Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

New Google Service Manipulates Caller-ID For Free

Posted by kdawson on Sat Nov 18, 2006 07:31 PM
from the party-to-whom-you-are-speaking dept.
Businesses Google The Internet
Lauren Weinstein writes to raise an alarm about a new Google service, Click-to-Call. As he describes it, the service seems ripe for abuse of several kinds. One red flag is that Google falsifies the caller-ID of calls it originates for the service. From the article: "Up to now, the typical available avenue for manipulating caller-ID has been pay services that tended to limit the potential for large-scale abuse since users are charged for access. Google, by providing a free service that will place calls and manipulate caller-ID, vastly increases the scope of the problem. Scale matters."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

New Google Service Manipulates Caller-ID For Free 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Uh... (Score:5, Informative)

    by nmb3000 (741169) <nmb3000@that-google-mail-site.com> on Saturday November 18 2006, @07:34PM (#16900626) Homepage Journal
    Not exactly new... [slashdot.org].
  • Finally, technology that gives power back to the teenage prankster. Now "Hey, did you know your refridgerator is running?" calls will be answered with "Yes Mr. President, I did ... Oh, and by the way, your voice sounds so much younger in person" instead of "Johnny, please hangup the phone before I tell your mother".

  • Deserves attention, but not a very hard problem. (Score:5, Insightful)

    by glasn0st (564873) * on Saturday November 18 2006, @07:35PM (#16900636) Homepage
    Scale matters. But control matters too. This is not like the spam problem where the cooperation of thousands of entities with different motives would be necessary to prevent abuse. The service is controlled by a single party that can make changes easily.

    It would be very easy for Google to implement a verification mechanism. An automated system could simply ring any added Caller ID number and verbally present a verification code (or ask for a response). If a user can answer a certain number, it's not unreasonable to assume that they could also originate regular calls from that number. In the worst case, it still ties the user to an organization or physical location.

    I agree with Weinstein that verification really should be a standard feature. Whoever runs even a simple mailinglist without user verification is considered a spammer these days; the ideas are not new. So it's fair to expect Google to carry out this verification.

    However, Google is known for technological innovation so I'm not turning off my phone just yet. They'll probably fix it. Of course, a little public attention may help if they seem unresponsive.
    • Personally, I think the verification portion should NEVER call the phone.
      However, after telling google you want to use a certain phone, you must dial a number displayed on screen to confirm - it doesn't have to be connected, simply ringing will be enough of a verification and should not cost any money.

    • The service is controlled by a single party that can make changes easily.

      It would be very easy for Google to implement a verification mechanism.

      I thought for a second that you were making sense. Google isn't the issue, the caller-id/phone system is crap.

      it would be a huge improvement for the Phone system to at least be reliable to the same country of origin, but that would hurt the telemarketers, the phone companies won't do that...

      If the DMA, etc wants to ever do business with me over the phone again, the

    • Google is NOT the problem.

      The problem is NOT that Google is letting you fake CallerID - it's that CallerID is trusted by anybody, when the telcos don't care a lick about securing it. (There are dozens of for-pay but cheap services to alter your callerID...) I'd even accept a nontechnological solution involving it being both criminally and civilly illegal for you to spoof it. But that clearly doesn't exist, either.

      If anything I hope this abuse gets really widespread and callerID gets dropped as a trustwor

  • This is stupid. It's not an issue. (Score:5, Insightful)

    by NineNine (235196) on Saturday November 18 2006, @07:36PM (#16900652) Homepage
    This is stupid. It's a non-issue. The advertiser has to opt-in. Hell, I'm guessing that the advertiser is going to have to pay for it (it's part of AdWords). If the advertiser chooses to try it, and gets too much crap, the advertiser can stop it.

    As a business owner, if I used AdWords (I don't... too much click fraud), I'd try it, because any way that customers can contact you easier is generally good. But if it gets abused by a bunch of 12 year old's, I'd cut it in a heartbeat.
    • It's not opt-in anymore. Take a look at maps.google.com - search for a business and they'll ALL have the click-to-call thingy on them.
      • I see. My biz is in there, too. Hmm... Well, I think that this has the potential to be real problems for people who have their toll-free numbers listed in Google (luckily, only our local number is in there).

        I don't know how many people will use this. It seems like it's *only* going to be used by people that want to call completely anonymously and people who want to call you long-distance for free. I think that even the laziest person in the world wouldn't find pressing buttons on a telephone to be too

    • Re:This is stupid. It's not an issue. (Score:5, Insightful)

      by lenroc (632180) on Saturday November 18 2006, @07:59PM (#16900798)

      However, the problem the blogger is concerned about is not the abuse you're thinking of. The problem is that a nefarious user could put click the "Call" link on a Business listing, but put in someone else's phone number. The "Caller-ID spoofing" part comes in here: Google's service calls the phone number entered, but the Caller-ID shows the number of the business that the "attacker" chose.

      If, when the person picks up the phone, they are immediately connected to the business, they would assume that the business called them. The blogger is apparently envisioning something of a "Joe job" [wikipedia.org] style attack.

      However, this is easily protected against. Instead of connecting to the business directly, all Google has to do is play a recording along the lines of: "This is Google, calling since you entered your phone number on the "Click to Call" service, please press 1 to connect to the business you selected. If you did not initiate this, please hang up or press 2 to disable this service for this phone number."

  • Caller ID is broken in the same way SMTP is broken (Score:4, Informative)

    by CerebusUS (21051) on Saturday November 18 2006, @07:41PM (#16900682)
    Much like SMTP relies on the sending email client/server to not lie about the originators email address, Caller ID relies on the PBX originating the call to set the caller ID value. There's no other way for the phone system to be able to deliver the correct direct-dial extension, only the PBX truly knows what the extension is, the phone company only knows the trunk id that the call comes from. As long as that's the case, there will never be a way to ensure that the originating PBX is telling the truth. DID ranges are (for the most part) not tied directly to outgoing phone lines, so they can't even be verified against those.

    • Re:Caller ID is broken in the same way SMTP is bro (Score:5, Insightful)

      by XorNand (517466) * on Saturday November 18 2006, @07:59PM (#16900792)
      Comparing CallerID to SMTP is a pretty good analogy. However I don't agree that either of them are "broken". Neither of the two were designed with authentication in mind, nor were they ever advertised as a means of security. Before CID, you had to actually answer the phone to see who was on the other end. CID was introduced as a conveniance feature, not a security feature. It's people's expectations that are broken, not the technologies.

      • Re: (Score:3, Informative)

        by CerebusUS (21051)
        I agree with you that it's going to be a question of scale, but the dividing line may be lower than you think. I work in a company of only 25 and we've got Caller ID configured to push the extension the call was made from. While restaraunts and offices small enough not to need a "true pbx" solution don't get the opportunity to configure their caller ID, the barrier to entry if you _wanted_ to push caller ID on your own is very low. Even lower with roll-your-own solutions such as Asterix@home being so eas

  • Heh... (Score:4, Interesting)

    by setirw (854029) on Saturday November 18 2006, @07:42PM (#16900692) Homepage
    ...by that logic, we ought to outlaw SMTP servers, since one can falsify email headers there more easily than this system allows the falsification of caller-id data...

  • Star-Eight-Six (Score:4, Informative)

    by vmfedor (586158) on Saturday November 18 2006, @07:49PM (#16900738)
    Although the potential for fraud is there, we can already block caller ID with star-eighty-six and nobody seems to be abusing that too much. Just like anything else you'll get a few jokers but I doubt anyone will start "bringing down" businesses using click-to-call.

    Google ambiguously states that Google "takes fraud and spamming very seriously. We use technical methods to prevent future prank calls from the same user within a reasonable period of time. You won't be charged for any such calls." Seems to me that they at least recognize the potential for a problem and at least have some sort of plan for how to handle it.

    All-in-all, though, this seems like a pretty lame idea.

    • Re: (Score:3, Informative)

      by TubeSteak (669689)
      Although the potential for fraud is there, we can already block caller ID with star-eighty-six and nobody seems to be abusing that too much.
      IIRC, *86 (or *67) does not actually block your Caller ID, it just tells the other phone to ignore the information.

      It won't work on 911 or 1-800 & 1-900 (because they're collect) calls.
      My memory is a bit fuzzy, but I don't think I'm wrong.

      • Re: (Score:2, Informative)

        by PayPaI (733999)
        You are (sortof) wrong. 911,800#,900# don't use CID. I've covered this before [slashdot.org] Relevant wikipedia article [wikipedia.org]

      • Re: (Score:3, Informative)

        by phliar (87116)

        IIRC, *86 (or *67) does not actually block your Caller ID, it just tells the other phone to ignore the information.

        You do not remember correctly. You are thinking of ANI (Automatic Number Identification). If you call a toll-free number, the business always gets your "ANI" number, since they're paying for the call. "Caller ID" (more correctly called "Calling Line ID or CLID) is different, and is blocked with *86 [whatever the correct code is]. ANI and CLID are different fields in the phone signalling me

      • It specifically sets a private flag. The number is still sent over the telephone network, but the origination switch shouldn't (and usually doesn't) send the number to the customer.

        At least one system I have used would transmit Private to the customer's equipment yet still display the calling party's number on the bill.

  • ANI (Score:2, Interesting)

    by DNS-and-BIND (461968)
    CallerID? Weak. Can you set your own ANI? Now THAT'S cloaking.

    • Re: (Score:3, Informative)

      by evilbuny (553280)
      Yes you can fake ANI, you just need an account with a VSP and off you go... all it costs is 1 to 2 c per minute usually...

  • Probably a non-issue, practicaly speaking (Score:3, Interesting)

    by 93 Escort Wagon (326346) on Saturday November 18 2006, @07:59PM (#16900794)
    I can see Weinstein's point, although I don't see that it matters much from a practical point of view (unless I'm missing something here). When I look at the Caller ID information on an incoming call, it's more of a whitelist situation - I let the machine get it unless it's one of a few numbers (family, friends). So whether the Caller ID information is valid or not, I'm not going to be answering the phone. Weinstein seems to be looking at it from a blacklist perspective, which I doubt is how most people use their Caller ID.

    • I doubt a whitelist would work for a company that may get hundreds, or thousands of calls each day. As I see it the whole idea of this service is that you can attract new customers by letting them contact a company after they have searched for something at Google, not to offer a way for existing customers to phone.

      I think it could be a really valuable service. I know if I see something I want to buy very often I think it would be great to contact the company and ask questions, but I can't be bothered making
  • and thinking, wtf can I possibly do- OTHER than have businesses connected to an enemy/friend I want to prank a few times.

    the manipulation is ENTIRELY going into MY phone, if I use the service.

    I canNOT use it to falsify my Caller ID info going to the business.

    WHAT ALARMING potential does this possibly have? I see naught... can anyone identify a situation where using this service can let me 'get away with something' more intense than a prince albert in a can call?

      • I use this service,
        I tell google, I wanna speak with toll free information (800) 555-1212

        I select the # for toll free information and type in MY phone number,

        my phone begins to ring, the caller id on my phone says the # calling me is (800) 555-1212

        I answer the phone, and a few momments later I am connected to information.

        where's the potential to misuse?

  • This service can not be abused in the way that you would think. Think about it, even if you can forge the caller-id, the google service calls YOU, and connects you to the number that the caller-id is spoofing. All you would end up being able to do is have the local police station number call a local drug dealer. When they answer, it will ring and call the police station. If you pick up the phone and get a ring, what are you going to do. I know that I am going to hang up unless I am expecting it.
  • This is really a non-issue.

    I guess a different form of abuse would be to register a friend as a business and then you have free calls to him, although depending on the description he might get a lot of wrong calls by others finding his listing on google maps.

    Also something I never heard about is google providing free sms.

    http://maps.google.com/support/bin/answer.py?answe r=32461&query=send+to+phone&topic=&type= [google.com]

    And they provide a firefox plugin so you can highlight text and send that.

    http://www.g [google.com]
  • Considering this is for calling selected BUSINESSES only, I have no problem with this. In many states, it is ILLEGAL for businesses to have caller ID. For those that do not, this is a way one can call a business (to reply to an advertisement) anonymously, without providing a name. I find this a good, pro-consumer approach.
    • I believe it's possible- but do you have a cite for In many states, it is ILLEGAL for businesses to have caller ID. further, if google can make the caller ID into you look like the business #, what makes you think they can't make the caller ID to the busness be your phone #??

    • In many states, it is ILLEGAL for businesses to have caller ID.

      I don't know of any state in which that is true. And it seems extremely unlikely ... remember how T-Mobile voicemail boxes could be hacked because the default was to allow access without a password if your Caller ID matched the account's phone number? How could T-Mobile even offer such a service if they were forbidden to have Caller ID in certain states?

      Perhaps you're thinking of the fact that telemarketers are forbidden to block Caller ID

  • I'd say the best case for abuse would be not towards the business being called but the person who's number you use. Seems it'd be easy to make a google hack that could pretty much disable somebody's phone by issuing click-to-call's every 2 minutes or so. Imagine a friday night out with your girlfriend and every 2 minutes a different strip club starts ringing your phone?
  • There may be some reason for concern here, but not the type of fear mongering the above summary would seem to suggest. There is potential for abuse by someone entering your phone number and connecting you to the advertiser by phone. But nowhere on the Click-to-Call service page does it allow any sort of caller-ID spoofing. You can't just use it as a VOIP portal and call anyone you want. In fact, Caller ID is blocked even to the advertiser you are connecting to. Just read the details, it's all there.

  • Did anyone follow the damned link? (Score:3, Informative)

    by Lord Kano (13027) on Sunday November 19 2006, @02:14AM (#16902450) Homepage Journal
    This is from Google's FAQ...

    • What is this click-to-call feature? How does it work?

      Google is testing a new feature that lets you speak directly over the phone, for free, to businesses you find on Google search results pages. When this feature is available for a business, you'll see a green phone icon in their advertisement or a call link next to their contact information.

      Here's how it works: Click the phone icon or call link, and you'll be invited to enter your own phone number into a special field. When you do so and then click Connect for free, Google will call your number almost immediately. Pick up, and you'll hear ringing on the other end as Google connects you to the business you selected. When they answer, you simply talk normally as you would with any other call.


    This isn't for prank calls. It's only use is to keep businesses from using their caller-id to amass a list of telephone numbers. They could arguably claim that the "do not call list" doesn't apply because they'd be returning calls to people who have called them.

    It can help businesses too. If you're too small of an operation to afford a toll free number, you can have your customers call you for free and place orders from you.

    There's no down-side to this.

    LK
  • The click to call actually calls you - so if you enter a fake number... your not going to be connected to who you call. So if somebody connected your phone to some sex line... you would see the sex line number and could ignore it. This could be used to annoy but nothing more than current telemarketers. Oh and its free. This is a great service and Lauren needs to re read how to use the service.

    How intelligent.

    • Re:How pissed would the... (Score:4, Insightful)

      by Anonymous Coward on Saturday November 18 2006, @08:01PM (#16900810)
      How pleased would the rest of us be if people would refrain from splitting the first sentence of their post between the subject line and the comment box?

      • Re:How pissed would the... (Score:5, Insightful)

        by CastrTroy (595695) on Saturday November 18 2006, @09:30PM (#16901268) Homepage
        Yes, that's for sure. We shouldn't even have subjects, the subject is the article. People most of the time end up doing stupid things like splitting the post between the subject and the comment, or leaving it as "Re: Subject that doesn't make sense" Because the subject refers to something 3 levels up and the subject has changed by this point. Nobody reads subjects, and hardly anybody puts in a useful subject anyway. It's nice for email, because you can scan your messages and tell which message is about what, but when you're reading posts, it's not worth your time to read all those subjects because 98% of them are Re......
      • Well I think it's even more annoying...

        • Re: (Score:2, Informative)

          by Paradise Pete (33184)
          Otherwise it looks like you said it twice and that's just as annoying.

          Only if you begin by reading the subject line. Otherwise it's just confusing. Do you really read the subject line of the posts before you read them?

          • Do you really read the subject line of the posts before you read them?

            Do you really read the posts? I only read his post to see what the rest of the sentence was. Otherwise, the subject lines are enough for me, like the summaries.

            Or are you implying that you read the articles as well?

            • Re: (Score:2, Informative)

              by Ankur Dave (929048)
              Not to be rude, but it's also annoying when people reply to a short parent and quote part of that parent. That messes up the experimental discussion system, where the first line of each message is shown as a preview.
              • "it's also annoying when people reply to a short parent and quote part of that parent."

                i disagree. Many times the parent post is below the rating threshold so the post isn't displayed. Without the quote I wouldn't know what the person is talking about without clicking on every post to display it.

                • Re:How pissed would the... (Score:5, Insightful)

                  by LordKronos (470910) on Sunday November 19 2006, @10:28AM (#16904198) Homepage
                  I agree with both of you. It is annoying that it screws up the 1st-sentence-preview of the experimental forum, but it's also annoying when you don't have the context.

                  The obvious solution, of course, is for slashdot to add an official method of quoting (rather than right now, where some people italicize, some prefix with >, some put it in quotation marks, and some just paste the text normally) and then have the experimental forum display the first line of non-quoted text.
    • Don't underestimate the utility factor.. A very long time ago I worked for a hardware store. After business hours, the policy was to not answer the phone..

      But when the damn thing wouldn't stop ringing, I'd use another line, ring the pizza place, and conference the lines when the pizza place picked up.

      Half the time the person trying to call us ordered a pizza. The other half the time, whomever calling us took out their rage on the poor pizza guy and demanded to know the number to the hardware store.

      And you'd

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.