[WXC/VFX] Calls from invalid caller IDs, silence when answered

Forums › One New Zealand (including Vodafone, WxC, Farmside) › [WXC/VFX] Calls from invalid caller IDs, silence when answered

A1kmm

17 posts

Geek
Inactive user

#70767 30-Oct-2010 12:35

Hi all,

Has anyone else on VFX been having problems with incoming calls from unusual caller IDs, with silence when they are answered? I've had two in the last two days - Asterisk CDR records are included below (with my details obscured):

"","2012574201","994098XX","external-pstn-sip","2012574201","SIP/XnetVFX-00000034","SIP/office-phone-00000035","Dial","obscured","2010-10-29 03:16:34","2010-10-29 03:16:42","2010-10-29 03:16:48",14,6,"ANSWERED","DOCUMENTATION","1288322194.55",""
"","113","994098XX","external-pstn-sip","113","SIP/XnetVFX-00000037","SIP/walkaround-phone-00000039","Dial","obscured","2010-10-29 23:23:36","2010-10-29 23:23:48","2010-10-29 23:24:02",26,14,"ANSWERED","DOCUMENTATION","1288394616.58",""

The "113" caller ID is particularly unusual - is this a fault causing calls to be generated or the wrong caller ID to be sent, or telemarketers that have been able to get fake caller IDs into the network?

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#397715 30-Oct-2010 13:45

Odds are it's nothing at all to do with VFX but an inbound SIP connection to your Asterisk box. You should be able to see the full details of where it's coming from in the Asterisk log.

maverick

3594 posts

Uber Geek

Trusted

WorldxChange

#397744 30-Oct-2010 15:04

We see the 2012xxxx call but not the 113, most likely your device is open for external sources which is a big concern as if they can see your device and compromise it they would be able to use your device as a transit switch.

We do see some strange inbound ANI's and a lot seem to come from one particular NZ Telco which always seems to have this type of traffic, unfortunately we don't control the ANI when it comes from other NZ carriers, if you have the VFX advanced feature set you can set up selective call rejection and set up rules based on ANI and time periods

Yes I am a employee of WxC (My Profile) ... but I do have my own opinions as well

https://www.facebook.com/wxccommunications

bazzer

3438 posts

Uber Geek

Trusted

#397767 30-Oct-2010 16:34

02012574201 are the logmein123 scammers. See this thread: http://www.geekzone.co.nz/forums.asp?forumid=50&topicid=66095

A1kmm

17 posts

Geek
Inactive user

#397816 30-Oct-2010 19:07

I think the 113 call must have been from my Ekiga.net SIP registration - I've now adjusted it so people calling me from there get put into a different context, and have to enter a PIN to make the phone ring. That will also make it more obvious where someone is calling from, as the CDR logs should show the original context.

A1kmm

17 posts

Geek
Inactive user

#397820 30-Oct-2010 19:21

In case anyone is interested, this is how I set up my external context to allow phone numbers to be blocked:

[external-pstn-sip]
exten => _X.,1,GotoIf($[ "${DB_EXISTS(banned/${CALLERID(num)})}" = "1" ]?yourebanned)
exten => _X.,n,Dial(SIP/...&SIP/...&SIP/...&SIP/...&SIP/office-phone&SIP/walkaround-phone, 18, rxtk)
exten => _X.,n,VoiceMail(1@default,d(external-extension))
exten => _X.,n,Hangup()
exten => _X.,n(yourebanned),Answer()
exten => _X.,n,Playback(PhoneNumberBanned)
exten => _X.,n,Playback(PhoneNumberBanned)
exten => _X.,n,Playback(PhoneNumberBanned)
exten => _X.,n,Hangup()

It is now just a case of typing "database put banned 2012574201 1".
I also put the following in my internal context:
exten => 1481,1,Set(DB(banned/${CALLERID(num)})= 1)
exten => 1481,n,Playback(PhoneNumberJustBanned)
exten => 1481,n,Playback(PhoneNumberJustBanned)
exten => 1481,n,Playback(PhoneNumberJustBanned)
exten => 1481,n,Hangup()

So now if I get a telemarketer, I can say "Please hold while I transfer you", and then transfer them to 1481, which politely explains that we don't like telemarketers and that their caller ID has been permanently blocked.

A1kmm

17 posts

Geek
Inactive user

#399061 2-Nov-2010 12:31

It looks like I am still getting calls from VFX with unusual caller IDs - this time:
"","1153","9940XXXX","external-pstn-sip","1153","SIP/XnetVFX-00000043","SIP/...","2010-11-01 06:28:31",,"2010-11-01 06:28:49",18,0,"NO ANSWER","DOCUMENTATION","1288592911.70",""
"","1153","9940XXXX","external-pstn-sip","1153","SIP/XnetVFX-00000046","SIP/office-phone-00000047","Dial","...","2010-11-01 23:09:24","2010-11-01 23:09:28","2010-11-01 23:09:33",9,5,"ANSWERED","DOCUMENTATION","1288652964.73",""
(times are in UTC)

Note the "SIP/XnetVFX", meaning that they are being matched to my XnetVFX entry in sip.conf. My entry has:

[XnetVFX]
type=peer
...
host=pan.wxnz.net
...
insecure=port,invite

So an incoming INVITE doesn't have to be authenticated or match the port, but it does need to match the host. So there are really two possibilities - someone is spoofing the IP address of pan.wxnz.net to try to set up calls (possible but probably unlikely because it would take a lot of brute forcing to find people to call), or the calls came through pan.wxnz.net.

maverick: Could it be that the ANI and caller ID are different, and you aren't seeing the calls because you are looking for the call using the ANI, but I can only see the caller ID?

maverick

3594 posts

Uber Geek

Trusted

WorldxChange

#399067 2-Nov-2010 12:42

Just a note, it's not us that controls the CLI on the inbound side, we pass what is received, the 2 call ANI's you received is what was passed to us ,

The call you received has a incorrect CLI and the Caller ID and ANI are both the same, this call was handed to us from the Telecom network but could have come from anywhere, the sad fact is that a number of carriers out there do not enforce good CLI presentation, a couple in NZ are particularly bad at this i'm afraid

Yes I am a employee of WxC (My Profile) ... but I do have my own opinions as well

https://www.facebook.com/wxccommunications

Sharesies

Trade NZ and US shares and funds with Sharesies (affiliate link).

A1kmm

17 posts

Geek
Inactive user

#399139 2-Nov-2010 14:55

I've had 8 'silence on answer' calls in the last 6 days - all with faked or suppressed caller IDs, compared to maybe one or two a year at most on the same number previously - so it is a reasonable assumption that they are from the same person / organisation. I can block known bad caller IDs, but that is not useful if the caller can change their caller ID on a whim.

The caller is almost certainly breaking one or more laws - e.g. if they intend to disturb, annoy, or irritate me, they are breaking section 112(2) of the Telecommunications Act 2001:
"(2) Every person commits an offence who?
* (a) uses, or causes or permits to be used, any telephone device for the purpose of disturbing, annoying, or irritating any person, whether by calling up without speech or by wantonly or maliciously transmitting communications or sounds, with the intention of offending the recipient; or ..."
If they are trying to sell me something by using misleading conduct, they are breaching the Fair Trading Act. They might also be acting fraudulently under the Crimes Act if an ANI is considered a document and they are forging it with intent to gain a pecuniary interest.

Presumably Telecom can determine which carrier it came to them from, and by going back through the carriers the call can be traced back to the person who sent it - so it therefore seems like it is a question of whether these upstream carriers are motivated to do anything about it more than whether it is possible - and if Telecom doesn't help to track down the source, they are being complicit in the law-breaking and therefore also an accessory to it.

Is there any way to report this to Telecom so they will look into it? Does it need to come from Worldxchange, or from me directly?

Niel

3267 posts

Uber Geek

Trusted

#399288 2-Nov-2010 18:34

I believe if the number of calls are above a certain frequency then you can get the police involved. 8 calls in 6 days would probably do it, and you already have the call logs to prove it.

You can never have enough Volvos!