Background
SayNoTo0870 is a great service that helps people find geographic alternatives to expensive 0845 and 0870 numbers.
An example might be that my bank has a number “0845 123456” for it’s lost credit card hotline. It also has the same number “0161 123456”. From mobile numbers and most landlines, calling the geographical number, will be much cheaper. As you can sometimes spend quite a long time on hold to people like this, being charged by the minute on an expensive 30p/minute line can get expensive.
SayNoto0870 let’s you type in the premium (strictly speaking “Lo-call”) rate number and see user submitted geographic numbers going to the same place. It works quite well.
Problem
The thing is, there’s not way to verify you’re actually connecting to the right people. Some numbers on their site are “verified” but what does that mean? That they’ve called it and got through to where they wanted to get through to? How do we know it’s an official organisation number?
How it works
If I (“Eve”) purchase an 0800 number, or even more cheaply, a geographic number, via a cheap online VoIP service (~£3/month) and then using a online VoIP service, I forward all call to my banks 0845 number, with the original caller-ID being sent. Everytime Alice phones up, she’ll be connected straight to Bob at the Bank. Bob at the Bank will also, receive a call appearing to come from their Alice, as the orignal caller-ID has been forwarded on.
However, as I, Eve, have the caller going through a number I control, I can intercept their communications – probably by simply illicitly recording the call between Alice and Bob and listening to it afterwards.
Telephone is usually regarded a relatively secure medium for communication, however if you were to intercept a sales line, or a bank line or something, many people may be giving away personal and financial information that could easily be exploited.
SayNoTo0870 is a great service, and I thoroughly support the aim. Sadly, it’s very ripe for a very nasty style of data-theft attack.
Mitigation
In my opinion, the only way to mitigate the attack is to ask companies and organisations not to use 0845 and 0870 numbers, that would encourage their users to see out untrusted alternate numbers.