Chunyi Peng

Combating Caller ID Spoofing on 4G Mobile Phones

 

Caller ID spoofing forges the authentic caller identity, thus making the call appear to originate from another user. This seemingly simple attack technique has been used in the growing telephony frauds and scam calls, resulting in substantial monetary loss and victim complaints. Unfortunately, caller ID spoofing is easy to launch, yet hard to defend; no effective and practical defense solutions are in place to date.

CEIVE (Callee-only inference and verification) is an effective and practical defense against caller ID spoofing. It is a victim callee only solution without requiring additional infrastructure support or changes on telephony systems. We formulate the design as an inference and verification problem. Given an incoming call, CEIVE leverages a callback session and its associated call signaling observed at the phone to infer the call state of the other party. It further compares with the anticipated call state, thus quickly verifying whether the incoming call comes from the originating number. We exploit the standardized call signaling messages to extract useful features, and devise call-specific verification and learning to handle diversity and extensibility. We implement CEIVE on rooted Android phones and test it with all top four US mobile carriers, one landline and two small carriers. It shows 100% accuracy in almost all tested spoofing scenarios except one special, targeted attack case.

On the Media inverse.com

Watch our CEIVE demo against “Consulate Phone Scam”

Scam calls from Chinese consulate have been repeatedly report in recent news and alerts (e.g., FTC, China-embassy, FCC, NBC, Washington Post, CBS, NPR, WNYC, XinhuaNet ). One victim in San Francisco even lost $3M ([https:goo.gl/pJYFNM SFgate).

Here is our CEIVE demo which successfully detects this spoofing (Done on August 15, 2018).

Watch our 1-min Video for MobiCom’18

Publications