TransNexus Blog

We have a lot of progress under the form of STIR/SHAKEN. Now it doesn't prevent all types of spoofing but it makes the calls traceable back to the originating carrier.

What happens is scammers get numbers with small carriers who interconnect with major ones. Eventually the reputable carriers notice spam from these smaller carriers and start dropping their calls (or banning them altogether). So the smaller carriers decide whether they want to see their legitimate traffic dropped or just ban the offending users (which is eventually what ends up happening). Scammers end up hopping to a different carrier so it's a cat-and-mouse game, but it's a lot more expensive to play now than it was with simple number spoofing.

In parallel, numbers are starting to get reputations attached to them, similar to IP addresses. Some filtering takes advantage of that.

Of course, spearfishing can continue unimpeded with someone buying a prepaid cell phone and using that to call a specific target. :(

https://transnexus.com/whitepapers/understanding-stir-shaken/

I hope this addresses the abuse.

See [1]

It basically asks the telecom operators to implement
digitally signed certificates.

So it would work, if I understand it conceptually, like your web browser, when it receives https traffic unsigned certificate, or https traffic from a domain that's not part of the certificate chain.

Therefore, this mandate will prevent 'spoofing'.
And without spoofing, the spammers would necessarely have
to reveal their identity, and there are already bunch of
existing legislation to prevent them from doing this type of business.

I missed important business calls when in US. Because they were calling using same area code where my sim card was registered, so I thought it was from the area local to me.

It is horrible, I am sure people actually lost not just business value, but also had negative health impacting incidents, due to this abuse of telecommunications.

[1] https://transnexus.com/whitepapers/understanding-stir-shaken/

At best, they could require the U.S. to implement STIR/SHAKEN [1], maybe. There will be significant technical and legal challenges in this. Overhauling or upgrading the existing switches is non trivial. This is just my opinion, but I predict this will result in legal battles and legal stalling on the part of the telcos. Even if all the telcos agreed to do this, there would be a period of time that nothing is enforced and even then, this has no impact on anyone outside of U.S. jurisdiction unless laws with teeth require amended agreements between the U.S. and non-U.S. telcos. I am not a lawyer, but I don't need to be one to see some of the ways this will play out and how this can turn into political posturing, deflection of responsibility and saber rattling between the U.S. and other countries.

[1] - https://transnexus.com/whitepapers/stir-and-shaken-overview/

There's not much you as an individual can do to stop it. I have the same issue with Comcast filling my PO Box with shitloads of junkmail.

The phone system is designed to accept anyone calling on it, and there's no authentication mechanisms in place for securing it since it all has to interoperate and is built on dated standards.

There are basically two solutions to stopping the problem (instead of treating the symptom). The first is to increase costs to make phone calls (voip made this basically free and it gets abused). This was the old deterrant.

The other is to have providers work on an authentication method for their network, they are starting to do this with STIR/SHAKEN: https://transnexus.com/whitepapers/stir-and-shaken-overview/

Legislation won't help unless it is on the providers to require authentication.

> a technology designed to prevent robocalls altogether, recommended in a report more than a year ago and currently set to be implemented in Canada in 2019, has no such date here in the States.

What’s the technology?

Edit: https://transnexus.com/solutions/stir-and-shaken/stir-and-shaken-overview

”STIR and SHAKEN use digital certificates, based on common public key cryptography techniques, to ensure the calling number of a telephone call is secure. Each telephone service provider obtains their digital certificate from a certificate authority who is a trusted authority. The certificate technology enables the called party to verify that the calling number is accurate and has not been spoofed.”

We're still very early in the process.

1) Deploy caller ID signing. <--We are here.

2) Deploy policies to make inter-telco tracebacks easier and increase liability for carrying too much spam.

3) Drop unsigned traffic and shutdown spam friendly portions of the PSTN (analogous to open email relays).

4) Use the tracebacks and KYC to deter robocalling operations from getting onboarded and ban current customers who are robocalling. And keep them banned when they open new sockpuppet accounts. It'll never be completely eliminated.

5) See 4.

Two-thirds of PSTN traffic is unsigned.
https://transnexus.com/blog/2023/shaken-statistics-july/