Spoofing any call - interactively

In this blog post, we’re going to setup our own callcenter to spoof any phone number on the fly!

What we’re doing today, is nothing new - but it is documented horribly. The blogs from Rapid7 regarding this topic, helped me tremendously - you may find them in the references below. Most of the code is based on those blogs. I merely adjusted and tested them for the Dutch providers.

Sometimes I have the idea this lack of information, is a symptom of security through obsecurity. Instead of improving security, we just try to hide the fact how broken it has been and currently still is. I’ve always hated the counterproductive sense of false security it creates. This is also why I don’t mind creating a blog post like this. It is better to be aware of the ease of which you can do this, and try to do something about it.

But let’s leave that debate for another time, how does this work and how do you set it up?

How does it work

The current process of spoofing a number interactively goes like this;

1. Call your VOIP number, e.g. 08512345678
2. Provide the PIN you configured, wait for the beep
3. Press 1 to go into the menu, wait for the welcome tune
4. Enter the number you want to spoof, e.g. 31612345678 - wait for the call tune
5. Enter the number you want to call, e.g. 31611223344 - wait for the call tune
6. You’re calling… enjoy.

The overview of this setup is as follows;

• For the VOIP services, I use CM.
  • Great service, easy to use. Documenation and configuration does lack, but I provide it in this blog post.
  • Costs are low, you buy a phone number for around 15EUR - and calling costs are cents per minute.
• For the callcenter itself, I use a VPS (10USD per month) on DigitalOcean, running FreePBX.

How do you defend against this?

Short answer, you can’t. Awareness does help in recognizing potential fraudulent callers.

The protocols that are being used, are inherently insecure - and have been for a long time. There are ways to e.g. block the spoofing of phone numbers - but only the providers themselves can do this. Some actually do, but most don’t and won’t. There are actual legitimate usecases for this, think of the telephones in the office that all call from the same number - that uses the same technique. And even if a provider blocks it, there are always providers that allow it. During testing, I also used USA providers that worked - you can route your calls all around the world if you want.

Same goes for SMS, but I’ll go over that in another blog post. I personally have a Telegram bot that can send SMS messages on the fly - spoofing not only the phone number, but also the id. For context, the id can be e.g. “ING”.

How do you set it up

VPS;

Inbound route;

Outbound route;

DISA;

extensions_custom.conf:

[from-internal-custom]
include => proof-of-concept-custom

[proof-of-concept-custom]
exten => 1,1,Answer
exten => 1,n,Wait(2)
exten => 1,n,Playback(welcome)
exten => 1,n(collect),Read(digito,,14)
exten => 1,n,Set(CALLERID(number)=${digito})
exten => 1,n,Set(CDR(outbound_cnum)=${digito})
exten => 1,n,Answer
exten => 1,n,Wait(2)
exten => 1,n,Playback(call)
exten => 1,n(collect),Read(digito1,,14)
exten => 1,n,Set(OUTBOUND_GROUP=OUT_3)
exten => 1,n,Playback(call)
exten => 1,n,Dial(SIP/REPLACE_ME/${digito1},300)

Incoming trunk config:

host=31.169.58.10&31.169.58.11&188.94.185.98&188.94.185.99&188.94.185.110
disallow=all
type=peer
allow=alaw&ulaw
canreinvite=yes
context=from-trunk
dtmfmode=rfc2833
insecure=invite,port
nat=no
pedantic=no
port=5060
qualify=yes
fromuser=REPLACE_ME
trustrpid=yes
sendrpid=pai

Outgoing trunk config:

username=REPLACE_ME
secret=REPLACE_ME
host=31.169.63.1&31.169.63.2
disallow=all
type=peer
allow=alaw&ulaw
canreinvite=yes
context=from-trunk
dtmfmode=rfc2833
insecure=invite,port
nat=yes
pedantic=no
port=5060
qualify=yes
trustrpid=yes
sendrpid=pai

References

• https://www.rapid7.com/blog/post/2018/05/24/how-to-build-your-own-caller-id-spoofer-part-1/
• https://www.rapid7.com/blog/post/2018/07/12/how-to-build-your-own-caller-id-spoofer-part-2/
• https://blog.vpetkov.net/2011/07/10/spoofing-caller-id-on-the-fly-from-any-phone-for-legal-and-legitimate-purposes/