Orange Boxing / Caller ID Hacking FAQ

[an error occurred while processing this directive] [an error occurred while processing this directive]

Orange Boxing / Caller ID Hacking FAQ (Frequently Asked Questions)
by dethme0w / AOH Staff

This file originated at www.artofhacking.com.

Orange Boxing / Caller ID Hacking FAQ (Frequently Asked Questions) by dethme0w and AOH Staff Revision 2 - October 21, 2006 The current version of this file can always be found at http://www.artofhacking.com/files/ob-faq.htm . ------------------------------------------------------------------------- (0) About this FAQ Document The purpose of this document is to address as many of the questions we have received about Orange Boxing as we can (not just the most frequently asked ones!), so that hopefully we will not have to answer the same questions personally over and over and over... This FAQ should not be construed as a replacement manual for S.O.B., CIDMage, or any other Caller ID generator. Nor, in fact, should it be considered as containing useable legal advice. We are not lawyers, and while we may conceitedly think we understand a few things about telecommunicatons-related law, we still have to repeat that we are not lawyers. So, there you have it, we are not lawyers. Go see a real one if you are thinking of doing something with an Orange Box that you are not sure is legal. If you would like to add to this FAQ or correct any errors, please see our contact information at the end of the document. (1) What is an Orange Box? An Orange Box is defined as a device that emulates the Caller ID signal that is transmitted to a telephone line from its Central Office following the beep of an incoming Call Waiting call. Basically, it's a Call Waiting Caller ID spoofer. There are many ways to accomplish this, including something as simple as a tape recording of a real Call Waiting Caller ID signal, or a software program to generate the signal such as S.O.B., or even something as elaborate as a hardware device with a keypad and LCD display designed to generate the signal on a standalone basis. Although only the latter would be a proper Orange Box, we have yet to see any specimens and suspect that none may exist. (2) How do I use it? Since the Orange Box emulates Call Waiting Caller ID, it follows that it works best during a call that is already established. You call the number you are calling as you usually would, wait for someone (or something!) on the other end to answer, and then send the signal. In S.O.B., CIDPad and CIDMage this is done by simply clicking the Play button. When this is done, if all other factors are correct your falsified name and number (and even a falsified date and time, if you want) appear on the Caller ID box on the other end. (3) So does this mean I can totally hide my real Caller ID info and the person on the other end only sees the fake one? No. The Orange Box talks directly to the Caller ID box on the other end. It can only do this when the telephone company has an open connection between you and the other line, and this connection only exists after the call has been answered. Your real Caller ID information (or PRIVATE if you dialed with *67) would appear on the Caller ID box on the other end before they answer, and the fake info would appear after you send it, which can only be after they answer. (4) When do I send the signal? Any time *after* the call has been answered. Not before. Nothing in the phone system is listening for your signal until the phone company establishes an audio connection between your line and the far end, and that connection only exists after the call has been answered. (5) Isn't that kind of useless? The fact that spoofing can only occur on an open connection is the chief limitation of the Orange Box. However, while this limits the usefulness of the Orange Box, it does not eliminate it. No, you can't flawlessly spoof Caller ID from before they answer, and you can't replace the Caller ID signal generated by the telephone company with one of your own creation. But this only presents a problem if you are trying to call a live, human target on the intial call. If you call a fax line or a line on which the call is answered by an answering machine, then no one is likely to see the initial, real Caller ID data. If you call someone who has Call Waiting under a pretext, you may be able to convince them that your false Caller ID signal is a real incoming call, and then have an accomplice (someone with a different voice, for obvious reasons) proceed to converse under the identity of the spoofed data. (6) Can I use the Orange Box on a toll-free number? Yes and no. All toll free numbers have access to the real numbers that called them sooner or later. Residential and small business toll-free customers get a list of all incoming calls on their bill and this information would not agree with your faked Caller ID information. Such lines also may have Caller ID so as long as your spoofing needs are short term, this should not be a problem. However, larger companies (and they don't need to be major corporations anymore) have Real Time ANI (Automatic Number Identification), which is a service offered by the phone company that cannot be blocked by *67 or per-line Caller ID blocking because it is not Caller ID. The realtime ANI equipment gets its Caller ID data from a completely different channel than Caller ID and thus would never "hear" your faked signal, even if it were compatible (it isn't). (7) Can I use the Orange Box on calls to a Cellular Telephone? No. All cellular phones which have Caller ID get it through a separate digital channel. The cellphone doesn't listen for nor understand the landline-compatible Caller ID signals generated by the Orange Box, and even if you had a device that could generate a compatible Caller ID signal for cellphones, you as the caller would still not have access to that separate channel. (8) Can I use the Orange Box on calls from a Cellular Telephone? Maybe. The microphones in cellular phones aren't very good and the technique of playing a Caller ID signal through a microphone is fraught with pitfalls that cause distortion and result in a signal that is unusable before it ever hits the phone line. However, if your phone has a headset jack, with the right interface you might just be able to get a clean signal into the voice channel. Since it is the receiving end that has to have a compatible Caller ID box and not the transmitting end, it is possible in theory for any phone, cellular or landline, anywhere in the world, to transmit an Orange Box signal successfully. The critical factor is the presence of compatible receiving equipment on the far end. (9) Can I use the Orange Box on calls to the USA from [Insert Country Here]? Yes, if the line you are calling has a Call Waiting Caller ID device. As with calls from cell phones (see above), it doesn't matter what Caller ID system the originating phone line uses, since the Orange Box talks directly to the remote Caller ID device and not the phone system itself. (10) So can I use the Orange Box on calls to [Insert Country Here] from the USA? It depends on the country you are calling. If the line you are calling has a Call Waiting Caller ID box that is compatible with the Orange Box you are using, then the answer is yes. (11) What countries have phones that I can Orange Box? That, of course, depends on which country's Caller ID system your Orange Box was designed to work with. S.O.B., CIDPad and CIDMage were designed to work with North American (USA and Canada) Caller ID, which uses the Bell 202 FSK signaling system. This system is used in Australia, Canada, China (including Hong Kong), New Zealand, Singapore and the United States. Other countries use different standards, and may not be able to be Orange Boxed depending on whether those standards include Call Waiting Caller ID. All of the countries in this list that use the "Bellcore FSK" Caller ID specification potentially have customers with Caller ID boxes you can spoof with. The other countries use standards that may support spoofing using a device similar to an Orange Box but designed to spoof those standards instead of the Bellcore standard. If you live in a country not listed here and you know which Caller ID standard is used where you live, please Contact us so that we can update the list. Argentina --- ETSI FSK Australia --- Bellcore FSK Austria --- ETSI FSK Belgium --- ETSI DTMF Brazil --- ETSI DTMF Canada --- Bellcore FSK Chile --- ETSI FSK China --- ETSI DTMF (except Bellcore FSK in Hong Kong) Colombia --- ETSI FSK or Bellcore FSK depending on locale Czech Republic --- ETSI FSK Denmark --- ETSI DTMF (Modified) Ecuador --- ETSI FSK Egypt --- ETSI FSK or ETSI DTMF depending on switch France --- ETSI FSK Finland --- ETSI DTMF Germany --- ETSI FSK Greece --- ETSI FSK Hong Kong --- Bellcore FSK Iceland --- ETSI DTMF India --- ETSI DTMF Israel --- Bellcore FSK Italy --- ETSI FSK Japan --- NTT FSK (Japanese proprietary standard) Luxembourg --- ETSI FSK Mexico --- ETSI FSK or Bellcore FSK depending on locale Netherlands --- ETSI DTMF Norway --- ETSI FSK Oman --- ETSI DTMF Poland --- ETSI FSK or ETSI DTMF depending on local switch Portugal --- ETSI DTMF Romania --- ETSI FSK Russia --- MF(*) Saudi Arabia --- ETSI DTMF Singapore --- Bellcore FSK Slovenia --- ETSI FSK South Africa --- ETSI FSK Spain --- ETSI FSK Sweden --- ETSI DTMF Switzerland --- ETSI FSK Taiwan --- ETSI FSK, Modified ETSI DTMF depending on local switch Turkey --- ETSI FSK United Kingdom --- British Telecom proprietary FSK, ETSI FSK (CCA) United States --- Bellcore FSK Uruguay --- ETSI DTMF (*) Russia uses its own Caller ID signaling system which employs old- school MF signaling, with digits represented by combinations of the frequencies 700, 900, 1100, 1300, 1500 and 1700 Hz. (12) Do I need to have Caller ID myself to use an Orange Box? No, for the same reason that you can Orange Box from any line in any country or from a cellular telephone. (13) Does the person at the other end need to have Call Waiting? He does if you're using a technique that involves fooling him into thinking a Call Waiting Call is coming in. If he doesn't have Call Waiting, he may not even know what to do when he hears the fake Call Waiting beep. If you're calling a non-Call-Waiting customer, then you are probably going to have to send the signal immediately after answer and hope it fools him (or, hope that an answering machine or fax takes the call). In this case, the only requirement is that a Caller ID device that is compatible with Call Waiting Caller ID is present on the far end. The good news is that just about every Caller ID Box, Caller ID phone and answering machine on the market today supports Call Waiting Caller ID even if its owner doesn't have Call Waiting. (14) What about VOIP? Can I spoof Caller ID to a VOIP phone? That depends. If the VOIP phone you are calling gets its Caller ID information from a separate internet source, then it won't be listening for landline Caller ID. However, some VOIP terminals attempt to completely emulate a real phone line, allowing you to plug in a "normal" phone, answering machine and, yes, Caller ID box. The determining factor is whether there is a Call Waiting Caller ID box connected to the same line, whether it be VOIP or otherwise. (15) What is the best way to connect my Orange Box to the phone line? Use an FCC Part 68 Interface, or a tape recorder interface that allows playback into the line. These will give you a direct audio connection to the line that is free of outside noise and distortion. This is very important because Caller ID receiving devices have a fairly tight signal tolerance. And why not: the signal normally comes from the central office down the road, not from you across the country. Real Caller ID signals are of excellent quality and yours needs to be too. (16) What about just holding the speaker of my (PC/Hardware Orange Box/tape recorder) up to the handset of my phone? Won't that work? When we were developing CIDMage we tried a number of interfacing methods, and the one that was least satisfactory was the acoustic coupling method, or holding the phone's mouthpiece up to our PC speaker when we hit play. We were only able to successfully spoof that way one time in 20 tries, and that was with the Caller ID box in the same room, not miles away as would be the case in the real world. This problem is due to the inevitable distortion that results from playing a sound through crappy speakers into a much crappier mouthpiece through noisy air. It can't be helped that the signal that makes it to the line after going through all that no longer has enough signal quality to be understood at the far end. (17) I have an Orange Box (or Orange Box program like S.O.B.) connected to the phone line but I can't get my fake information to appear on the far end! Why not? Because of the signal quality requirements we mentioned above, even if you have a good clean line interface you may need to experiment until you have the right sound level before your Caller ID signal will get through. It's best to set this up with an assistant on the other end of the line, adjusting the volume of your Orange Box (or sound card) each time you try sending a signal, until your assistant sees a good fake number on his Caller ID box. You should do this until you can reliably send fake caller ID to your assistant before you attempt Orange Box use with a "live" target. It is also important to make sure that the other requirements for Orange Boxing are present: a Call Waiting Caller ID box on the other end, the timing of when you send your Caller ID Signal (after they answer!), and of course valid fake information prepared in your Orange Box. Caller ID spoofing programs normally will always generate a valid signal, computing the checksum and building the frame structure automatically, but it is possible to mis-adjust the program's settings so that it no longer generates a compatible signal. Consult the software docs for more about that. Lastly, it is very important to understand what Orange Boxing's limitations are. We are asked this question very often by would-be Orange Boxers who did not understand that you can't send the signal before the other end answers. If you're attempting Orange Boxing with the expectation that it is some kind of telephonic invisibility cloak that lets you be anyone with no effort, you're setting yourself up for disappointment. (18) I want to be able to enter a name longer than 15 characters, can I do that? The Telcordia specification for Caller ID allows no more than 15 characters for the name field of name-and-number Caller ID. CIDMage will allow you to enter longer names, and even to enter special characters that the remote Caller ID receiver might not be able to decipher. You can do these things to the number and date/time parameters too. However this functionality is intended strictly for experimentation and for learning the capabilities of your own Caller ID box. If you try to send a Caller ID signal that has been expanded beyond the limits of the Telcordia spec, different Caller ID devices will handle the signal differently: some will reject the entire call information and just display "Error"; others will truncate the name or number at the limit, others might even crash. But it wouldn't make sense to expect a Caller ID box that only has 15 characters for a name to be able to display more than that just because an off-spec signal came in. (19) Can an Orange Box fool an automated system that uses Caller ID for authentication? Possibly, yes. We ourselves once ran a system that may have been vulnerable to this (although no one ever, to our knowledge, attempted to attack it). Years ago, the AOH staff ran a dialup BBS which used Caller ID to decide how to handle certain callers. This was accomplished using a serial-port Caller ID box (a device which got Caller ID information from the line and sent it directly to the computer the BBS was running on) and a program we wrote called Caller ID Gestapo, which received the Caller ID data from the device and filtered that data against a set of rules to determine whether the caller should be allowed to logon or not. Although the initial data came in between the first and second rings of the incoming call, as is normally the case, the serial device was rather dumb, and would always send the computer whatever Caller ID information came in as it came in. Likewise, Gestapo didn't have a usable way to ascertain the line status, and so processed any Caller ID data as it came in, before or during a call. What this meant was that if a Caller ID spoofer had existed when we were using this arrangement, a fake Caller ID signal might possibly have been sent at the instant the BBS modem answered (and before the data carrier started!) that would have been processed by Gestapo which would in turn have overwritten its just-previously-written semaphore which instructed the BBS on how to deal with the call. Of course, this kind of system cannot be defeated with an Orange Box if the software makes the decision whether to answer the call at all or not, because if the call is not answered, no spoofing can occur. Our BBS and our use of Gestapo are long gone now, but there were likely many other automated systems (voice response, data lines, protected fax etc) that used a system with the same flaw as ours, and who knows, maybe some of them are still operating. We really don't know if this flaw is widely considered by designers of Caller ID authenticating systems. So the proper answer to this question probably should be "Yes, but your mileage may vary!" (20) Give me the technical goods. Exactly how does the Orange Box work? The best way to explain how an Orange Box spoofs Call Waiting Caller ID is to first explain how the phone company sends real Call Waiting Caller ID. There are a few differences between regular Caller ID and Call Waiting Caller ID. Most obvious is that regular Caller ID comes in before a call is answered, and Call Waiting Caller ID come in when Call Waiting is activated, which of course is always during an existing call. Before Call Waiting Caller ID, Call Waiting alerted the subscriber that another call was coming in by sounding a beep on the line. That beep is called the Subscriber Alert Signal or SAS. The SAS was (and still is) a 440 Hz tone that sounds for about 300 milliseconds. The subscriber would then "flash" over to the new incoming call, or ignore the SAS and let the caller hear only ringing. Call Waiting Caller ID works the same way, but immediately after the SAS tone is sounded, the phone company plays a CAS signal. CAS stands for CPE Alert Signal. CPE stands for Customer Premises Equipment. So the CAS is a Customer Premises Equipment Alert Signal, or for those of you who dislike acronyms, a special tone that wakes up the Caller ID box. The CAS is actually two frequencies played at the same time, they are 2130 and 2750 Hz played simultaneously for about 80 to 100 milliseconds. As soon as the Caller ID box detects the CAS, it cuts off the subscriber's phone (if it can - the phone has to be plugged in through the Caller ID box rather than plugged into another parallel jack for this to happen). The silence lasts just long enough so that the customer doesn't hear the Caller ID stream coming through, which sounds a little like a bird squawking but more annoying. After silencing the phone, the Caller ID box sends an ACK tone back to the phone company to indicate that it is ready to receive Caller ID. If the phone company doesn't get the ACK signal, it doesn't send a Caller ID signal. If it does get the ACK signal, then the Caller ID signal follows immediately after. The ACK signal is usually a DTMF "A" or "D", although some telephone companies may accept any DTMF (touch tone) digit. After this, the telephone company sends the Caller ID box a Caller ID signal, which is an FSK data stream. The exact format of this data stream is well covered in specifications and tutorials from numerous sources, a few of which are mentioned hear the end of this FAQ Document. There is a difference between this Caller ID Data Stream and the regular (non-Call Waiting) stream. In regular Caller ID, the data stream includes a series of sync pulses, which manifest as a bunch of ASCII U's at the beginning of the data stream. This has the equivalent function, in regular Caller ID, as the CAS tone you just read about - it alerts the Caller ID box that a signal is coming in. The U's are not present in Call Waiting Caller ID. After the FSK Data Stream has been sent to the Caller ID device, the phone is restored, the Caller ID box displays the number and name of the new incoming call, and the customer has the same option to flash over to the new call as he would have had if the call had not included Caller ID. None of these tones are audible to the first calling party, because the telephone company also mutes the audio to the other end during this exchange. Fortunately, this muting doesn't happen during Orange Boxing, since the telephone company is not listening for SAS or CAS like the Caller ID box is, nor is it listening for the unprompted ACKs that Orange Boxing would generate. The Orange Box works by generating the SAS and CAS signals. It then waits briefly for the Caller ID box to send its ACK but is not listening for the ACK, it just pauses. Then it sends either a manufactured facsimile of a Caller ID data stream, or a recording of a real "live" Caller ID data stream. If successful, the Caller ID box will detect the CAS, send the ACK, receive the spoofed Caller ID Data Stream, and display it for the subscriber as if it were a real incoming new call. (21) Is Orange Boxing legal? That depends entirely on why you are doing it. Orange Boxing is probably completely legal for joke/gag purposes. Also, if you're a telemarketer you are probably aware of new telemarketing regulations that require you to transmit valid Caller ID that indicates a real phone number where the called party can reach your company. These regulations aren't specific on whether that Caller ID must come before the call is answered or if afterwards is OK. If you are doing telemarketing from home and don't want to give out your home phone number to everyone you call, then the Orange Box may allow you to comply with these regulations by letting you spoof your own company's toll free number. However, if you are planning to use an Orange Box to deceive or harass someone, then perhaps it is for the best that its limitations make it least useful for these highly illegal and unethical purposes. We are not lawyers - ask one before you try doing something you think might be illegal. (22) There *must* be a way to completely spoof an incoming phone call, with Caller ID between rings and all, isn't there? There is, but it is not suitable for most people. The Vermilion Box is an encapsulation of several techniques that involves getting physical access to the target line, disconnecting it from the telephone company network, and then reconnecting it to a line emulator that powers the phones, rings the ringers, and sends a fake Caller ID message between rings. When the called party answers this "call", he or she has seen only your faked Caller ID before answering. This technique has numerous possible complications but is not completely infeasible. For more information, read about the Vermilion Box at http://www.artofhacking.com/files/vermbox.htm . (23) But I heard about a device used by the FBI that can fake Caller ID before answering! Why can't the Orange Box do this? Occasionally, we have heard the claim of the existence of a small device that plugs into your wall jack, allows you to enter a phone number, and then causes that number to be displayed before answer, on the Caller ID device of any number you call. This device is supposedly only sold to law enforcement agencies and works by sending a special tone sequence to the phone network before or during dialing. This claim gets posted to phreaking newsgroups and chat rooms from time to time but no one has ever produced a working web link or literature citation to back it up. If we ever find solid evidence of the existence of this device, the following version of this FAQ document will be updated with what we know. (24) What Orange Boxing programs are out there? CIDSIM was written for DOS and the PC Speaker way back in 1994 and as such never really worked as anything more than a demo of what the data stream sounds like. A somewhat updated 2001 version of it is still available, along with a few other wacky DOS-era tone toys for the obsessively curious, at http://artofhacking.com/files/index.htm , but expect nothing and you won't be disappointed. S.O.B. was the first successful Orange Box program. It's sort of our seminal work on home-rolled Caller ID, but it is no longer actively developed. It is still available to download at http://artofhacking.com/orange.htm . Spoob followed soon after, and is open source but works best on Linux. Its Perl source can be found at http://lab.digitol.net/code/spoob.pl . The commercial programs CIDPad and CIDMage are lightweight and full-featured Caller ID signal generators, respectively. Each one can perform all the functions of a proper Orange Box, and both have additional capabilities (CIDMage has many more capabilities). Look for more information and downloadable trials at http://codegods.net/cidmage . (25) What other methods are available to defeat or spoof Caller ID? Aside from Orange Boxing, there are two methods that can be used to spoof Caller ID: The first is - use a PRI ISDN line. You probably don't have one of these in your house as this kind of line is used to connect the many phones of a large corporation's PBX to the greater phone network. But the PBX attached to this line has the capability of assigning any number you want to the outgoing caller ID of any phone attached to it. If you work at such a business, you might be in luck. See Lucky225's article in 2600 magazine, Spring 2003. The other method is to procure an ANI failure when making a call. For local calls this is mindblowingly unlikely to happen accidentally, but there are ways of deliberately procuring ANI failures. Once you have an ANI failure, your ANI will not be transmitted to the destination line, even if it is a toll free line with realtime ANI. Now, if you can get an ANI failure on your way to calling an operator who can complete the call for you (Lucky225 described a method that was reliable for a while of getting this to happen with Telus operators) then the operator will ask for your number, you can answer with whatever number you like, and it will appear on the target's Caller ID receiver. This technique is sometimes called Op-Diverting. In addition to these, several of the methods of defeating Caller ID (without spoofing a fabricated one) in Fixer's Beating Caller ID text file still work today. (26) Where can I find more information about Caller ID and Orange Boxing? http://www.ainslie.org.uk/callerid/cli_faq.htm Alastair Ainslie's Caller ID FAQ. This is probably the most complete reference on Caller ID available as it is the only one we have seen that attempts to cover all the Caller ID standards of the world. http://mirror.lcs.mit.edu/telecom-archives/archives/caller-id/bellcore.specs A list of Bellcore specifications on Caller ID. May be incomplete. http://mirror.lcs.mit.edu/telecom-archives/archives/caller-id/specifications The basic SDMF specification. http://www.verizonfears.com Lucky225's site. Includes a brief on Orange Boxing and some other techniques (of varying difficulty and practicality) for spoofing Caller ID. http://www.artofhacking.com/files/BEATCID.HTM Fixer's Beating Caller ID FAQ was first written in 1998 and has been updated little since then, but contains a description of the technical spec for Caller ID and some ways that may or may not work today, to defeat it. http://www.artofhacking.com/boxrvw.htm Fixer's Coloured Box Review includes descriptions of every known Caller ID related phreaking device, among many others. ------------------------------------------------------------------------- The Orange Boxing / Caller ID Hacking FAQ has been provided as a public service by the staff of artofhacking.com . Please do not modify this document and repost it. If you wish to make additions or corrections, please email your contribution to dethmeow@artofhacking.com . Your contribution will be included and gratefully acknowledged in the next release of the FAQ. This is a copyrighted document and must not be modified or redistributed in any way not explicitly permitted here. You are permitted to post this FAQ on any free public website (with or without advertising) as long as a link to http://artofhacking.com is placed in close proximity to and in equal prominence to the link to this document, and as long as the FAQ is not modified in any way. We reserve the exclusive right to publish this document on paid electronic or tangible media. You may contact us by email at webmaster@artofhacking.com, or by snailmail at: Whirlwind Software PO Box 8619 Victoria BC V8W 3S2 Canada © 2006 Whirlwind Software. All Rights Reserved.

[an error occurred while processing this directive]