Blok zinciri tabanlı arayan kimliği doğrulaması (BBCA): VOIP/SIP ağlarında arayan kimliği sahtekarlığı saldırılarını önlemek için yeni bir çözüm ile arayan kimliği sahtekarlığı saldırı anatomisi ve test sonuçlarının analizi

Voice over Internet Protocol (VoIP) networks are increasingly targeted by caller-identification (caller-ID) spoofing attacks, posing a serious threat to telephone system security and privacy. Despite existing measures, these attacks persist, often leveraging social engineering techniques. In this study, we analyze caller-ID spoofing attacks in a live financial call center environment, emphasizing their risks and consequences. By initiating calls with spoofed caller-ID information and employing malicious social engineering, we demonstrate the practicality of terminating calls across VoIP, fixed line, and cellular networks. Our experiments demonstrated significant vulnerability, with an 84% success rate in spoofing calls as valid customers to change banking passwords, and a 76% success rate when posing as legitimate financial call centers contacting customers. Furthermore, four of the five major Turkish operators, including three Global System for Mobile Communication (GSM) operators, one fixed-line operator, and one VoIP-Internet Service Provider (ISP), were unsuccessful in preventing caller-ID fraud, revealing significant system deficiencies. To address this issue, we propose a blockchain-based caller-ID authentication solution utilizing a low-latency consensus algorithm for end-to-end management and verification of caller-ID information by ISPs and institutions. Our approach ensures ISP registration renewal upon each caller-ID change, mitigating issues such as roaming, Internet Protocol-Private Exchange Branch (IP-PBX), or Virtual Private Network (VPN) adoption. We discuss the solution's feasibility, potential deployment challenges, and future research directions, including complex call scenario handling. By enhancing telecommunication security and offering a scalable defense against caller-ID spoofing attacks, our approach effectively addresses this critical issue.