Slashdot Log In
VoIP Security
Posted by
CmdrTaco
on Wed Jul 27, 2005 08:04 AM
from the this-is-the-future-people dept.
from the this-is-the-future-people dept.
An anonymous reader writes "Whitedust are running an interesting article on the security aspects of VoIP. From the article: "The fact that VoIP operates across standard networks makes it vulnerable to all manner of IP hacking - including man in the middle attacks,sniffing, session hijacking, etc." Considering it's recent growth, how secure is VoIP?" PCM2 sent us a wired bit about Phil Zimmerman of PGP working on a privacy system for Voice over IP calling
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
The Dumbing-Down of America...part XXVII (Score:5, Informative)
From TFA:And all these errors are in just the introduction.
Now, I don't expect perfection, but the sheer amount of errors present here is beyond the pale, and renders the reader incapable of trusting the subject matter presented, or taking the author seriously.
Mr. Anderson, about 98% of the errors in your article could have been avoided by the use of a simple spell-checker. Nowadays, people don't actually need to know how to spell, as we have software to do that for us...but you have to actually use the software.
Re:The Dumbing-Down of America...part XXVII (Score:2)
A clue as to why... (Score:3, Informative)
Their website [whitedust.net] lists their numbers as: "Tel: 00353 - (0)87 - "...etc numbers, so they're not in North America.
This: (Mon, 14 Feb 2005 16:57:12 +0000) also suggests a European country (I think). So maybe English isn't their first language.
Re:A clue as to why... (Score:3)
They may speak with a funny accent there but they're pretty likely to know English..
Re:The Dumbing-Down of America...part XXVII (Score:3, Informative)
Man in the middle. (Score:5, Interesting)
The only security problem I see is if the attacker can learn information that lets him make calls billed to my account. This becomes the VOIP vendors problem anyway. When I notice something wrong with the bill I'll do a chargeback on my credit card for the bill and simply change VOIP providers. If this happens a lot, the VOIP vendor will do something about their security problem.
Or am I missing something?
Re:Man in the middle. (Score:3, Interesting)
If an attacker has access to a router beyond your isp/backbone but before the signals reciever then the contents can be subverted.
Admittedly, if all you do is argue about the sports scores then there is not much risk.
But if you were using VOIP as a transparent replacement to POTS (Plain Old Telephone Service) and were ordering a new car or dicussing your new pin number with the bank then things are quite different.
Re:Man in the middle. (Score:5, Informative)
POTS is wide open to MIM attacks.. in fact anyone with a cheap earpiece can do it - no need for a PC even.
Parent
Re:Man in the middle. (Score:3, Insightful)
POTS is wide open to MIM attacks.. in fact anyone with a cheap earpiece can do it - no need for a PC even.
Yeah because it's so much easier to pick the correct pair of wires out of several dozen or hundred on the local loop then it is to setup a router rule to capture VoIP packets.
Unless they are hanging off the pole outside your house (which would be rather brazen) I don't worry myself too much with MIM attacks on POTS. In fact unauthorized bugs on POTS can usually be detected fairly easy (they cause a
Re:Man in the middle. (Score:5, Insightful)
Unless you were targeting one specific person, the above will work fine
My whole point was that it's much harder to target one specific person with POTS then it is with VoIP. What's easier? Finding my pair or capturing packets from/bound for my IP address?
The article was dealing with security, and the security for both is the same. You would have to do the same for VoIP as you do for POTS if you want security. Harden the conduit, and encrypt and decrypt the message at the TX side and RX side.
And you still have the problem of the person at the other end who is on his speaker phone while the cubemate next door listens. Ultimately the only end of the line you know is secure is your end (POTS or VoIP) and this is all for highly paranoid people anyway.
As much as I am arguing against VoIP (and cell phones) security is not the reason why. I worry about more reliability and quality of service -- both of which seem to be lacking at this time.
Parent
Re:Man in the middle. (Score:3, Insightful)
Used to be that way with a lot of information crimes, but the internet makes them possible on a whole new scale. Imagine a mim attack that compromises a couple of major VoiP hops, and sorts out the calls to banks and creditcard companies based on phone number, or whatever. That can be automated now, so a guy
What about... (Score:2)
Paranoia (Score:5, Funny)
I thought you were going to give me a lift to Tinas?
Thats tomorrow, have you been taking my pain killers again?
No... erm... ok I'll see you later
*click*
Wait, we are being line-tapped
Oh my god! Execute the Omega 13 Device!
*end of world*
Really - if you want security, talk in tongues, or use a third party audio scrambler, plus encrypt the session. (then unencrypted it will just sound like noise). Plus standon one foot while you talk, and occassionally look through the venetian blinds for snipers across the rooftops.
Re:Paranoia (Score:4, Funny)
and occassionally look through the venetian blinds for snipers across the rooftops.
-SNIP-
Dude, why not stick your head out the door for a few seconds too while your at it? If you take paranoia seriously, you seriously need to set up outdoor pinhole cameras, like I have. I love the espressions of frustration on the sniper's faces. Also, keep in mind your location can be determined by a tempest brainwave triangulation attack, so wear the proper protection. (you have been warned)
Parent
Cain and VoIP Sniffing (Score:5, Informative)
PacketCable VoIP security (Score:5, Interesting)
Of course, now ask how many cable compaines are actually deploying fully PacketCable-compliant systems with all the security turned on the way it was designed to be.
No discussion about this, w/out VoIPsec list (Score:5, Informative)
Re:No discussion about this, w/out VoIPsec list (Score:2)
PGPfone (Score:2, Informative)
http://web.mit.edu/network/pgpfone [mit.edu]
Damn hippies.... (Score:2)
Anyone who believes that this is some 'golden age' of free communications is on crack. And cheap crack at that.
POTS is also vulnerable (Score:2, Informative)
If you have a set of aligator clips and a phone. Or a set of diaganol cutters (DoS attack).
I mean, really
- Brian Roach
One has to wonder... (Score:2, Insightful)
What about something like OTR? (Score:3, Interesting)
Anonymous Diffie-Hellman would be "good enough" (Score:3, Insightful)
The downside is, that a MITM is possible to get the key, but that's pretty damn unlikely compared to people just sniffing and listening to your call or blindly injecting data to an existing one. From what information is available about Skype, it does something like this, I believe.
But, designing horribly complicated systems that cover the corner cases seems to be the norm, and those get ignored due to complexity and thus everyone does the unencrypted thing in the end
So what? (Score:4, Interesting)
How secure is the PSTN? (Score:5, Interesting)
If you think the PSTN is really secure, you might want to look through some old issues of 2600...
Nomadic vs Non-Nomadic VoIP (Score:2, Interesting)
I've been using VoIP for the better part of two years now, and it's maintained by my ISP. I run it over the Ethernet hookup I have, and as far as functionality is concerned I hardly notice the difference from POTS.
Outages? I've had two. Once when my apartment lost power (thus the VoIP-box lost power) and once when some major link in my ISP's chain went down. As a matter of fact, I've had FEWER problems with VoIP th
*sigh* (Score:3, Interesting)
With VoIP you have to actually be on the network.. and not just on the network.. but IN the packet stream.
Hacker A who is on a server off the switch can't listen to your conversation... they woudl have to interrupt the packet stream flowing through the router.
VPN (Score:3, Interesting)
1. they don't have to be bothered with trying to figure out what ports to forward on the firewall and
2. they have so much difficulty in troubleshooting their own systems that they love to blame everything on us.
In any event, I picked up the new o'reilly book on voip and they talk a lot about avoiding vpn as it creates lag. They also indicate that sending all of your QOS flagged traffic down a VPN tunnel eliminates the ability of the upstreams to "see" the QOS flags as they are encrypted. Anyone else have experience with this?
So much safer. (Score:2)
Re:So much safer. (Score:2)
Hrm. Tough call.
Re:So much safer. (Score:3, Insightful)
Because there is no way in the world I could just go to you telephone access box with a phillips head screwdriver and pull your connection.
Your welcome to try it at my house. The lines are underground and all of the NIDs are in the utilities room downstairs which only the teleco and my landlord have a key too.
Despite that your point would be valid if it wasn't for the fact that a VoIP phone can be brought down the same way. And a cell phone can be jammed. If somebody is out to get you then you have b
Re:So much safer. (Score:2)
I don't think that word means what you think it means.
DoS attack? Want to take out a neighborhood? Piece of rope tied to a car bumper and the little 2ft post on the side of the road. Or just knock the lock off with a cheap hammer, then reach in and pull out a handfull of wires.
Hit a big box with your car to cause real havoc.
How about listening to cell calls with a scanner? Ask Newt Gingrich about that one.
Monitoring a POTS line is still as simple as climbing a pole and attaching a couple of
Re:So much safer. (Score:2)
Try clicking the receiver a bunch of times... no good. If there is a way to free the line, I don't know what it is. Since you are such a brilliant fellow, I am sure you know.
Point is... if you ar
Re:So much safer. (Score:3, Informative)
Check your house for nosy people and failing that call your telco to have it looked at.
Of course I've never heard of that problem before. Doesn't mean you're making it up but more than likely the reason is more than a "remote DoS" attack.
Mostly call-centers can only fake their CID information [but not ANI] which makes call display all fucked up [but not their billing]. That's about
Re:So much safer. (Score:2)
If your experiment doesn't work as I predicted, let me know. I've had it happen on more than one line, and yes, I am sure no one on my end picked up a receiever.
Maybe call-waiting would get around it, but if you didn't have it, I know I could tie
Re:So much safer. (Score:3, Informative)
Tom
Re:So much safer. (Score:2)
It's normal behaviour for the caller to control the state of the call - it's actually useful - for example if someone phones you and you pick it up on an extension you can hang up and go to the another phone and pick up.. and the caller will still be there.
In this country all phones work like this, even the new digital exchanges. I'd expect in the US it's more varied as there isn't one telco running everything.
Re:So much safer. (Score:2)
In reality if you stood on a soap box spouting crap like that I'd tell you to shut up as well.
And it doesn't make me feel better, it makes me sad that there are people like you living amongst us. It makes me weep for the future, do you have or plan on having kids? Seriously consider giving them up for adoption.
Tom
Re:Hmm... (Score:5, Interesting)
Cant we just stick to regular telephones? I dont want my 911 call to be interrupted by a denial of service attack...
Indeed. I have spoken about this [slashdot.org] before. In fact from TFA:
Considerating the stability and reliability of the tradional telephony networks - a product of decades of work - it seems foolhardy to replace it.
I couldn't agree more! All the power to people who use VoIP or cell phones as a primary line. But anyone who completely abandons POTS at this point is jumping off the diving board with no idea of how deep the water is. POTS is damn near 100% reliable (short of drunk guy hitting pole outside your house), it survives power outages and I don't think it can be brought down by a buggy TV in your neighbors house. A friend of mine lost Roadrunner and TW's digitial phone service for two days because of a TV next door that was leaking RF onto the coax network.
More to the point, if these services are going to be sold as a replacement for your POTS line then they damn well ought to be regulated like your POTS line -- with requirements for reliability and appeals processes if you get hosed.
Parent
Re:Hmm... (Score:2)
I live in a college-heavy neighborhood, in a DUI-heavy state...you'd be surprised just how often this can happen (though I lose power more often than phone).
I once had drunk drivers crash into some box two houses down that apparently my home power runs through twice in three weeks. Same box. Different cars. No joke. And it wasn't even the snowy season.
Of course, this has nothing to do with VoIP security...
Re:Hmm... (Score:2)
I live in a college-heavy neighborhood, in a DUI-heavy state...you'd be surprised just how often this can happen (though I lose power more often than phone).
Hahaha, nice. I should have pointed out that odds are the drunk guy hitting the pole would also knock out your VoIP service too -- unless you have a wireless internet connection and a laptop/UPS. My main point was that in my 30 some years on this earth the only time I can ever recall the phone not working was when somebody hit the pole and ripped t
Re:Hmm... (Score:4, Insightful)
[sarcasm] Yeah, fuck progress! [/sarcasm]
Parent
taxes and fees (Score:2, Interesting)
My phone company charges $12 for my no-frills service. Somehow the bill I pay is $45 after all the fees and taxes. Those extra charges are the main reason I'm considering bailing from POTS to VoIP. They'll catch up sooner or later, but for a time, I can keep some of my money.
Heck I might have some cash to enter the sucker mill^H^H cell phone subscriber pool.
Re:Hmm... (Score:2)
Keep risk management in perspective. In the case of a business, I think it would be a good idea to keep at least one POTS line, to prevent a total outage of phone se
Re:Hmm... (Score:2, Informative)
It is good enough, and that's exactly what we do. I have a VoIP "line" from AT&T at our business for outgoing long distance, plugged right into our phone system. It saves us probably $200 - $300 a month in long distance (You should see what busi
Re:Hmm... (Score:3, Insightful)
The advantages of VoIP is amazing... the cost on Long Distance is ridiculous... POTS might not be broken.. but what happens when those wires do need to be replaced... i'm positive nobody is going to be jumping in and re-laying the wire..
And exactly what kind of wires do you think your internet connection is coming in on? Do you worry about the wires when you talk about VoIP? And, yes, they will replace the wires. Pretty much the only copper part of the PSTN left is the local loop from the CO to your h
Re:Hmm... (Score:3, Insightful)
Well the VOIP provider has one important motivator that the phone company lacks.
Yeah, because between VoIP, the cable company and cell phones (none of which are regulated or held to the same standard) the baby bells have no competition at all. Do you really beilive that?
The bells seem to think that whatever they want to do is okay. Youre stuck with them, they dont have to be honest in their billing, It costs the telcos nothing to enable caller-ID, indeed it is an integral part of the POTS system, so w
Re:Hmm... (Score:2)
People don't seem to care about the availability of their phone system, 99.something pwercent availability seems to be good enough for most.
Cell phones might be at 99% but VoIP isn't even close. And those people will care when they have a heart attack during that 1% of the time.
Think that's a remote chance? Take a 1% downtime and apply it across a couple hundred thousand users. It's only a matter of time.
Re:Cisco / Encryption (Score:2)
It makes sense on one level - you're preventing