AI
The Phone Network Hackers Abandoned Too Early
The PSTN covers any phone reachable by a standard US number. Before 1996, the network split between AT&T’s local Bell operating companies and a single long-distance entity subject to competition. The Telecom Act of 1996 opened local exchange service to competitors, created the CLEC category, normalized wireless regulation, and required incumbents to interconnect on non-discriminatory terms under publicly filed agreements. The hacker community lost interest right as the network became most interesting.
Call Routing in the Modern LATA
Every LATA has an ILEC feature group D tandem as its default route. When two carriers lack a direct connection, calls flow through that tandem. ILECs cannot carry their own long-distance traffic between LATAs; they must hand it off to an IXC. CLECs face no such restriction and can send traffic directly to each other over IP trunks between LATAs. Voice routing is ad hoc: unlike BGP, a carrier cannot see the full network topology and picks paths based on regulatory rules and static routing entries from the LERG.
Phone Numbers, Portability, and the LERG
CO codes originally mapped to a single end office building. After competitive entry, number block pooling split each CO code into thousands blocks, required in metro areas by the FCC. When a number ports to a new carrier, a database lookup returns an LRN, a phone number in a CO code owned by the destination carrier, allowing calls to route to the right switch. Routing information propagates via the LERG, gigabytes of CSV files distributed weekly to all subscribed carriers. New CO codes take 30 to 60 days to propagate.
Access Stimulation: The Phone Network’s Oldest Billing Exploit
In all domestic calls, the calling party pays. CLECs can collect a portion of that per-minute access revenue from upstream carriers. Access stimulation exploits this: attract inbound volume, pocket the difference. In 1996, dialup ISPs were the vehicle. The FCC killed that in 2001. Operators shifted to free conference call services in rural rate centers with higher per-minute rates. FreeConferenceCall.com was an early pioneer. The FCC closed the main loophole in 2011. The same billing mechanism drives PBX brute-force: a compromised SIP server running international calls earns the attacker 50 cents per minute.
STIR/SHAKEN Evasion: The TDM Shuffle
STIR/SHAKEN adds a cryptographic signature to SIP calls at attestation levels A (verified caller ID), B (verified customer), or C (pass-through). Spammers evade it with the TDM shuffle: route calls through a TDM segment, which strips the STIR/SHAKEN header since TDM does not support it. When the call re-enters the IP network, a gateway assigns a C attestation, laundering the spoofed caller ID. About 40% of calls still traverse TDM at some point. Snowshoe spamming spreads volume across 20 shell companies each using different low-volume VoIP providers with weak KYC, cycling numbers that cost one cent each.
How to Become a CLEC
CLEC certification means filing with the state public utility commission: financial statements, executive resumes, a service area description, and a brief equipment plan. Processing takes 30 to 90 days. After approval, get local interconnection in your target rate center (about one month for an ILEC) and feature group D long-distance access. Build a switch (Asterisk works for minimal use), register with NANPA, obtain your OCN and CLLI code, and wait 45 to 90 days for a CO code. Submit to NPAC, and you have your own numbering resources on the public network.
Notable Quotes
it’s how I was able to become a phone company at the age of 19. Enzo Damato · ▶ 7:54
it’s it’s the longest running basically free money glitch in the phone network people have been using this for years Enzo Damato · ▶ 22:43
a large part of the network, I’d say about 40% of calls today are still hitting TDM at some point in the call chain. Enzo Damato · ▶ 26:35
SS7 devices haven’t been pentested in I think ever. Enzo Damato · ▶ 30:07
Key Takeaways
- CLECs can bypass inter-LATA traffic restrictions that bind ILECs, routing directly over IP trunks between regions.
- Access stimulation has exploited per-minute inbound billing since 1996, and the same mechanic drives SIP brute-force today.
- The TDM shuffle strips STIR/SHAKEN headers by routing calls through legacy TDM, then re-attaches a C attestation on re-entry.
- CLEC certification costs little in deregulated states, and the full formation process takes roughly three to six months.
- SS7 hardware on the live network has never been pentested but remains accessible to any licensed carrier peer.
About the Speaker
Enzo Damato is a Rice University researcher with over 7 years in telecommunications, network administration, and security. He founded Rice Telecom Corporation, a facilities-based CLEC, to research telecommunications security and robocall mitigation. He has worked extensively with mainframe systems, winning a best session award at the SHARE conference for his presentation on DIY mainframe acquisition, installation, and configuration. He developed and currently teaches Rice University’s first course on mainframe computing, and manages AS25944, an IX-peered ASN for his personal lab.