Caller ID Spoofing Firm Gets Death Threats

Frankie70 writes "Three days after the startup company Star38 began offering a service that fools Caller ID systems, the founder, Jason Jepson, has decided to sell the business. Jepson said he had received harassing e-mail and phone messages and even a death threat taped to his front door -- all of which he said came from people opposed to his publicizing a commercial version of technology that until now has been mainly used by software programmers and the computer hackers' underground. Details in the Houston Chronicle. Earlier ZDnet article about the service."

Obligatory Joke

[Anonymous Coward]

Attempts to trace the harassing calls failed due to their use of spoofed Caller ID information.

Re:Obligatory Joke

[bsharitt]

Harassing this man is wrong. This should only be used for legimate uses like pranks and stalking.

No it wasn't!

[ScottGant]

I didn't tape it to his door, I taped it to his mailbox.... ...NO WAIT! Ignore that last little bit....

Re:No it wasn't!

[dealsites]

Jason Jepson seems a little paranoid. Sometimes you have to take the heat to make some $$$. Controversial topics are usually pretty lucrative. It definately stirs up the interest in a product. While I personally wouldn't want to be caller-id spoofed, I think he should give the idea a chance. Like another poster pointed out, the companies will soon wise up and prevent the caller-id spoofing. Until then, try to make a few bucks.
--
Live deals all the time. Check out the latest in deal processing. [dealsites.net]

Re:No it wasn't!

[Pantero Blanco]

I didn't say I'd support declaring them illegal. I said I expect them to be declared illegal...much like redboxes, firecrackers, and radar detectors (in many states).

Joke disguises are most often used as just that- joke disguises-which is a legitimate reason to own one. The worst you can do with most of the things you find in joke shops is stink up a room or soak someone. Basically, you can embarrass someone.

With a caller ID-spoofer, you can get someone arrested. "They make for great practical jokes" isn

Good ridance

[Nos.]

Death threats may be going a bit far, but I don't really see a "legitmate" reason for a service like this. Telemarketers and debt collection agencies can NOT use services like this (at least where I am) and I really don't see a legitimate use for a service like this. I just wish it would be cancelled not sold to some other company.

Re:Good ridance

[ResidntGeek]

It'll make the phone companies fix the problems with their systems. People shouldn't be able to do this, and nobody will be happy about it, so the phone companies will be pressured to fix it.

Re:Good ridance

[A1kmm]

The telecos here don't let you "spoof" caller-id even if you have a legitimate reason(for example, the number you are "spoofing" is actually the number of the person really calling, over IP), let alone if you wanted to sell a service to allow customers to deceive people.

Re:Good ridance

[double-oh three]

One good use I've heard of is pranking friends/enemies. A joke is a legitimate use. Say you've got a friend in the federal government that's looking to be upwardly-mobile. Spoof the White House's phone number. For the overly, overly religious; [phone].

Re:Good ridance

[madmancarman]

When you say

Spoof the White House's phone number

and

For the overly, overly religious; [phone]

aren't you being a bit redundant?

Re:Good ridance

[PPGMD]

Never been called by the Whitehouse have you? Their number doesn't return a caller ID codes at least on My Verizon cell phone.

Re:Good ridance

[rich_r]

The call was probably along the lines of "get off our lawn and take your damned pants with you" ;)

Re:Good ridance

[Lord Kano]

Death threats may be going a bit far, but I don't really see a "legitmate" reason for a service like this.

Credit and Collection agencies can't use this, but what about Bail Bondsmen? Or Private Investigators? Repo Men? All of them have a legitimate reason to hide their identities from the people that they call.

Pretention. You're a small company, but you can give the impression that you're a BIG company in order to make potential clients trust you with their business.

How about practical jokes? Call someo

Re:Good ridance

[dave420]

Credit/collection agencies, bail bondsmen, PIs and even Repo men can call from lines that don't announce who they are. I mean, you wouldn't have a line registered under your business if it's a liability to your profession. The use of an alternative name is understandable and legal, it doesn't warrant a technology like this. As for pretention? That's just ridiculous. You're suggesting it's use as a marketing tool is a good reason to allow it? Do those feelings extend to spam? Practical jokes? Now I know you're scraping.

The only use of it is deception. It can only do harm - there are no legitimate uses for it.

If you really want to freak people out pretending to be god, just change your name by deed poll ;)

Re:Good ridance

[dave420]

Well, it's been demonstrated that the technology is harmful. The Caller ID system is used by people to identify malicious callers, and other illegal uses of phones. Getting rid of that ability is endangering victims and making life a lot harder for law enforcement agencies. That is a far more substantial argument than that of a marketing tool.

The legitimate uses you named were far from convincing. Those agencies who need to hide their numbers already can do that, with no new help. Introducing this ser

Re:Good ridance

[Lord Kano]

Getting rid of that ability is endangering victims and making life a lot harder for law enforcement agencies. That is a far more substantial argument than that of a marketing tool.

Life is supposed to be hard for law enforcement. Federal agents complaining that they don't have the tools that they need to do their jobs is BS; pandering at its worst.

Those agencies who need to hide their numbers already can do that, with no new help.

No, they can block their Caller ID information, they can't replace it on the fly.

Introducing this service would give that power to everyone, which (as I've pointed out before) can only harm.

So in your worldview, power should be kept for the select few and you get to select those few.

I am not buying it.

LK

Re:Good ridance

[Lord Kano]

I don't know what fantasy you live in, but the last time I checked, a 9mm semi-automatic pistol is outgunned when faced with fully automatic and assault type weapons loaded with armor piercing ammunition. These weapons are COMMON among the criminal element.

Police departments in every major city in this country have fully automatic firearms, snipers and armor piercing ammunition. Sure, an individual cop can be outgunned, but "the police" are not.

Think back 3 years ago to a bank robbery in California when

Re:Good ridance

[treke]

Fine here's a use. Take for example a small company that operates out of the employees homes. Calls are made from from personal phones, cell phones, wherever. There is one phone number that is designated as the incoming number for the company. You fake caller ID on all calls to display the main number of the caller so that you only receive a call at the main location and your customers do not end up getting someones personal answering machine when they try to return a missed call.

Using caller id to identify callers is a losing proposition, there are other technologies in place that do not involve trusting the information the caller gives you. Try calling 911, they already happily disregard the information caller id distributes.

Re:Good ridance

[Jim Starx]

I don't think any of those reasons are legitimate. If I'm paying money out of my pocket for caller ID I expect it to work for everyone, including those you mentioned.

Re:Good ridance

[Fweeky]

PI's and co can withhold their caller ID. Practical jokes are likely to be limited to spoofing known numbers, which is moving into pretty dubious territory; otherwise the user's just going to get a number they don't recognise,, not "God-The Almighty Himself".

Re:Good ridance

[grolaw]

Yea. Sure. It's cool that it's out there.

You properly use the contraction "it's" and you use it twice in the same sentance. This is a record on /..

However, the PIs that I use don't need to spoof phone numbers and anybody who spoofs the name of a major company is diluting a trademark and is also violating the Lantham Act.

Why a person with your command of the language would miss the obvious is beyond my comprehension. BUT, it is the high point of reading /..

Re:Good ridance

[mattkime]

You properly use the contraction "it's" and you use it twice in the same sentance. This is a record on /..

I am not amused at your attempt to discredit a post merely because of its proper use of grammar!

Re:Good ridance

[grolaw]

Did you hear the one about the literate /.'er?

Re:Good ridance

[SlashdotLemming]

but what about Bail Bondsmen? Or Private Investigators? Repo Men?

Or how about terrorists? Down with the technology because it can be used for evil. Sounds like Patriot Act reasoning.

We must be free, we must be free. But they can't be free because they're bothering me.

Re:Good ridance

[rmohr02]

Pretention. You're a small company, but you can give the impression that you're a BIG company in order to make potential clients trust you with their business.

IANAL, but this sounds like fraud to me.

Re:Good ridance

[xigxag]

This was exactly on my mind when my bank called me the other day. They left a message on my machine to question some unusual charges that had been made, and said to call them back.

Caller ID identified them as my actual bank.

When I called, the rep asked me for my card number and my mom's maiden name to verify. I gave them the information, but how do I know for sure that I wasn't just pwned?

More generally, how is one ever supposed to tell in the future that one is not the victim of a phish? The Star38 guy said he was likely scammed himself, and you'd think he'd know better.

In my particular case, the way I handled it was to initially give the "wrong" maiden name...then the rep said, "that's not what we have on record." At that point I knew she was legit, but one can potentially see this escalating to Frank Herbert-like levels of feints within feints, with the pro more likely to be one step ahead of the mark.

Re:Good ridance

[M. Silver]

In my particular case, the way I handled it was to initially give the "wrong" maiden name

The way I've handled it was to look the number up in the phone book. Isn't going to work very well with larger banks, though.

Maybe the banks will eventually have to start leaving messages like "Call me back at blah blah, and for confirmation purposes the PIN at the bottom of this month's bill is yada."

Well I would handle it

[Sycraft-fu]

By knowing my bank's phone number. If they leave me a message, I just call them back at their main 800 number. Not because I'm paranoid, simply because I have it memorized. It also, however, prevents any of this from happening.

Same thing with e-mail scams for eBay and the like. If I see something that looks like it's actually from a site I use, I'll go log in to my acocunt as normal. It will then get my attention, if they want it. Again more due to laziness since I use pine over SSH and thus cannot click l

Interesting

[Pan T. Hose]

In my particular case, the way I handled it was to initially give the "wrong" maiden name...then the rep said, "that's not what we have on record." At that point I knew she was legit [...]

Note to self: always say "that's not what we have on record" for the first time, if the victim says something different then note that, otherwise if she complains say "oh, I'm sorry, that was the right [password/maiden name/swiss bank account/credit card number] indeed."

Similar to blocking, and blocking the blocking.

[chipmeister]

I remember from the whole debate a few years ago about phone company services that would reject blocked numbers that there were some professions such as social worker and public defender that made a case for hiding their home and personal cell phone numbers. A legitimate use in this case would have the spoofed number appear as their government office number, rather than their home phone.

Doctors responding to patients from home

[PerpetualMotion]

After working at an answering service, I would page anywhere between 2-10 doctors a night with emergencys from hospitals or patients with sick babies, women worried about their pregnancys, adults having athsma problems, chipped/painful teeth, or other problems. Some that should go to the ER, some that could of waited till the next day, and others that just really just needed a call back. Doctors cannot give their home telephone number out. Most anyone who thinks they have a medical emergency thinks they should call direct instead of going through "channels." This means doctors use caller ID blockers.

There would periodically be problems with doctors using caller ID blocks being unable to call people back who block those calls, leading to sometimes unimaginable frustration in the middle of a medical emergency. The first time I saw this service, I saw immediatly that it could and probally would be abused, but for doctors who got stuck in that situation, it would be invaluable.

Re:Good ridance

[violet16]

Since when does something need to have a "legitimate reason" to be allowed? Seriously, don't free societies allow everything unless there's a really good reason for prohibiting it? Yet I see several "insightful" posts here arguing that unless this service can justify why it's worthy, it should be banned.

I'm sure advertisers think there's no legitimate reason for Firefox to have pop-up blocking, and Sony thinks there's no legitimate reason for PlayStation owners to have mod chips, and so on.

As for saying d

Re:Good ridance

[gehel]

Hackers are never the problem.
Easily exploitable vulnerabilities in a system are.

It depends a lot on what you call hackers ... Having people studying the security of the system is a good thing. Having them warn the manufacturer / buisness / developper / ... is a good thing. Having them release exploit in the wild can be usefull in certain conditions to make things move if the problem is not solved.

Having them sell a service on that is quite something different !

Re:Good ridance

[Anonymous Coward]

Hackers are never the problem.
Easily exploitable vulnerabilities in a system are.

I don't really agree. It sounds more like a black-hat justification than a real analysis.

In an "ideal" world, we wouldn't need locks on our doors or passwords on our computers, because people wouldn't be trying to steal from us or cheat us. There are actually still a lot of communities where the crime rate is low enough that locks aren't used most of the time. We never locked our house when I was growing up. It's a nice way to live, not worrying about other people being dishonest to the point that you get hurt. The small percentage of people who just can't be bothered to play by the rules end up hurting everyone else. The hackers are the problem.

Now, admittedly, we live in the real world. In most areas, including on the Internet, you can't trust your neighbors anymore because there are too many of them. That means we use locks and firewalls. They will never be perfect, anyone qualified can tell you that it's always a compromise between security and usefulness. Everyone, and every new technology, has to pick their compromise and hope it works out. If they're lucky, the attack rate will be low enough that it doesn't cause too much damage. If not, or if they make mistakes and end up with a worse compromise than they thought they had (nobody's perfect), then the technology becomes a liability. In that case, easily exploitable vulnerabilities are also the problem.

To make up for the fact that no system or technology is perfect, we have laws that try to prevent people from destroying everything that anyone builds simply because they can. If people exploited every weakness of every system, society would fall apart. (Or at the very least it would look like one of the future distopias in sci-fi.) That's why we jail hackers. Not to try to pretend that network security, but to add an extra level to it. Violate my security protocols, and you are going to find yourself on the receiving end of my criminal justice system. It's a lot of work for an unpleasant reward, so maybe less people will do it.

In this case, I don't see a legitimate reason for the spoofing. They have gone to the trouble of giving you an easy choice to provide your ID or not to. You can default either way, and switch per-call easily. With a few exceptions (giving the main office number instead of your private extension), there's really no reason to give a false ID. If it was just the hackers doing the spoofing, the rate would be low enough that the technology would still be useful. If anyone and everyone can send whatever ID they want, then the technology is likely to be abused to the point where it is useless. Then millions in investments go down the tubes and millions of people lose a useful service, not because it was dangerous or harmful or anything, but because it wasn't perfect and someone decided to destroy it for personal pleasure and profit.

I don't condone the death threats, but I wouldn't turn in the person if I knew who it was.

Re:Good ridance

[Anonymous Coward]

Hackers are never the problem.
Easily exploitable vulnerabilities in a system are.

So, burglars are never a problem, it's the "easily exploitable" locks on the doors? The "easily exploitable" non-shatterproof windows?

Come on, whatever happened to not invading someone elses's property and systems because it's *wrong*? Blaming it on the victim (whoever the hell it is) is obnoxious at best and morally bankrupt at worst.

Easy to trace

[usefool]

If it's a death threat, police should be involved and trace the originators. Email and phone calls should be easy enough to trace if there's serious crime associated with them.

And if the phone threat's caller ID is spoofed, well, at least the threats are directly supporting the spoofing service.

Waaaah!!

[Fnkmaster]

I offered an obnoxious, socially irresponsible service and people got angry at me! Waaaaaah!

What a bitch. If this happened more often, we wouldn't have companies like SCO and others going on with their obnoxious, socially reprehensible behavior in the name of shareholder value. Don't get me wrong, I'm a capitalist, but that doesn't mean that a company has the right to shit all over everybody. We're all part of something called society, and we have laws and social norms that you must obey, and unfortunately sometimes the law doesn't completely reflect the reality of socially acceptable behavior. Just because it's legal or technically possible doesn't mean the people should bend over and accept it.

Re:Waaaah!!

[crackshoe]

Can you spot the differances between making people 'bend over and accept' your new technology and people coming out of the woodwork and threaten you because they don't like what you're doing?

And people wonder why americans get a bad rap

[Anonymous Coward]

no morals = acceptable
corruption = good
greed = good
sharing = bad
war = peace
can spam = more spam
safer world = more terrorism
anti american = opposing views
safer = less liberty

Laws one must obey...

[nurb432]

That includes not threatening to kill someone beacuse you disagree with their products..

Dont lose sight of what is actually going on here...

Re:Laws one must obey...

[Fnkmaster]

Sorry, I didn't mean to imply that I support making death threats to people for their company's products. By mocking this situation, I was just expressing my sincerest desire that companies would realize that social responsibility holds as much in the realm of data, bits and bytes as it does in the real world. This is a more general commentary really, it has little to do with the situation of this one guy and his company.

In fact, while this service seems like it would be prone to abuse, I can think of p

Kill it!

[CptnSbaitso]

From the houston chronicle:

"The backlash against Star38 is the type of friction that can arise between for-profit software companies and hackers who resent the commercialization of technology they believe should remain free."

I really want to know if the majority of threats were from people who wanted the services to be free or if they were from people who decided that they didn't like the service at all! I fall into the second category and I'll bet everyone else does too!

Re:Kill it!

[Daniel Dvorkin]

That's probably straight from a *38 press release.

How about this: "The backlash against Star38 is the type of friction that can arise between companies offering a service for which there is no legitimate use and rational people who resent the use of legal loopholes by people who want to make money by offering their services to scum, and wish to remain free from harassment in their workplaces and homes."

There is no legitimate reason for anyone calling me to hide his identity. None. I'm not saying the o

Re:Kill it!

[A1kmm]

It is not Star38's fault, it is the fault of the Telcos who made it possible by switch misconfiguration. However, if their telecoms provider decided to reconfigure the switch properly to block spoofing, and their service suddenly didn't work :), I would have much sympathy for Star38 either. I just hope that this doesn't affect the right of the teleco to fix their service(perhaps "but if we reconfigure our switch, we will get sued"?).

Re:Kill it!

[Daniel Dvorkin]

I think there's plenty of blame to go around. Yeah, the telcos shouldn't allow it in the first place, but ... if I find out that it's particularly easy to file the serial numbers off a particular brand of handgun, and start selling such guns without the serial numbers right next door to a crack house, a reasonable jury might decide that I am at least partly at fault when the dealers start carrying them. Know what I mean?

Re:Kill it!

[NoMoreNicksLeft]

I'll go one further. Telco's should be forced to provide ANI to me at a modest fee, maybe $5 per month. This CallerID bullshit is all but worthless, even when clever PBX tricks aren't being used.

A federally mandated phone blackhole list would be even better yet. Each person gets 5-20 blackhole slots, that can be bound to any published blackhole list. In 2 weeks, we'd have all of their numbers on these things, everyone would be subscribed to them, and we could finally get this shit under control. The DNC li

Re:Kill it!

[eric76]

On the other hand, you could tell anyone who you want to have the ability to call you from somewhere other than their house to spoof their id with their home telephone number. That way, you could ignore all telephone calls that don't appear to originate from a select set of telephone numbers.

For that matter, someone working from home could spoof their company's telephone number when they need to talk to a customer.

Or you could call home from the local bar or brothel but make your office telephone number

Re:Kill it!

[Temsi]

Couldn't agree more.

This paragraph stood out, and I was gonna write something about it if nobody else had...

So, basically, they're jumping on the SCO bandwagon blaming "anarchist hippies" for their F'd up business model.
What did they expect? Civilians greeting them as liberators throwing flowers at them? No, wait... wrong discussion for that line.

Personally, I think death threats are going too far, but loud complaints are in order, and should be expected.
In fact, a service such as this one, should ups

Bullshit Detector

[Anonymous Coward]

*beep* *beep* BULLSHIT ALERT *beep* *beep*

The entire premise behind this "service" seems to be: fraud. I can think of no legitimate uses for it.

And now, the creator of the service is looking to sell out? If it's a dangerous life, why not just shut down? Obviously, he's looking for a quick buck, at the expense of the rest of us (and whatever shady organization snaps this up). ...and this is just more free advertising.

Re:Bullshit Detector

[karlandtanya]

Privacy=fraud?

Don't think so.

But, wait, you say...If you want privacy, then turn on caller-ID blocking.

No, then I still give away some information.

I would prefer you not even know that I don't want you to know.

If you need my phone number, you can very well ask me for it and if I want you to have it, I'll give it to you.

Otherwise, it's none of your business.

And the fact that I choose not to tell you is also none of your business.

Re:Bullshit Detector

[gad_zuki!]

> I can think of no legitimate uses for it.

I'll play devil's advocate. People say the same thing about anonymous remailers, proxies, etc. I understand there's a difference between spoof and anonymous but lets see:

Civil Disobedience.

Bond/Repo Men/Private investigators.

Complaing to people in power without revealing identity or giving off the "CALLER ID BLOCKED" message.

Getting around hairy social or legal situations in an ethical manner. Remember, legal does not equal correct. Illegal does not equal incorrect.

Road warriors "spoofing" their work phone numbers and not their cell numbers.

and of course the #1 reason:

Teenage girls calling boys they like, giggling, and hanging up.

I don't get this...

[Sebby]

Why is this article more about 'selling out' than the fact that caller ID spoofing is a misrepresentation and prone to abuse. I think the obvious reason for him getting out of this is due to the threats he received (I'm guessing because of the abusive potential of the 'technology') and not because he 'sold out'...

Re:I don't get this...

[realdpk]

It must be pretty nice to be able to announce that you're selling a company with 3 days of service records backing it up, and to have free(?) on slashdot to do it!

Interesting part about the article...

[ONU CS Geek]

[snip]
The backlash against Star38 is the type of friction that can arise between for-profit software companies and hackers who resent the commercialization of technology they believe should remain free.

"In most countercultures, there is an aspect of selling out," said Caleb Sima, co-founder of Spi Dynamics, an online security company. "People who make money off technology are deemed to have sold out. Anyone who has a unique idea and is making money is going to get badgered."
[/snip]

No, I think it's that people don't like it when people use technology for slimy things, and want to get paid for the slimy things [pr0n aside]. I have no problems with Asterisk...I use it in my house, and have openly recommended it to some 'phone guy' co workers that like messing around with routing and stuff at home.

I know that caller ID can't be trusted...but that's only the first step in the puzzle. You've already got call ID block Block on your phones...so telemarketers decided to start putting 800 numbers and things like 555-555-5555 in as numbers on their outgoing CallerID.

I'm sure some people were upset. Legally, [IANAL], I think they could be on some shady ground, especially, if they're trying to represent someone else, when they're attempting to collect a debt.

Re:Interesting part about the article...

[penguinoid]

No, I think it's that people don't like it when people use technology for slimy things, and want to get paid for the slimy things [pr0n aside].

Are you implying that pr0n is slimy? Or does it just look slimy because you haven't cleaned your monitor in a while?</bad joke> Really, I don't get what people have against pr0n. Is it because it involves nakedness? There is plenty of bikini pr0n, which does not involve nakedness and you might see on a nice day on the beach. Because it involves sexuality

Who would do this?

[darkmeridian]

The article seems to suggest that hackers angry at the founder "selling out" were threatening him. Really? The guy lives in a gated community and a person managed to stick a note on his door and escaped unnoticed? I don't think so.

The guy might have just created this to get a good reason to sell the business. "Oh, it's so popular that people are trying to kill me. I'm not cashing out because, uh, the business might be illegal, etc."

Re:Who would do this?

[chimpo13]

The guy lives in a gated community and a person managed to stick a note on his door and escaped unnoticed? I don't think so.

Ho, ho, ho. People who believe they're safe because they're in a gated community just aren't thinking. When I'd help my friend repo cars, gated communities didn't even get a 2nd thought. Not even the fancy-pants ones like when we went to MC Hammer's house.

And when we'd drive into a gated community in an obvious repo truck past the guard, well, that's the risk at hiring guards for 8 bucks an hour. You don't get the brightest guards out there and you don't lie to them to get in.

But I think this guy is just trying to make a quick buck and sell his business. If you're doing something shady, you have to deal with shady people.

Re:Who would do this?

[British]

Please tell me when you repo'd MC Hammer's car he ran out and yelled "Can't touch this!"

Re:Who would do this?

[jericho4.0]

I agree. Little about this story rings true. He hired a P.I. instead of the police because 'he didn't know who threats were from' and so the police wouldn't be any help? He gets emails and phone calls AND a note on his door? I'm suprised he didn't get the head of a familly pet in his bed.

And his web site is empty also. A mailto link and some text does not a service make.

We read stories of people pissing of the 'hacker' community on a daily basis, but we rarely hear about death threats. This guy is a hoa

It isn't as though he developed the technique.

[Scoria]

Anybody can generate fictitious Caller ID information. Instead of attributing the blame to Jepson, who merely developed a convenient method by which to do so, perhaps we should blame the telephone companies. They developed the insecure technology, after all, and appear unwilling to mitigate the problem(s).

how to spoof with a cell phone

[Anonymous Coward]

ok this got baried on the last post so here it is again ---- to fake the id on any cell phone what you need is the code to programe the phone (not the unlock code) 1) how to get the code: Call your cell phone provider and tell theam your phone is acting up and it gives you some message saying it cant authenticate on the network. The before they start in trouble shooting it aske theam if you can reprogram the phone. Now watch out some companies like verizon use over the air *228 to program the phone and cingular send updates through the air as well. So how do you get the code easy tell theam you'r not getting a good signel and that you want to manualy program the phone. The will walk you through manually programing the phone. Here it comes write down the code they give you and irnore the rest. Your phone already works so all you need is the code. Now thet you have it all you need to do is use it and the first thing any phone asks you after entering the code is what phone number you want. So change it to what ever you want I like [phone] then save the rest -Dont change anything else or your phone wont work on the network -- now why does this work well cell phones use E.S.N. and authentication keys when billing not the phone number but there caller id only uses the number that is programed into the phone so enjoy this and yes i'm a coward i didnt want to log in as my self to post this so dont aks me anymore ? about this --- and I dont believe this workes for nextel. tata

Re:how to spoof with a cell phone

[v1]

I was going to do some modding here today but I'll forego that for some good advice:

don't do this.

Years ago I got a cel phone at the same time as a friend of mine. Back in those days, the codes came with the phones if you read all the literature. I found my way into the programming area and, among other things, managed to permanently screw up my low battery shutdown point. I was able to change my number to a friend's number, and answer his phone calls.

When I mentioned this to my service provider, they said "you must not have done it very many times..." The reason was, when they get five (5) incorrect ESN/Phone Number match-ups, they deactivate your phone by it's ESN, and then you have to take it back to them to get it turned back on. So just don't. (and no, you can't change your ESN... at least not unless you own a specific model of Motorola phone for which Motorola got fined heavily by the FCC for producing it in that modifyable way)

Software programmers?

[carcosa30]

Are these the people who write, like, software programs?

Is there another kind of programmer? Maybe UML programmers? But I thought those were called MBAs...

Collection agencies are scum

[Gannoc]

I've never been the target of one myself, but I used to always wonder why bankruptcy lawyer commercials always said stuff like "Stop creditor harassment."

I always thought, "Well honestly, if you're not going to pay your bills, then you should expect people to ask you for the money."

Nope. Its harassment. Its actually frightening stuff. I first started learning about this when I received an odd message on my answering machine. It was from someone from "Kansas City" who said that she was despirately trying to get in contact with my neighbor, and that she had called the police and they had said I was a neighbor, and could I PLEASE tape a note to their door giving them her number."

Well, it sounded fishy, so I called the number myself late at night after hours. The answering message didn't say where I had called, but I waited and found it was a collection agency.

Basically, they lied to ME, a 3rd party, to try and get me to do their fucking job for them, and probably ruin my relationship with my neighbors in the process. They clearly didn't call the police about an emergency like they implied. I'm glad I checked up with them, i'm sure my other neighbors got similar messages.

These people do everything short of theatening to break your fingers. They'll say "We're going to call your boss and tell them you're not paying your bills. I'm going to try and get you fired." They threaten to tell your neighbors, to tell your children's school, etc. They'll call you 5-7 times a night demanding that you immediately send them the money.

There have been many stories of people who sent them a part of their bill, and then the collection agencies illegally used their checking account number to withdraw the whole amount, causing a chain reaction of them now being late on ALL of their bills, instead of the one they just couldn't pay.

So its no surprise that collection agencies would use something like this to fool people.
Yes, some people are deadbeats, but there are a lot of people who have lost their jobs and need to choose between food and their gas bill.

Re:Collection agencies are scum

[Have Blue]

On the one hand, that sounds pretty awful. But on the other hand, they're up against people who are probably often quite willing to go to even greater lengths, probably into outright criminal behavior, to avoid paying their debts. The previous story about Star38 had a lot of informative posts about the legal limits on the actions of collection agencies; they are limits to what they can do and they're lower than you seem to think.

Re:Collection agencies are scum

[sevensharpnine]

I'm more sympathetic to the people involved than I am to the collection agencies. Almost all bills are well-documented transactions. Contracts get signed, services/products delivered, etc. Collection agencies can use the legal process if they want their money back. However, it's cheaper to hire someone to make threatening phone calls. Basically, these threats are a form of least-cost production. They want the money as soon and as fast as possible.

Re:Collection agencies are scum

[drinkypoo]

yeah, one of the things they "can't" do is claim to be anything other than a collection agency. In fact they are generally required by law to announce that they are a collection agency - which they frequently don't do.

criminal offense

[bani]

what they did was a criminal offense and you should report them to the feds. they can get fined under the FDPCA.

Spoken like a truely employed person...

[oldosadmin]

Has it ever occured to you that there may be valid reasons to have collection agencies coming after you?

I'm 20 years old and over $3000 in debt because of schooling expenses and a couple of periods of unemployment. Do you think I DON'T WANT TO PAY THEM? No, I'd love to pay them, I even moved back in with my parents to enable myself to have more money to pay back my debt. But that does NOT give them the right to call me everyday, refuse to say who they are until I give my name, and make me dread answering

Re:Spoken like a truely employed person...

[maximilln]

I'd love to pay them

I completely agree. If the corporate world really wanted us to pay our debts back, they'd offer jobs and raise our wages.

Funny... the IRS reports that the average American wage _DECREASED_ 10% from '00-'02. That's making it pretty darn difficult to pay back those debts.

Oh, and it's not a conspiracy, because we all know that politicians and CEOs have taken similar pay cuts and have decided to forego their yearly million dollar bonuses. HAR HAR.

Not Going to Sell Well..

[artlu]

Obviously, no one is going to buy that business knowing that they'll receive imminent death threats! He needs to go back to Marketing 101. On the other hand, he probably could sell the business for a nice profit because of the publicity that it has generated.

gShares.net [gshares.net]

ummm . . .

[lavaface]

Jason Jepson, has decided to sell the business. Jepson said he had received harassing e-mail and phone messages and even a death threat taped to his front door

who the hell is gonna buy this business?

It should be all or none

[egburr]

Either anyone should be allowed to spoof their ID, in which case caller ID becomes worthless, or nobody should be allowed to do it. Some types of companies are prohibited by law from spoofing their ID, and for good reason. The phone companies should implement a technological means of prevention for this, and not allow anyone at all to do it.

Caller's should be allowed to block or reveal their ID, but not spoof it. Receivers should be able to accept or reject calls with a blocked ID.

I've had more than enough calls from "0" which were not from the operator. I've had plenty of calls from other numbers that are obviously false (not 7 or 10 digits). I've had plenty of calls from numbers that were "out of service" when I called them.

If the phone companies are unable to prevent spoofing, the government should implement laws either to make spoofing illegal or to mandate an upgrade to the phone system to make it impossible.

Re:It should be all or none

[Plugh]

Either anyone should be allowed to spoof their ID, in which case caller ID becomes worthless, or nobody should be allowed to do it.

Allowed??! Allowed?!?!?

Have you learned nothing about the nature of technology from the perverse antics of the RIAA?

You can make an algorithm "illegal", but you damn well can't stop it from being used. In my (not even remotely Humble) opinion, that's why, utlimately, the only realistic political stance is a Libertarian [freestateproject.org] one.

Re:It should be all or none

[adolf]

Ladies and gentlemen, please allow me to introduce the real reason why this is all possible in the first place:

Meaningful Caller ID for DID PBX systems.[1]

[1]: You might have a Direct Inward Dial number assigned to your extension at work, right now. Or at least, you know someone who does (the whole "let me give you my direct number..." bit.)

The way they work is thus:

Joe Random calls your DID number (666-666-6666). The telco switch sees that it's supposed to route calls to that number across Acme Elec

How is this done?

[cybernate]

Anyone know how this is done? I can understand how to fake your cid number, but how can you fake CNAM? If I faked my number to a real friends number the terminationg switch would do a CNAM dip and display his number. How could I change the text of the name?

Mod Parent Up!

[Anonymous Coward]

Those are excellent questions to ask.

Some information can be found by reading http://artofhacking.com/files/callerid/CLID-CID.TX T [artofhacking.com], but otherwise resources for this kind of information are non-obvious.

Wake UP!

[Saeed al-Sahaf]

Isn't this "Death Threat" bull shit just a good example of self-generated FUD designed to SELL THE BUSINESS FOR $$$? Come on people, are we that stupid, that willing to buy into the TINFOIL HAT bs that this story is?

Re:Wake UP!

[Sebby]

You're probably right, given that he doesn't want to involve to actual police, just a few 'PIs'

Spoofing CallerID is nothing special

[SSpade]

Spoofing caller ID is trivial, no great hack at all, and fairly commonly done. I'm amazed anyone cares (and have a sneaky suspicion that the news coverage and the "death threats" might well have been a way to sell a company for considerably more than the $5,000 or so it would have taken to set it up).

If you have anything bigger than an analogue copper phone line you can configure your PBX to send any number you like as your outgoing CallerID. It's no cleverer a trick than configuring your fax machine to send the wrong originating number.

Companies of all sorts have done this for years. Not just debt collectors and PIs, either. If you get a 'phone call from anyone at the New York Times you'll likely see a CallerID of 000-000-0000. Other companies will often send the main switchboard number at their HQ, rather than the direct dial number to the actual caller.

Spoofing it on a straight analogue line is a little trickier, but sometimes possible.

Huh?

[Anonymous Coward]

I thought the philosophy about grey-area technology around here was that you don't blame the technology - you blame the user. I guess that's only the case when it doesn't inconvienence us. A large amount of P2P transfers are illegal (or at the very least grey-area), but nobody blames P2P. So a large amount of Caller ID spoofing will be illegal or grey-area, and everyone blames the technology? Whatever.

I can't help but wonder . . .

[taustin]

I can't help but wonder is maybe somebody explained to him that his service is inherently illegal for collectio agencies to use, since lying is specifically illegal under the Fair Debt Collection Practices Act:

15 USC 1692e [ftc.gov]:

A debt collector may not use any false, deceptive, or misleading representation or means in connection with the collection of any debt.

Caller ID should be secure

[Anonymous Writer]

I thought that caller ID was done through the phone company and people couldn't alter it. And I always thought it would be a great method for dial-up authentication and private networking. With caller ID, a computer recieving a data call could identify that the calling computer was physically located at a land line. This would be extremely useful for businesses to business transactions and banking. Having to rely on encryption while connecting through the internet just isn't as secure as a direct physically secured phone call.

Sure, there could be legitimate uses; say for example that you have a call forwarding feature provided by the phone company and you are having calls to your number forwarded to a phone at your location. It would be useful to be able to have calls from that location display your caller ID if you need to return a call. However, that shouldn't be up to a company like this. It should be a feature connected with calling card billing; if you use your calling card from a remote location and it is being billed to your phone number, it should also display your caller ID. Connecting caller ID to billing would also work well for tax accounting. If you were making a phone call for business, you would want your business number caller ID to appear. And you would want the call to be billed to your business phone number as well, for tax purposes.

The options for using this service legitimately don't compare to the possible illigitimate uses for it. This would be the next "spamming" type of business, making money out of putting others through misery. The fact that caller ID is called "caller ID" is so that it can work just like proper identification. Using a service like this to pretend you are someone else calling would be the equivalent of using a fake driver's license, even though it isn't percieved that way by the legal system yet.

One good use...

[NotAnotherReboot]

I can think of *one* good use for spoofing- calling cards. Why not have the company performing the calling card service to take the number you call them from and then spoof that when they make the call through their system?

This is not funny

[Facekhan]

I will be remembering how funny /.'ers found this the next time somebody offers a software or hardware product which offends someone somewhere but has many legitimate uses. I don't have much sympathy for bill collectors as a whole but as someone who has on occasion had people not pay me (even though they have the money to pay) and simply ignore my attempts to get the money I understand how frustrating it is especially to small businesses. We don't want to get nasty about it but the system of annoying bill collectors calling you is far better than the one it replaced. Namely, bill collectors breaking your legs and stealing your stuff or getting you sent to debtor's prison.

I have been on both ends of the collections game and after just a month of this I can see why companies try to distance themselves from the nasty side of it and hire professional assholes to do the job

I'd like one.

[geekoid]

Ever since I misdialed a number, relized it was the wrong number and hung up.
Couple minutes later I got a call with some ass screaming at me, so I hung up. And then again, and again. That jackass kept calling me. Finally, I changed my number.

Then there was the time I called someone on a business matter. Sometime later her husband came home, saw my unmber on there caller ID, called me up and kept trying to get me to admit I was sleeping with his wife.

Gah, I hate caller ID.

Why do you need to change your caller ID?

[adb]

Just disable it. You can do this with a single call to the phone company. Sending false information is lame.

Re:Perhaps an alternative

[ResidntGeek]

No matter what the Caller ID says, people aren't going to automatically pay their bills just because they hear "give us our money!" on the phone.

Re:Perhaps an alternative

[Cro Magnon]

Since when is a person "formally notified" by phone? I always thought they had to be notified in writing, perhaps served by a process server.

Re:Perhaps an alternative

[Cylix]

Um, there are laws forbidding collection agencies to hide their identity.

collection agencies break the law all the time

[bani]

you really think 'the law' is a deterrent?

http://www.ftc.gov/opa/1996/02/allied.htm
http : //www.ftc.gov/opa/1995/08/grlakes.htm
http://www. ftc.gov/opa/2002/07/dccredserv.htm
http://www.con sumeraffairs.com/news04/nco.html
http://www.ftc.g ov/opa/2000/08/performance.htm
http://www.usdoj.g ov/usao/az/azpress/2004/2004-058 .pdf
http://www.usatoday.com/money/perfi/columnis t/lamb /0009.htm

debt collection is a highly corrupt business and its very nature demands employees who have low ethical and moral standards.

Re:Perhaps an alternative

[Jedi Alec]

ehmmm, I believe that would be what bill collectors in their own very special jargon call a "letter"

Re:Perhaps an alternative

[pjt33]

Doesn't your country have registered mail?

Re:Perhaps an alternative

[glpierce]

"at about 2:30 PM, several of my neighbors are "missing," though they never left their houses"

That's what we call a "nooner" (or in this case, an "after-nooner").

Re:Perhaps an alternative

[chris_mahan]

Certified mail.

Re:Perhaps an alternative

[Detritus]

That's what the court system is for.

Any bill collector who lies or uses fraud to collect a debt, should be tossed in a cell with Bruno, the sex machine.

RE: bill collectors

[King_TJ]

Frankly, I think bill collectors already do MUCH more calling than is necessary to "get the money that is owed to them". The problem is not that they can't make initial communications, or remind people they still have an outstanding balance.

That's already accomplished much more effectively with the "past due" notices and "collection activity is being taken" notices they mail out on a regular basis.

Bill collectors really just use phone calls as a means of harassment, to wear down someone - hopefully to the point where they'll just pay the bill rather than being interrupted constantly by the ringing phone.

As just one example, my ex-wife ran up a bunch of bills on my Discover card right before she moved out. Even though I had the card itself in my possession the whole time )and her name was never on it as a co-signer), she used some old "cash advance checks" to get thousands of dollars for herself.

I alerted them as soon as I realized what happened, but they still claim I'm responsible for the charges. I tore up my card and refuse to pay (largely because there's no way I CAN pay!). They called both my home and my workplace about 6 times per day, on average - and on weekends, call several times, starting at about 8AM, again around 10AM and again around lunchtime. I finally just changed my home number to an unpublished number, but they still call my work as regularly as ever.

Lucky for me, my boss is pretty understanding about the situation... but any fool should know that if you're trying to collect money, you don't take steps that could get the person fired from their job as part of your efforts!

Re:Perhaps an alternative

[1u3hr]

Perhaps it is dishonest for a bill collector to use someone else's phone number on a caller ID, but how else can the collectors get the money that is owed to them.

Send a certified letter.
Take them to court.
Often these bill collectors get a number and ring it continuously. Sometimes the person at the other end has little or nothing to do with the debt (parents, room mates, etc). After you've informed them of the debt, any more "reminders" are basically harrassment.

Re:who stands to benefit?

[AndroidCat]

Caller id has never been foolproof. It depends on the originating switch to be truthful. As soon as companies got their own digital switches, spoofing was possible. Now that capability is now moving down to the level of individuals.

Re:Death Threats?

[penguinoid]

It's not like the man is running a web based puppy killing service, folks.

I was going to find some online puppy killing service, just to fuck around with you, but after several minutes of googling I couldn't find one.