Main | February 2005 »


January 31, 2005

CID/ANI spoofing on VoIP using Asterisk

ANI Spoofing

Contributed by: opticfiber

An article written for rootsecure.net this past July describes a method for spoofing any CID/ANI number from your voip service, provided there lax in security. According to Rootsecure,"Automated ANI / Caller ID spoofing is setting the number you are calling from without the use of an operator / company PBX system. By far the easiest method thanks to the increasing take-up of internet telephony services are VoIP (Voice over Internet Protocol) service providers who allow you when using their service to set whatever caller ID you like (which is also used as ANI)."

 

For complete instructions on how to setup CID/ANI spoofing on your voip servoce see the Rootsecure.net instructions

From RootSecure.net:


What is Caller ID?
Caller ID is a service provided by most telephone companies (for a monthly cost) which will tell you the number / name of an incoming call. [Definition: Hack FAQ ]

What is ANI?
Automatic Number Identification is a system used by the telephone company to determine the number of the calling party. There are believed to be two types, “FLEX ANI” (used for e.g. verification services such as voicemail) which is relatively easy to spoof, and “Real Time ANI” (used only for billing purposes on e.g. 800 numbers) which is harder to spoof. [Definition: Hack FAQ ]

What is ANI / Caller ID spoofing?
ANI / Caller ID spoofing is setting the ANI / Caller ID on the outgoing call you are making to a 10 digit number of your own choosing. Traditionally it has been a complicated process either requiring the assistance of a cooperative phone company operator or an expensive company PBX system.

What is Automated ANI / Caller ID spoofing?
Automated ANI / Caller ID spoofing is setting the number you are calling from without the use of an operator / company PBX system. By far the easiest method thanks to the increasing take-up of internet telephony services are VoIP (Voice over Internet Protocol) service providers who allow you when using their service to set whatever caller ID you like (which is also used as ANI).

Which VoIP service providers support spoofing?
VoicePulse and Nufone both allow spoofing (verified February 16th 2004, 7th July 2004). IAXtel is understood not to support spoofing.

Is international calling / spoofing possible?
Both Nufone, and VoicePulse Connect support international calling, (dial 011+country code+number) however you may need to modify your extension file to recognise the international format e.g. exten => _011N.,1,Dial,IAX2/username@voipprovider/$ Spoofing using VoicePulse to a UK Ericsson T610 mobile phone / landline with caller ID has been verified working, it displays the calling number (if the number is in the address book it will display the name / photo listed for it instead). The leading zero should be left off when spoofing, eg 20-1111-1111.
[Update: As of 5th June 2004 this no longer appears to work, caller id shows up as "unavailable"]

How can I spoof ANI / Caller ID
Requirements: A spare computer with a Linux compatible network card, basic Linux knowledge, Redhat 9.0 CDs, a broadband Internet connection, a VoIP hardware phone / compatible software phone, an account with a VoIP provider.

Overview of the process:
1. Follow the instructions in Andy Powell’s, “Getting Started With Asterisk” guide for the initial Linux install.
2. Add the following lines to your extension config file in the same context as your SIP phone.
exten => 33,1,Answer
exten => 33,2,AGI(cidspoof.agi)
4. Sign up with a VoIP provider.
5. Add appropriate details into your IAX config file (as issued by your VoIP service provider).
6. Download the cidspoof.agi script changing line 77 to the correct username / hostname for your VoIP IAX service provider, and copy it to /var/lib/asterisk/agi-bin/.
7. Start Asterisk
8. Check your SIP phone has correctly registered / verify you are able to make a SIP to PSTN call.
9. Call extension 33, enter the 10 digit number you wish to spoof from, followed by the 10 digit number you wish to spoof to.

A simpler alternative is to use the command SetCallerID(2121111111) in the "extensions.conf" file direct however it will have to be manually edited and Asterisk reloaded for every call.

Is it possible to get a dial in number to enable remote spoofing?
DID (direct inward dial - USA) / DDI (direct dial inward - UK) numbers are available from both Voicepulse and Nufone with no minimum contract period.

Nufone only offer numbers in the state of Michigan for $7.50 per month. Voicepulse offer a wide variety of area codes / exchanges for $7.99 per month.

What are the other advantages of a DDI / DID number?
1. It can act as an extra phone line.
2. It can run a conference / call centre service, since the line is never busy unless your Asterisk PBX server box says it is.

Is it legal?
It appears to be perfectly legal, as long as it is not used for fraudulent purposes.

January 18, 2005

Asterisk Today

From caller ID to long distance, anything your phone can do, Asterisk can do better and cheaper. Asterisk, an open source telephony project sponsored by Digium , greatly reduces the cost of traditional telecommunication technology and operation, and moves Voice over Internet Protocol (VoIP) into the mainstream.

With VoIP, telephone calls are transmitted over an Internet connection, eliminating long distance charges and the need for a traditional proprietary telephone service plan. If you own a telephone, heed the call to Asterisk.
 

 

Because Asterisk is based on VoIP, Asterisk provides an inexpensive telecommunication solution perfect for a small business, a home office, or even an entire household. And because Asterisk has the ability to communicate seamlessly between VoIP and the public switched telephone network using any of the most popular codecs and protocols, it allows for high voice quality at no toll costs. Also, Asterisk's freely and widely available open source code can replace a traditional hardware PBX. Finally, unlike most VoIP telephone systems, Asterisk integrates with a wide range of hardware and standards-based telephony equipment.

"Asterisk was designed to be able to do everything a traditional telephone system can do, and much more," said Mark Spencer, creator of Asterisk and founder of Digium.

The Linux configuration of Asterisk offers a myriad of calling features, including caller ID, call waiting, and voicemail. Moreover, it has all of the advanced capabilities of a professional-grade telephone system, such as conference call bridging, auto-attendant, interactive voice response (IVR), overhead paging, directory listing, and many more.

Along with the Asterisk code, the only equipment needed to set up a small PBX is a PC with a Linux operating system, an analog or digital telephone, an inexpensive Digium TDM400P card with Foreign Exchange Station (FXS) or Foreign Exchange Office (FXO) modules, and an Internet connection. [Foreign Exchange allows the user to have a number that doesn't originate from a local office. FXS supplies a ringing voltage to telephone lines, and FXO sends and receives phone calls through a central office switch.]

The Digium TDM400P card, starting at $125, can be used to connect to a conventional phone or phone line. Each card can terminate up to four telephones or telephone lines, or can service even more when used in conjunction with an IP telephone. A PC can hold several TDM400P cards, one in each PCI slot.

This Is Not Your Father's PBX

While Asterisk started out as a Open Source Software implementation of a standard PBX, it has grown into much more.

For example, when you dial into Digium's main telephone number (877-LINUX-ME), you'll hear the default Asterisk IVR (in a surprisingly sultry voice) say...

Thank you for calling Digium -- your Open Source telecommunications supplier. If you know your party's extension, you may dial it at any time. Otherwise, press one for sales, two for technical support, three for customer service, four for accounting, nine for a company directory, or zero for an operator.

Dial an extension number to be transferred directly to the person you need to speak with. Or, press nine and enter the first three digits of your contact's last name to be connected to that person, even if he or she is in a different city or country! The IVR can say whatever you'd like it to say, and can also access a database. All of these features are set up with a simple Asterisk configuration file.

The entire Asterisk application is licensed under the GPL with special exceptions for OpenH323 and G.729 code. New features are implemented weekly (if not daily) as needed, and bugs are eliminated by a team of "Bug Marshals" as they appear on Digium's Bug Tracker web site (http://bugs.digium.com).

For individual users, Asterisk open source telephony lowers cost, frees customers from proprietary solutions, and eliminates upgrade costs. For service providers, Asterisk fulfills the needs of all kinds of businesses, and can be customized as much as needed.

January 14, 2005

Asterisk 1.0

At the first annual Astricon Conference, Asterisk version 1.0 was announced by Mark Spencer and released to the world. For information on how to download Asterisk, click here. This release marks the outstanding achievements of the developers, the hundreds of friends and tireless supporters from IRC on irc.freenode.net in #asterisk, and the thousands of Asterisk users worldwide. Also made available today are the 1.0 releases of Zaptel, the software drivers for Digium hardware, and libPRI, the GPL-licensed PRI stack supporting North American and EuroISDN PRI protocols. Digium wishes to thank everyone that has contributed their time, energy, money, and passion to this software. We look forward to the continued efforts of this wonderful community, as it extends Asterisk to the undefined limits of imagination.

Source: Digium.com

January 13, 2005

What is the Asterisk Platform?

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can inter operate with almost all standards-based telephony equipment using relatively inexpensive hardware.

Asterisk provides Voicemail services with Directory, Call Conferencing, Interactive Voice Response, Call Queuing. It has support for three-way calling, caller ID services, ADSI, SIP and H.323 (as both client and gateway). Check the Features section for a more complete list.

 

Asterisk needs no additional hardware for Voice over IP. For interconnection with digital and analog telephony equipment, Asterisk supports a number of hardware devices, most notably all of the hardware manufactured by Asterisk's sponsors, Digium(TM). Digium has single and quad span T1 and E1 interfaces for interconnection to PRI lines and channel banks as well as a single port FXO card and a one to four-port modular FXS and FXO card.

Also supported are the Internet Line Jack and Internet Phone Jack products from Quicknet.

 
Asterisk supports a wide range of TDM protocols for the handling and transmission of voice over traditional telephony interfaces. Asterisk supports US and European standard signaling types used in standard business phone systems, allowing it to bridge between next generation voice-data integrated networks and existing infrastructure. Asterisk not only supports traditional phone equipment, it enhances them with additional capabilities.

Using the Inter-Asterisk eXchange (IAX(TM)) Voice over IP protocol, Asterisk merges voice and data traffic seamlessly across disparate networks. While using Packet Voice, it is possible to send data such as URL information and images in-line with voice traffic, allowing advanced integration of information.

Asterisk provides a central switching core, with four APIs for modular loading of telephony applications, hardware interfaces, file format handling, and codecs. It allows for transparent switching between all supported interfaces, allowing it to tie together a diverse mixture of telephony systems into a single switching network.

Asterisk is primarily developed on GNU/Linux for x/86. It is known to compile and run on GNU/Linux for PPC along with OpenBSD, FreeBSD, and Mac OS X Jaguar. Other platforms and standards-based UNIX-like operating systems should be reasonably easy to port for anyone with the time and requisite skill to do so. Asterisk is available in the testing and unstable Debian archives, maintained thanks to Mark Purcell.

Who Made This?
Asterisk was originally written by Mark Spencer of Digium, Inc. Code has been contributed from open source coders around the world, and testing and bug-patches from the community have provided invaluable aid to the development of this software.

Where is Asterisk going?
Asterisk is growing fast with new features added frequently to the CVS tree. Mark Spencer and numerous contributors from around the world contribute new code and patches on a daily basis. To stay up-to-date on the growing feature list of Asterisk, please visit Digium's web site for more information on subscribing to the Asterisk mailing

Short for private branch exchange, a private telephone network used within an enterprise. Users of the PBX share a certain number of outside lines for making telephone calls external to the PBX. .

Most medium-sized and larger companies use a PBX because it's much less expensive than connecting an external telephone line to every telephone in the organization. In addition, it's easier to call someone within a PBX because the number you need to dial is typically just 3 or 4 digits.

 

January 12, 2005

What is VoIP?

Voice Over IP also called Internet telephony, Voice-over-IP (VoIP) uses the Internet Protocol (IP) to transmit voice communications over Local Area Networks (LANs), Wide Area Networks (WANs), and the Internet. VoIP provides an alternative to standard telephone communication. By integrating VoIP into your communications infrastructure, long-distance toll charges can be reduced or eliminated. VoIP sends digitized audio in packet form, allowing the elimination of toll charges between a company's branch offices by tunneling voice traffic over the internet or private data networks.

 

Currently VoIP calls terminating on the Public Switched Phone Network (PSTN) in the United States cost $0.03 per minute or less. These savings can quickly produce a return on investment.

In addition to reducing or eliminating long-distance toll charges, using VoIP can reduce or eliminate the need for parallel voice-only wiring. Calls can be sent over a company's data network, which eliminates the need to maintain two sets of wiring (one for voice, the other for data). VoIP also reduces the need for dedicated station (FXS) cards in PBX hardware, as it is not port based. When additional VoIP phones are added to a network, no additional station cards need to be purchased, reducing costs.

Dave Pasternack 

Powered by: Dal