How to block this spoofed Caller ID?

[Trumpet]

I have this caller ID #########8, obviouly spoofed. Since it starts with # I'm not sure how to add it to blacklist without it being comment. I don't want to block the name it uses, OUT-OF-AREA, because I'm worry it might block legit calls instead.

Also, I have issue with ncidd at boot. It always fails to initialize the modem or failed to get the country code from it. I have to manually restart ncidd after boot "sudo invoke-rc.d ncidd restart" each time to get ncidd working. Any insight on this? I'm using TFM-561U on RPi 3 running on Ubuntu Mate.

[John L. Chmielewski]

Hi Trumpet,

I believe you can enter #s in a name using double quotes:

"#########8"

Need to see your ncidd.log at verbose 3 when you boot. Set verbose = 3 in ncidd.log by removing the '#' from this line:

# set verbose = 3

After modifying ncidd.conf, terminate ncidd, delete your ncidd.log and then reboot. After the reboot, restart ncidd then terminate it. Attach the ncidd.log generated to your next post.

[Trumpet]

So by doing "#########8" that would block the spoofed number #########8?

I attached 3 ncidd.log. boot and boot2 are logs generated during boot while restart is generated after I manually restarted ncidd after boot.

For whatever reason ncidd simply won't work properly at boot. Always need to manually restart it.

[John L. Chmielewski]

Sadly "#########8" does not work. Need to review the code to see why.

Your logs indicate that the ModemManager is taking control of the modem at boot and preventing ncidd from initializing.

I assume you are running Ubuntu Mate 15.10 or 16.04 which uses systemd.

For now, you best bet is to stop the ModemManager from starting at boot and then rebooting to start ncidd. The status lines are not needed but are helpful:

sudo systemctl status ModemManager
sudo systemctl disable ModemManager
sudo systemctl status ModemManager

The first status line will show it running, but the Loaded: line will indicate enabled.

The disable line will stop the ModemManager from starting at boot.

The second status line will also show it running but the Loaded: line will indicate disabled.

[mmartz]

A little update (or step forward perhaps)...

For now, you best bet is to stop the ModemManager from starting at boot...

What I just did to combat ModemManager (mm) in Ubuntu 18.04.1 (bionic) from interefering is to create/add a udev rule in /etc/udev/rules.d/99-ttyacm.rules (your vendorID and productID will vary depending on device(s)) of:

ATTRS{idVendor}=="0803" ATTRS{idProduct}=="3095", ENV{ID_MM_DEVICE_IGNORE}="1"

** and **

modify all related ModemManager.service files from:

- ExecStart=/usr/sbin/ModemManager --filter-policy=strict
+ ExecStart=/usr/sbin/ModemManager --filter-policy=default

... otherwise the udev rule is ignored.

This seems to be the least destructive if someone is using a 3G/4G/etc. connection too on another USB device. Disabling mm completely would kill any usage of those internet providers. There's also some way of disabling all ACM type modems as well from detection with mm but skipped trying that for the same reason. NetworkManager also seems to have a way of not managing, by at least a mac address, but my modem didn't immediately appear to be assigned one by the current system (didn't dig real deep for that confirmation although mmcli -L couldn't currently identify my modem specs even though it has been around for a while).

Anywho... hope this perhaps helps someone out since mm was preventing connection between client and server of ncid/ncidd... and only when enabled with systemd (systemctl) i.e. this particular issue didn't show up when ncidd server is manually started from a terminal with $ sudo systemctl start ncidd.

Back Ref:
* https://sf.net/p/ncid/discussion/275237/thread/a5583898/#0d2c

[John L. Chmielewski]

Can you do a lsusb and post the result?

[Trumpet]

trumpet@RPI-Server:~$ lsusb
Bus 001 Device 004: ID 0572:1329 Conexant Systems (Rockwell), Inc.
Bus 001 Device 003: ID 0424:ec00 Standard Microsystems Corp. SMSC9512/9514 Fast Ethernet Adapter
Bus 001 Device 002: ID 0424:9514 Standard Microsystems Corp. SMC9514 Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

I'll do couple more reboots to see, but so far ncidd is starting properly.

[John L. Chmielewski]

Hi Trumpet,

With the new release out I had some time to look into blacklisting a number as #########8.

The server will not accept #########8 as a blacklist or whitelist entry but you can alias it.

Here is my test line:

CID: *DATE*05242016*TIME*2130*LINE*-*NMBR*#########8*MESG*NONE*NAME*OUT-OF-AREA*

You can use a client to create a NAMEDEP alias or enter it manuallyin ncidd.alias:

alias NAME * = "SPOOF" if #########8

With the above alias entry, I just entered SPOOF in the blacklist. When I tested it, it hungup the call.

Will look into modifying ncidd to enter a number containing #s