  Caller ID spoofing is a global industry problem and often acts as a critical
enabler for telephone fraud. To address this problem, the Federal
Communications Commission (FCC) has mandated telecom providers in the US to
implement STIR/SHAKEN, an industry-driven solution based on digital signatures.
STIR/SHAKEN relies on a public key infrastructure (PKI) to manage digital
certificates, but scaling up this PKI for the global telecom industry is
extremely difficult, if not impossible. Furthermore, it only works with
IP-based systems (e.g., SIP), leaving the traditional non-IP systems (e.g.,
SS7) unprotected. So far the alternatives to the STIR/SHAKEN have not been
sufficiently studied. In this paper, we propose a PKI-free solution, called
Caller ID Verification (CIV). CIV authenticates the caller ID based on a
challenge-response process instead of digital signatures, hence requiring no
PKI. It supports both IP and non-IP systems. Perhaps counter-intuitively, we
show that number spoofing can be leveraged, in conjunction with Dual-Tone
Multi-Frequency (DTMF), to efficiently implement the challenge-response
process, i.e., using spoofing to fight against spoofing. We implement CIV for
VoIP, cellular, and landline phones across heterogeneous networks (SS7/SIP) by
only updating the software on the user's phone. This is the first caller ID
authentication solution with working prototypes for all three types of
telephone systems in the current telecom architecture. Finally, we show how the
implementation of CIV can be optimized by integrating it into telecom clouds as
a service, which users may subscribe to.
