Journey to the center of PSTN - I became a phone company

Journey to the Center of PSTN - I Became a Phone Company

Speakers: Enzo Damato

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=cA-ZQJ8EZSs

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Enzo%20Damato%20-%20Journey%20to%20the%20center%20of%20the%20PSTN%20How%20I%20became%20a%20phone%20company%2C%20and%20why%20you%20should%20too..pdf

Overview

Enzo Damato's DEF CON 33 talk is a tour-de-force walkthrough of the Public Switched Telephone Network (PSTN) from the inside—not from the perspective of a hacker probing someone else's infrastructure, but from the perspective of a licensed carrier who legally operates within the network. Damato obtained his own telephone company license, acquired numbering resources from NANPA, established peering relationships with other carriers, and built a VoIP switching platform. This insider vantage point allowed him to discover and demonstrate vulnerabilities that are invisible to anyone operating solely from the user side of the phone system.

The talk covers three main areas: how anyone can legally become a phone company (and why that's a security problem), the technical architecture of PSTN interconnection, and the exploits that are possible once you have carrier-level access—including caller ID spoofing at the protocol level, call interception, routing manipulation, and STIR/SHAKEN bypass techniques.

Background

▶ Watch: that you could do from the inside of the phone network. (0:33)

The PSTN is one of the most security-relevant pieces of critical infrastructure in the world, yet it is largely opaque to the security research community. Most telecom security research focuses on the subscriber side: SIM swapping, SS7 attacks using purchased API access, or PBX misconfigurations. Damato took a different approach: rather than finding vulnerabilities from the outside, he went through the regulatory process to become a legitimate carrier, gaining access to the same interconnection systems that AT&T, Verizon, and Lumen use.

The path to becoming a phone company in the United States involves obtaining a CLEC (Competitive Local Exchange Carrier) license from the relevant state PUC (Public Utilities Commission), registering with the FCC for interstate authority, obtaining a Company Code from the NANC (North American Numbering Council) or going through a larger carrier as a reseller, and establishing SIP or TDM interconnects with Tier 1 carriers. Damato notes that the regulatory burden, while real, is manageable—the more significant barrier is technical knowledge, not money or paperwork.

Key Findings

▶ Watch: the first time were allowed to become a competitor to Ma Bell for local excha... (2:31)

Caller ID is not authenticated in most carrier interconnects. Despite the deployment of STIR/SHAKEN (the framework mandated by the TRACED Act), the attestation chain has significant gaps. A carrier that has not implemented STIR/SHAKEN—or that attests calls with an "A" (full attestation) level without actually verifying the originating number—can place arbitrary caller ID on outbound calls. Damato demonstrates that at the SIP level, the From header and the P-Asserted-Identity (PAI) header can be set to any value, and terminating carriers frequently pass these values to the end user without verification.

STIR/SHAKEN has a critical attestation fraud problem. The STIR/SHAKEN framework assigns three attestation levels: A (full), B (partial), C (gateway). "Full attestation" is supposed to mean the originating carrier both authenticates the calling party and confirms they are authorized to use that number. In practice, Damato found that some carriers issue "A" attestation for calls where they cannot possibly have verified the number—either because they are acting purely as a transit carrier, or because their KYC (Know Your Customer) processes are insufficient. Since the attestation signature is cryptographically valid (it has a real certificate), downstream carriers and analytics engines accept it.

Number spoofing via SIP manipulation. Within carrier SIP interconnects, Damato showed that altering the From, P-Asserted-Identity, and Diversion headers allows a carrier to present virtually any number to the called party. Most PSTN termination paths do not strip or validate these headers; they propagate them end-to-end. This is the protocol-level mechanism behind virtually every robocall and spoofed scam call.

Route hijacking and traffic interception. As a carrier, Damato has access to the routing tables of the PSTN. He demonstrated that by manipulating NPA-NXX routing (the 6-digit North American Numbering Plan routing used by carriers), a malicious carrier could route calls to a number through their own infrastructure before forwarding—enabling passive interception of voice calls. This is an analog to BGP route hijacking but for the phone network.

Gray routes and regulatory arbitrage. Damato documented the existence of "gray routes"—call paths that traverse jurisdictions with different (or no) regulatory requirements, enabling spoofing and interception that would be illegal in the US but is placed from infrastructure in less-regulated countries. These gray routes use the same PSTN interconnection agreements as legitimate traffic.

SMS vulnerabilities. The talk extends to SMS: because SMS delivery uses the same SS7 and SIP infrastructure as voice, a carrier-level actor can intercept SMS messages, including one-time passwords (OTPs) used for two-factor authentication. This attack does not require SS7 API access (which requires purchasing access from a telecom intermediary)—it is available to anyone with legitimate carrier interconnection.

Technical Deep Dive

▶ Watch: You know, MCI, Sprint, the other longdistance carriers, if you remember dial ... (3:28)

PSTN Architecture

The modern PSTN is a hybrid network. The legacy TDM (Time Division Multiplexed) network uses SS7 (Signaling System 7) for call control and ISUP (ISDN User Part) for call setup messages. Over the past two decades, most of this has been wrapped in IP via SIP (Session Initiation Protocol) and replaced at the core by softswitches.

Interconnection points between carriers are called points of interconnection (POIs). In the SIP world, these are SIP trunks—TCP or TLS connections between carrier SBCs (Session Border Controllers) that carry SIP signaling and RTP media. The key document governing interconnection in North America is the ATIS IP NNI (Network-to-Network Interface) specification.

Damato's platform used a standard open-source softswitch stack (Asterisk/FreeSWITCH with custom routing logic) backed by a SIP proxy for carrier interconnection. He obtained direct SIP interconnects with several Tier 2 carriers, giving him the ability to both originate and terminate calls across the PSTN.

STIR/SHAKEN Implementation Weaknesses

STIR/SHAKEN works by having the originating carrier sign a JSON Web Token (JWT) called a PASSporT (Personal ASsertion Token). This token contains the calling number, called number, timestamp, and attestation level. The token is signed with the carrier's private key, with the public certificate hosted at a URL in the token header.

The vulnerability Damato identified is that the attestation level "A" has no enforcement mechanism. The carrier self-certifies. There is no real-time verification by an authoritative body. The Secure Telephone Identity Policy Administrator (STI-PA) issues certificates to carriers but does not monitor per-call attestation accuracy. A carrier that consistently issues fraudulent "A" attestations may eventually be flagged through analytics, but the feedback loop is slow enough that abuse is widespread.

Additionally, many calls still traverse paths where STIR/SHAKEN is not implemented—particularly international routes and routes through smaller CLECs. These calls arrive with no signature, and terminating carriers are supposed to treat them with suspicion, but analytics vary widely.

SIP Header Manipulation Demo

Damato showed live call placement with a spoofed caller ID. From his carrier SBC, he placed a call with a From header containing a number he did not own (a major bank's published customer service number). The call arrived at the destination with the spoofed number displayed on the called party's screen. He then showed the SIP INVITE captured at his SBC, demonstrating exactly which headers carry the displayed number and how they propagate.

Demo / Proof of Concept

▶ Watch: Journey begins: becoming a competitive local exchange carrier (CLEC) and ente... (6:25)

Key demonstrations included:

• Caller ID spoofing to an arbitrary number, showing the call arriving with a bank's number on the recipient's screen.
• STIR/SHAKEN "A" attestation forgery, showing a signed PASSporT JWT with full attestation attached to a call where the originating number was not verified.
• SMS OTP interception, demonstrating that a carrier-level routing manipulation could divert an SMS to a target number through the attacker's infrastructure before delivery.
• Gray route tracing, showing how a call placed in the US transited foreign infrastructure before terminating domestically, bypassing US STIR/SHAKEN requirements.

Defensive Implications

▶ Watch: we can see an example of a modern latta ecosystem as it exists currently. (8:08)

For individuals:

• Do not rely on caller ID as authentication. No technology available to end users can guarantee that a displayed number is genuine.
• SMS-based OTPs are vulnerable to carrier-level interception. Prefer authenticator apps (TOTP) or hardware security keys (FIDO2/WebAuthn) wherever possible.
• Be extremely skeptical of any call claiming to be from a bank, government agency, or other trusted institution—even if caller ID appears correct.

For organizations:

• Require app-based or hardware MFA for all sensitive systems. Eliminating SMS OTP removes the most accessible phone-network attack vector.
• When evaluating vendor calls or employee authentication, implement voice biometrics or out-of-band verification rather than trusting caller ID.

For carriers and regulators:

• STIR/SHAKEN attestation needs enforcement, not just self-certification. Auditing of per-carrier "A" attestation rates against known spam/fraud patterns would identify bad actors quickly.
• International gray routes represent a significant gap; FCC enforcement is domestic, but most abuse originates internationally.
• The STI-PA certificate revocation process needs to be faster—currently, a carrier can abuse its certificate for weeks before revocation.

Key Takeaways

1. Becoming a licensed phone carrier is achievable for a technically motivated individual and provides access to attack surfaces invisible from the subscriber side.
2. STIR/SHAKEN does not solve the caller ID spoofing problem—it creates a new, certifiably signed spoofing problem when attestation is fraudulent.
3. Carrier-level access enables SMS interception, which undermines SMS-based two-factor authentication at scale.
4. The PSTN's trust model—where carriers are assumed to be honest actors—is fundamentally at odds with a threat model that includes rogue carriers.
5. The research demonstrates the value of regulatory engagement as a research methodology: sometimes the most powerful way to understand a system's vulnerabilities is to operate it legitimately.

About the Speaker(s)

▶ Watch: And this is just scratching the surface of, you know, carrier side VIP abuse. (28:46)

Enzo Damato is a telecommunications researcher and self-described "phone company" operator. He began with a background in server infrastructure and networking, progressing through obtaining his own Autonomous System Number (ASN) before pursuing the more complex challenge of becoming a licensed telephony carrier. He built and operates a real telephone company with its own numbering resources and carrier interconnections. This talk reflects years of practical experience navigating both the regulatory framework and the technical interconnection systems of the North American PSTN.