Vermilion box
From Wikipedia, the free encyclopedia
A vermilion box is a (hypothetical) portable telephone line emulator used for phreaking, whose function is to spoof all of the aspects of an incoming phone call—DC line voltage, an AC ringing signal and caller ID—while the line is disconnected from the public switched telephone network (PSTN), as well as allow the user to communicate with the recipient if the call is answered.[1] Its use requires a physical connection to the circuit somewhere between the target premises and the exchange (in either the local loop or the access network), but when properly applied, results in a stealth-intensive incoming call that appears completely genuine but which cannot be electronically traced. Typically, the user physically disconnects the target line from the network or causes an outage in the system, connects the vermilion box, and then initiates the illicit call.
The device incorporates the functions of three more basic phreaking boxes:
- A magenta box, which generates the AC ringing signal required to make the target telephone ring.
- An orange box, which uses frequency-shift keying to transmit the desired caller ID information, modified to also produce an on-hook (idle state) signal.
- A beige box, used to conduct the call itself.
In addition, a direct current (DC) source is required to supply power to the telephones on the target's line in the absence of the network.
Name
Use in spoofing attacks
The use of a vermilion box has sometimes been posited as an element in socially-engineered spoofing attacks where the caller ID of an incoming call serves to implicitly identify an attacker as someone who is authorized to receive the desired information or system access. However even if proven its efficacy in such operations was short-lived, as at approximately the same time telemarketers began using the ability of Primary Rate Interface (ISDN-PRI) connections to transmit caller ID information of their choosing as a means of increasing their contact rate, which quickly lead to widespread mistrust of caller ID among the public.[1][3]
