>>>>
>>>>
>>>> _______________________________________________
>>>> --Bandwidth and Colocation Provided by http://www.api-digital.com--
>>>>
>>>> asterisk-biz mailing list
>>>> To UNSUBSCRIBE or update options visit:
>>>> http://lists.digium.com/mailman/listinfo/asterisk-biz
>>>>
>>>
>>> _______________________________________________
>>> --Bandwidth and Colocation Provided by http://www.api-digital.com--
>>>
>>> asterisk-biz mailing list
>>> To UNSUBSCRIBE or update options visit:
>>>  http://lists.digium.com/mailman/listinfo/asterisk-biz
>>
>>
>> _______________________________________________
>> --Bandwidth and Colocation Provided by http://www.api-digital.com--
>>
>> asterisk-biz mailing list
>> To UNSUBSCRIBE or update options visit:
>>  http://lists.digium.com/mailman/listinfo/asterisk-biz
>>
>
>
> _______________________________________________
> --Bandwidth and Colocation Provided by http://www.api-digital.com--
>
> asterisk-biz mailing list
> To UNSUBSCRIBE or update options visit:
>   http://lists.digium.com/mailman/listinfo/asterisk-biz