asterisk users - May 2008 - [asterisk-biz] ANI

Bill Michaelson wrote:
> Alex Balashov wrote:
>> Steve Totaro wrote:
>>
>>   
>>> This make more sense:
>>> Open WiFi AP (or cracked WEP)  ---->  hacked Asterisk box (who
sets the
>>> CID/ANI ----> Telco  ------>  terminated to the PSTN
>>>     
>>
>> Well, sure, but you can do far worse things than spoof ANI/CID with
that
>> kind of mischief.  The sort of things generated in the scenario you 
>> described are hard to track down whether they're telephony-related
or not.
>>
>>   
> Precisely right, and in the general case, it seems that the essential 
> problem is the lack of general awareness that certain forms of 
> identification are unreliable.  Thus the perceived need to clear the 
> innocent.  And also, perhaps, the reason for excessive apathy about 
> the (general) problem in many corners.
>
> Referring back to my earlier suggestion about public key 
> authentication, a more widespread appreciation and understanding of 
> it's applicability in various realms would go a long way toward 
> helping solve many problems ranging from spam and phishing to stuff 
> like this.  It's a mind-share/social problem.  There is nothing 
> inherently wrong with spoofing; the problems arise when the receiver 
> is unduly deceived.
>
I motion that this thread be moved to the Asterisk Users (already copied 
to Users List)

For those that do not subscribe to the Biz list, this thread may be 
interesting to you.  
http://lists.digium.com/pipermail/asterisk-biz/2008-May/subject.html

I am done giving examples of what could be done as far as current 
exploits.  The purpose was to clue some people into what can actually be 
done that could cause *real harm*.

I would like to see what Bill and others can offer as solutions.  This 
particular issue could result in many forms of real harm and is worth 
more discussion.

*Maybe the "Asterisk Community" can do more than talk about Asterisk.
We are numerous, smart, and many are influential or have influential 
contacts.*

Thanks,
Steve Totaro

Regulation, laws, and controls are NOT the answer.  I like the freedom I
am entitled to, even with the Patriot Act. It will be a sad, sad day
when all thoughts, conversations, and transactions are logged and once
logged can be a form of control rather than a form of safety.

On Tue, May 13, 2008 at 9:57 PM, Alexander Lopez <Alex.Lopez at opsys.com>
wrote:
> Regulation, laws, and controls are NOT the answer.  I like the freedom I
>  am entitled to, even with the Patriot Act. It will be a sad, sad day
>  when all thoughts, conversations, and transactions are logged and once
>  logged can be a form of control rather than a form of safety.
>
We are closer to that sad day than you know.  Approaching or already
past the tipping point.

Thanks,
Steve Totaro