Website offers Caller I.D. falsification service
By Kevin Poulsen, SecurityFocus
Overdue debtors beware: You may not be able to rely on Caller I.D. to screen out those annoying bill collectors much longer. A California entrepreneur has a plan to bring the hacker technique of Caller I.D. spoofing to the business world, beginning with collection agencies and private investigators.
Slated for launch next week, Star38.com would offer subscribers a simple Web interface to a Caller I.D. spoofing system that lets them appear to be calling from any number they choose. "It creates an extra avenue for them to have someone pick up the phone," says founder Jason Jepson.
Caller I.D. spoofing has for years been within the reach of businesses with certain types of digital connections to their local phone company, and more recently has become the plaything of hackers and pranksters exploiting permissive voice over IP systems. But Star38.com appears to be the first stab at turning Caller I.D. spoofing into a commercial venture. Jepson claims the service will charge a twenty-five cent connection fee for each call, and seven to fourteen cents per minute.
SecurityFocus took the site for a test drive, and found it worked as advertised. The user fills out a simple Web form with his phone number, the number he wants to call, and the number he wants to appear to be calling from. Within two seconds, the system rings back, and patches the user through to the destination. The recipient sees only the spoofed number displayed on Caller I.D. Any number works, from nonsense phone numbers like "123 4567" to the number for the White House switchboard.
Jepson says the backend system doesn't rely on the most common methods of Caller I.D. spoofing -- PRI lines and VoIP -- but otherwise declined to comment on how it operates, for fear that competitors will launch copycat sites.
Legal Issues
Star38.com claims it will screen subscribers, and initially make the service available only to licensed private investigators and collection agencies. Jepson and his partners believe that collection agencies in particular will find the service invaluable for getting recalcitrant debtors to answer the phone.
"If [collection agencies] have access to the loan application, they have the references," says Jepson. "Now they can call John Doe, and the number that he used as a reference on his loan application pops up on his or her Caller I.D." When debtor answers the call, instead of being greeting by Uncle Joe from back east, he finds himself on the line with a stern gentleman who wants to discuss some missed car payments.
The service does not appear to violate any federal criminal law, says Orin Kerr, a law professor at the George Washington University Law School, and a former Justice Department computer crime lawyer. "It doesn't violate the Wiretap Act or the Computer Fraud and Abuse Act or anything like that," say Kerr.
But Rozanne Andersen, general counsel at the Association of [url=\"http://www.acainternational.org/\"]Credit and Collection[/url]Professionals, believes collection agencies would be barred from using Star38.com under two federal civil laws: the Fair Debt Collection Practices Act, which prohibits false or misleading representations and unfair practices in collecting debts, and the FTC Act, which outlaws deceptive trade practices in general.
"I would say that the concept would be very attractive to the industry, but the practice would be prohibited," says Andersen. "If that consumer calls that number, and does not reach the collector, that's a very serious problem. Certainly the use of what I'll call a 'dummy number' or a 'substitute number' would be a prohibited practice, because it is deceptive in its nature."
Jepson says his own attorney has advised him that the practice is permissible. He plans on launching Star38.com on September 1st.
[url=\"http://www.securityfocus.com/news/9419\"]source[/url]
Website offers Caller I.D. falsification service
Moderators: Moderator, Global Moderator
Website offers Caller I.D. falsification service
[color=\"#41211C\"]It takes years to build up trust and only seconds to destroy it
[/color]
Website offers Caller I.D. falsification service
[b]Citing threats, entrepreneur to quit caller ID venture[/b]
By Ken Belson
The New York Times
It may be known as caller ID spoofing, but it is evidently no laughing matter.
Three days after the start-up company Star38 began offering a service that fools caller ID systems, the founder, Jason Jepson, has decided to sell the business. Jepson said he had received harassing e-mail and phone messages and even a death threat taped to his front door--all he said from people opposed to his publicizing a commercial version of technology that until now has been mainly used by software programmers and the computer hackers' underground.
For a fee, customers using the Star38.com Web site would be able to alter the number that would appear on the caller ID screen of the recipient's phone. The technique could mask the identity of a bill collector, for example, or enable a private investigator to fool someone into answering the phone on the false belief that a friend or relative was ringing.
Jepson said Friday that he did not yet have any paying customers for the service. But he said he had received hundreds of messages from potential customers--as well as from people concerned that his product would invade their privacy. He also said he had received inquiries from five investors who were interested in investing in or buying his company.
"It generated a lot more interest than I ever thought it would," said Jepson, who noted he had spent only $3,000 to develop his service with the company's five other employees. But he said the threats had persuaded him to get out of the caller ID spoofing business.
"I was harassed," he said. "It's too much."
Jepson, an entrepreneur who lives in a gated community in Orange County, said he had hired a private investigator familiar with hackers, both to protect himself and his family and to try to determine the source of the threats.
He said that since he did not know specifically who was threatening him, he thought it would be fruitless to seek help from the police. "I don't want to go to the cops, who might not know what a hacker is," he said.
The reaction against Star38 is the type of friction that can arise between for-profit software companies and hackers who resent the commercialization of technology they believe should remain free.
"In most countercultures, there is an aspect of selling out," said Caleb Sima, the co-founder of Spi Dynamics, an Atlanta-based online security company. "People who make money off technology are deemed to have sold out. Anyone who has a unique idea and is making money is going to get badgered."
While network security consultants and some other technology professionals are known to have a cottage industry involving the use of caller ID spoofing, Jepson said the nature of the threats he had received made him conclude they had come from so-called phishers--people who use caller ID spoofing and online techniques to trick people into handing over confidential information.
The people who threatened him, he said, had already tapped his phone calls and had obtained details about how much money he last deposited into his checking account. "Some people," he said, "are pretty fired up about this."
[url=\"http://news.com.com/Citing+threats%2C+entrepreneur+to+quit+caller+ID+venture/2100-1037_3-5347560.html?tag=nefd.top\"]source[/url]
By Ken Belson
The New York Times
It may be known as caller ID spoofing, but it is evidently no laughing matter.
Three days after the start-up company Star38 began offering a service that fools caller ID systems, the founder, Jason Jepson, has decided to sell the business. Jepson said he had received harassing e-mail and phone messages and even a death threat taped to his front door--all he said from people opposed to his publicizing a commercial version of technology that until now has been mainly used by software programmers and the computer hackers' underground.
For a fee, customers using the Star38.com Web site would be able to alter the number that would appear on the caller ID screen of the recipient's phone. The technique could mask the identity of a bill collector, for example, or enable a private investigator to fool someone into answering the phone on the false belief that a friend or relative was ringing.
Jepson said Friday that he did not yet have any paying customers for the service. But he said he had received hundreds of messages from potential customers--as well as from people concerned that his product would invade their privacy. He also said he had received inquiries from five investors who were interested in investing in or buying his company.
"It generated a lot more interest than I ever thought it would," said Jepson, who noted he had spent only $3,000 to develop his service with the company's five other employees. But he said the threats had persuaded him to get out of the caller ID spoofing business.
"I was harassed," he said. "It's too much."
Jepson, an entrepreneur who lives in a gated community in Orange County, said he had hired a private investigator familiar with hackers, both to protect himself and his family and to try to determine the source of the threats.
He said that since he did not know specifically who was threatening him, he thought it would be fruitless to seek help from the police. "I don't want to go to the cops, who might not know what a hacker is," he said.
The reaction against Star38 is the type of friction that can arise between for-profit software companies and hackers who resent the commercialization of technology they believe should remain free.
"In most countercultures, there is an aspect of selling out," said Caleb Sima, the co-founder of Spi Dynamics, an Atlanta-based online security company. "People who make money off technology are deemed to have sold out. Anyone who has a unique idea and is making money is going to get badgered."
While network security consultants and some other technology professionals are known to have a cottage industry involving the use of caller ID spoofing, Jepson said the nature of the threats he had received made him conclude they had come from so-called phishers--people who use caller ID spoofing and online techniques to trick people into handing over confidential information.
The people who threatened him, he said, had already tapped his phone calls and had obtained details about how much money he last deposited into his checking account. "Some people," he said, "are pretty fired up about this."
[url=\"http://news.com.com/Citing+threats%2C+entrepreneur+to+quit+caller+ID+venture/2100-1037_3-5347560.html?tag=nefd.top\"]source[/url]
[color=\"#41211C\"]It takes years to build up trust and only seconds to destroy it
[/color]