S/S attestation on Twilio Elastic SIP

Trunk Providers
, ,
1

Following from this post
https://community.tangopbx.org/t/filtering-inbound-calls-by-s-s-attestation/

and referencing Twilio’s docs are here
Trusted Calling with SHAKEN/STIR | Twilio

I have some dialplan to monitor S/S signatures for incoming calls. At this point I’m not doing anything other than recording in the CDR. If patterns emerge with problem calls, someday I will use the attestation history to figure out filtering.

[from-pstn-check-ss]

exten => _.,1,Noop(Entering user defined context from-pstn-check-ss in extensions_custom.conf)

exten => _.,n,Set(CALL_ATTESTATION=${PJSIP_HEADER(read,X-Twilio-VerStat)})
exten => _.,n,NoOp(S/S Attestation Level: ${CALL_ATTESTATION})
exten => _.,n,ExecIf($["${CALL_ATTESTATION}"!=""]?Set(CDR(userfield)=S/S Level ${CALL_ATTESTATION}):Set(CDR(userfield)=S/S Level Unsigned))

exten => _.,n(inroute),Goto(from-pstn-e164-us,${EXTEN},1)
; end
1 Like
2

I’m going to put this out there like I have in other places. Using only the attestation for determining the validity of the call is not the way to go. There are quite a few of prolific spam carriers that will mark a call with an A attestation because it meets the requirements. The call originated on their network, with their DID from their customer which results in an A attestation. The call is still about your SSN being revoked unless you pay a “fine”. Onvoy is one of the biggest prolific spam carriers out there and pretty much all their calls get signed with an A attestation.

So at the end of the day, you could receive numerous calls with an A attestation and all be scam/spam/fraud calls and you could receive legit calls with a B or even no attestation. S/S is about the relationship between the OSP (originating provider), the CallerID presented and the subscriber presenting the call with said CallerID. It has no bearing on the contents of the call.

2 Likes
3

100% agree with you. The customer was adamant they wanted to block all C so we just provided dialplan for them and thought it was good to share with others as a foundation.

4

I don’t disagree with that at all. The dialplan is helpful. Using the attestation as part of the overall logic makes sense. Using it as the only logic, not so much.

1 Like
5

A month or so ago, we had an XCast Labs customer request all unsigned calls be blocked at the trunk switch, which was done. It remained enabled only for a few days before they requested we revert the block and only apply it to select DIDs.

Monitoring signatures seems like a safer way to proceed.

1 Like