Combating phone spoofing with STIR/SHAKEN

Combating phone spoofing with STIR/SHAKEN - a BSidesLV crowd-sourced status quo, demo & explanation PasswordsCon, Tue, Aug 6, 13:00 - Tue, Aug 6, 13:25 CDT STIR/SHAKEN is a set of protocols that adds PKI to phone calls. Effectively adding a digital ...

Combating phone spoofing with STIR/SHAKEN - a BSidesLV crowd-sourced status quo, demo & explanation
PasswordsCon, Tue, Aug 6, 13:00 - Tue, Aug 6, 13:25 CDT

STIR/SHAKEN is a set of protocols that adds PKI to phone calls. Effectively adding a digital signature that can be verified by a phone that supports STIR/SHAKEN, proving the calling number isn't spoofed. The US FCC made STIR/SHAKEN mandatory for carriers in the US starting July 1 2021. Canada joined in a little later. I didn't plan on speaking about this since STIR/SHAKEN is just wishful thinking for now where I live in Norway. However; after a little crowdsourcing work over 2-3 days here in Vegas to check the status of STIR/SHAKEN, it has become clear to me a talk is needed in order to enlighten people and call SHAME, SHAME, SHAME on US mobile carriers!

People
Per Thorsheim