Legacy Telecom Infrastructure

The challenge of retrofitting security into a 100+ year-old international telephony system built on trust, legacy technology, and legal agreements that resist modernization.

← Back to The Australian Government to Require SMS/MMS Sender ID Registraion

The global telephony system remains vulnerable to caller ID spoofing because it was originally built on a foundation of "gentlemen’s agreements" between trusted national entities that saw little need for security controls. This culture of inherent trust was later reinforced by the rise of outsourced call centers, which required the ability to display local numbers for legitimate business purposes, effectively institutionalizing the practice of faking identity. Consequently, modernizing the network is a massive undertaking, as engineers must navigate over a century of legacy technology and rigid legal frameworks that grandfathered in these insecure practices long before modern verification standards existed.

3 comments tagged with this topic

View on HN · Topics
I've yet to read a good explanation of why the telcos permit CLID faking and reinjection of apparently local CLID by overseas inputs. I'm assuming there's a technical and/or willpower reason or some counterfactual like VOIP depends on it. Even just flagging it would help. Or, rejecting numbers they can know lie inside their own routing architecture, or asserts within their own number plan where the CLID does not match. Morally it's like BCP38 in the customer facing internet systems: reject customer input they don't pay you to assert.
View on HN · Topics
I used to work at two (UK) telcos. There's a historic reason and a modern reason. The historic reason was, just like the Internet, the international phone network was built on gentlemen agreements by engineers who largely trusted each other. A big national telco is unlikely to attack its peers, so there was little need for safety measures. As smaller telcos came in to the mix via deregulation, that understanding changed - but it was hard to retroactively fit controls. The more modern reason is outsourced call centres. You want outbound calls from your Philippines based staff to show as if they were calling from a local number. When large and reputable entities were doing this it was fine. Just like showing a different reply-to address on an email. If you were designing a modern network, it wouldn't be like this. But international telephony is over a hundred years old and has a huge amount of legacy technology and legal agreements.
View on HN · Topics
That we can do better now isn't important to why something existed to be grandfathered-in in the first place. Call centres were getting outsourced before e.g. Skype was a twinkle in the eyes of Priit Kasesalu and Jaan Tallinn.