Spoofed Call

Description

A spoofed call is a fraudulent or malicious call in which the caller identity presented to the called party is falsified. This is achieved by manipulating the calling line identification (CLI) information in the call signalling, such as the From header in SIP or the Calling Party Number in ISUP. The result is that the called party sees a number or name that does not correspond to the actual originator. Spoofed calls are a significant security concern because they can be used for various illegal activities, including fraud, harassment, and impersonation.

In 3GPP networks, call signalling is governed by protocols such as SIP for IMS-based calls and ISUP for circuit-switched calls. The caller identity is typically carried in the P-Asserted-Identity header (for trusted networks) or the From header (for untrusted). Network elements such as the P-CSCF, S-CSCF, and MGCF are responsible for validating and forwarding this information. However, if an attacker gains access to the signalling path, they can modify the identity. For example, a compromised SIP client could insert a false From header, or an attacker could exploit a misconfigured gateway to inject spoofed signalling.

The 3GPP security architecture includes measures to prevent spoofed calls. These include authentication of the calling party, integrity protection of signalling messages, and verification of the calling identity at network boundaries. For instance, the IMS AKA authentication ensures that only authenticated users can originate calls, and the P-CSCF can verify the identity against the subscriber's profile. However, spoofed calls can still occur if the attacker is outside the operator's network, such as when calls originate from the PSTN or from a different operator's network without proper verification.

To combat spoofed calls, 3GPP has specified features such as the Originating Identification Presentation (OIP) and Originating Identification Restriction (OIR) services, which allow the calling party to control the presentation of their identity. Additionally, the Terminating Identification Presentation (TIP) and Terminating Identification Restriction (TIR) services manage the presentation of the called party's identity. More recently, standards like STIR/SHAKEN have been developed to authenticate caller ID in IP networks, and 3GPP has incorporated similar concepts in its specifications.

Spoofed calls are addressed in various 3GPP specifications, including 22.173 (IMS multimedia telephony), 22.228 (IMS service description), 22.898 (study on spoofed calls), and 33.831 (security aspects). These specifications define requirements and mechanisms to detect and prevent spoofed calls, such as verifying the calling party's identity and providing indicators of trust. The fight against spoofed calls is ongoing, as attackers continually find new methods to bypass security measures.

In summary, a spoofed call is a call with a falsified caller identity, enabled by manipulation of call signalling. It poses risks to users and operators, and 3GPP has developed a range of security features to mitigate it. Understanding spoofed calls is essential for telecom engineers to design and operate secure networks.

Purpose & Motivation

The concept of spoofed calls and the need to address them arose from the increasing prevalence of fraudulent and malicious calling practices. Before the widespread adoption of IP-based telephony, spoofing was more difficult but still possible in the PSTN through techniques like PBX hacking. With the advent of VoIP and IMS, the barrier to entry for spoofing decreased, as signalling could be manipulated using software tools. This led to a surge in spoofed calls used for telemarketing fraud, phishing, and harassment.

The primary motivation for defining and combating spoofed calls is to protect users from fraud and abuse, and to maintain trust in the telephone network. Spoofed calls can cause financial loss (e.g., via callback scams), emotional distress (e.g., harassment), and security breaches (e.g., impersonating a bank). Operators also face reputational damage and regulatory penalties if they fail to prevent such calls.

3GPP introduced specifications to address spoofed calls, starting with Release 12. These specifications define requirements for network elements to verify caller identity and provide mechanisms for users to report spoofed calls. The evolution of the definition reflects a shift from a narrow technical description to a broader one that encompasses unauthorized use and intent to defraud. This aligns with the growing sophistication of attacks and the need for comprehensive security measures.