Slashdot Mirror
Snooping on VOIP
EvilAlien writes "SecurityFocus is running an article on a joint Justice Department and FBI filing to the FCC which asks for broader communications interception powers:
FBI seeks Internet telephony surveillance. The move is very similar to the Lawful Access Consultation launched by the Canadian Government in August 2002. Both initatives discuss technological challenges and fears of communication "safe havens" for criminals on broadband services such as Internet, VoIP, and wireless services. Holes in existing legislation, such as Communications Assistance for Law Enforcement Act (CALEA), can provide unintended exclusions for services such as Free World Dialup."
Harder to decrypt. One day all secure conversations will be carried on VOIP.
Have a nice day!
What's the encryption like on VOIP? Would something like PGP be possible?
Join the Free Software Foundation
Let me guess. Previously known as French World Dialup. /Pedro
In other news, criminals are now able to use "cars", new transportation means that allow them to quickly escape after perpetrating crimes. FBI is looking for a way to monitor all cars in order to ensure security.
This is getting boring. Really.
Karma cannot be described by words alone.
Won't people who value their privacy (which, sadly, may also include criminals) just revive a project like PGPfone? I don't think it's been updated in a while, but the source code is still there...
people used ssh to tunnel their calls (assuming it's possible), or made calls over VPNs?
He tried to kill me with a forklift!
In other news, orwell rolled over in his grave today, as a confused nation scrambled to hand over their individual freedoms for the sake of percieved security.
Do not surrender your freedoms, granting increased voip snooping is just one more step to a totalitarian nation, where we justify acts like pre-emptive wars, racial profiling, internetwide snoop network with evil McCarthy databases,...
Oh shit it already happened...
I really wonder how they will sniff ipsec't packets..
I'm not a complete idiot... Some parts are missing.
Seriously. I know most people send postcards (e-mail) and not letters (encrypted e-mail) but wouldn't you at least do a simple public key exchange for VoIP? I feel I have much more privacy in a phone call than I do on an unencrypted Internet chat that is being relayed through a bunch of unknown servers.
;)
Even the simplest of key exchanges would stop any eavesdroppers, and making a man-in-the-middle attack requires so much more work, not to mention being detectable if verified through a secure channel.
That being said, I can understand the law enforcement agencies. It's not like it's the difference between a postcard and an envelope - it's the difference between a postcard and an indestructable envelope. Giving the police special permissions (e.g. to open your letters with a court order) doesn't work well in a world where encryption is in black and white - secure and insecure. Escrow keys and stuff like that to make it work like in the "real world" doesn't work well either.
Personally, I think I'd just write a AES wrapper if I'm busy planning to Take Over The World(tm Pinky & the Brain). Either that or I'll just send some PGP'd blueprints over freenet through a proxy from a webcafe wearing gloves or something
Kjella
Live today, because you never know what tomorrow brings
What if the VOIP program was directly from my computer to the other party's computer with no "central server" as such that all the traffic flows through. As I see it, CALEA is only feasable on systems such as POTS or cellular where all calls go through a switch of some sort. If one were to set it up so that my computer talks directly to your computer over an encrypted link (maybe with SSL etc) there is no central switch to be compromised...
i nutes'-worth
Of course, one can always use a pay phone. Cash still works.
Just my please-deposit-nintey-cents-for-the-first-three-m
RickTheWizKid
"safe havens" for criminals
Us non-criminals can't have a safe haven either? Thanks.
Developers: We can use your help.
Speak freely has IDEA encryption built in and the client can exchange session keys with PGP. I doesn't use a PGP IDEA key to DO the encryption, it generates it's own but once the key exchange is done with PGP. *poof* fbi still AS ALWAYS needs to get off their fat ass and drop this Ubiqitous Law Enforcement Rampage and do the HUMAN INTELLEGENCE that they get paid to do.
I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
Remember when we used to have sigs that included keywords that were designed to attract the attention of spooks using Echelon to monitor e-mail traffic? Well, we can easily add recorded voice clips to the end of our VOIP calls to similar effect. Go to the library, check out a book of war poetry, and start recording those keyword-rich sound bites. Or select passages from Gravity's Rainbow.
Hmm, we could put this stuff on our answering machines too. As a way of supporting America's martial spirit, of course.
"with their freedom lost all virtue lose" - Milton
We can give up all our remaining freedoms but the only "tech" a "terrorist" really needs is the commitment to die for their cause. How do you 100% guard against that? I fear for our children's children.
He was completely off by about 19 years.
134340: I am not a number. I am a free planet!
Sounds like its time for the geeks of America to unite and do something. Reading stories like these make me feel lucky that I live in Europe. I Feel sorry for u people.
perhaps i'm just naive or ignorant, but how would the government being able to snoop on a voip call be any different from a wiretap on your hard line phone? it would have the same effect, and i'm assuming that if the government were allowed to snoop on voip calls, they would be subject to the same guidelines that they have to follow when tapping a regular phone line. can someone with more information clarify please?
"I just want to thank my coach Eric a.k.a. Disco for shattering my reality..."
The law enforcement community has been begging for the unrestricted right to spy on the american people for some time now. I don't know about the rest of you, but I'm much more fearful of government agents with gestapo-like powers than I am of deluded wackos from the 3rd world. The intelligence community already spies on the rest of the world, which is where the threat is coming from. That should be enough. If not, then that is what our military is for, to defend the country against our enemies...which are OUT THERE, not HERE. I'd rather have terrorists over to my house for dinner three nights a week than see law enforcement aquire unnecessary powers that are a greater danger to the public than the terrorism they are purported to prevent.
The abundance of those who would trade freedom for the temporary illusion of security are proof positive that 50% of the population is of below average intelligence.
Muslim community leaders warn of backlash from tomorrow morning's terrorist attack.
I wonder if it would be plausible to get these guys to cease-and-desist under the DMCA.
IANAL, but I kinda doubt it, but it's nice to dream about, no?
This is the real signature
(Beats those shadows on the cave wall, don't it?)
You too can listen in to VOIP with voice over misconfigured internet telephones or vomit for short. It only works for Cisco IP phones, but I hear that this Cisco company may become a medium to large business in the networking industry.
Why can't I moderate something "Wrong" or at least "Grossly Misinformed"?
Encryption? Privacy? There's always VOMIT!
http://www.ebiblecommentary.com/phone.htm/ cu-hearme.com/
http:/
...still in emacs, anyway.
(Standard M-X Spook word list follows)
Go ahead, put the whole list in your sig.
Cheers,
Jim
$400 million 1 October 15 May 17 November 3rd October ACLU ADF AES AIDS AIIB AK-47 ALIR ANO ARD ARN ASALA ASG Abu Nidal Abu Sayyaf Aceh Merdeka Aden-Abyan Ahl-e-Hadees Air Force One Al-Fatah Al-`Asifa Alamo Albanian Alex Boncayao Brigade Alliance of Eritrean National Force Alliance pour la resistance democratique Allied Democratic Forces American American Airlines Amn Araissi Arab Revolutionary Brigades Arab Revolutionary Council Area 51 Aum Shinrikyo Aum Supreme Truth Avtomat Kalasnikov BATF Babbar Khalsa Baghdad Berlin Bhinderanwala Tiger Force Black September Brigate Rosse CIA CIRA CNDD CNRM CNRT Catholic Reaction Force China Chukaku-Ha Clinton Cocaine Communist Conseil Cuba DES DFLP DNA Dal Khalsa Dayak Delta Airlines Delta Force Dev Sol Devrimci Sol EFF ELF-RC ESSA EZLN Eastern Shan State Army Eiffel Tower Ejercito Popular Boricua Ejercito Popular Revolucionario Ellalan Force Eritrean Euzkadi Ta Askatasuna FALINA FALINTIL FALN FBI FMLN FRETILIN FROLINA FSF Farabundo Marti Fatah Force 17 Free Aceh Ft. Bragg Ft. Meade GIA GRAPO George Bush George W Bush Gerakin Aceh Merdeka Grey Wolves HAMAS Harakat ul-Ansar Hawari Hitler Hizb-i Wahdat Hizb-i-Islami Hizb-ul-Mujahideen Hizballah Hizbullah Honduras ICBM IRA Ikhwan-ul-Mussalmin Interahamwe Iparretarrak Islamic Israel JKLF Jamaat ul-Fuqra Jamat-e-Islami Jamiat-e-Ahl-e-Hadees KGB KKK Kach Kahane Chai Kashmir Kennedy Khaddafi Khalistan Khmer Rouge Komala Kosovo Kurdish Kurdistan Kuwait LSD LTTE La Cosa Nostra Lakshar-e-Taiba Lautaro Legion of Doom Lenin Les mongoles MAPU/L MD5 MI6 MILF MNLF Macheteros Macheteros Mafia Maktab al-Khidamat Manuel Rodriguez Marxist Maubere Resistance Mayi-Mayi Middle-Core Mohajir Qaumi Mong Tai Morazanist Mossad Mothaidda Quami Mujahedin-e Khalq Myanmar NORAD NSA Navy Nazi Nellis Range Noriega North Korea Oklahoma City Ortega Osama Bin Laden PALIPEHUTU PCP PGP PLO Pakistan Panama Pearl Harbor Peking Provos Qaddafi RC5 RDX RENAMO RSA Reno Romania Rule Psix SCUBA SDI SEAL Team 6 SHA SWAT Saddam Hussein Saheed Khalsa Scientology Semtex Serbian Shora-e-Jehad Sivi Vukovi South Africa Soviet Steyr Students of the Engineer TEMPEST TNT Tal Al Za'atar Talaa' al-Fateh Tamil Eelam Teamsters Terra Lliure Treasury Tupac Amaru U-235 US Airways Uzi Waco White House World Trade Center Zapatistas airframe airport al-Gama'at al-Islamiyya al-Jihad al-Qa'ida algorithm amatol ambush ambush ammo ammunition anonymous anti-tank archives armada armor armor-piercing arms arrangements assassinate assassination assassination assault atomic bomb bank account biological blowfish bomb bomb boobytrap border c4 camera carnivore charcoal chemical child pornography chinese class struggle claymore cocaine codebook colonel commando composition b conspiracy constitution cordite corporate corrupt council counter-intelligence crack-cocaine cracking cray credit card cryptographic czar d-day data haven defcon defenses democratie detcord detonate detonators dictionary disruption divers doctrine domestic doomsday double agent e-bola echelon efnet embassy embassy embassy empire encrypt enigma explosion explosive faction fertilizer fissionable flight 800 freedom freemasons genetic gold bullion government grenades guns hack harbor heroin hijack hostage hostages hydrogen bomb illuminati impulse incendiaries infiltration infosec infrastructure initiators insurgent intel international internet worm interpol jihad kamikazi kampuchea kibo kill kill kill kill launch codes lead azide lead styphante liberate liberation limousine lockpick loyalist main charge marijuana martyr maverick mercury fulminate microfiche microfilm minefield mines motorcade motorola mouvement munitions napalm nationalist nitric acid nitrocellulose nuclear oppressed orthodox password picric acid pipe-bomb plague platter charge plutonium plutonium policy political pre-teen president president primers private key propaganda psyops public key pulse detonation engine radar rail gun rebel rema
-- My Weblog.
http://www.ebiblecommentary.com/phone.htm
http://cu-hearme.com/
The way things are going, that should read: "safe havens" for dissidents...
Excellent timing yet again for an article related to something I wanted to ask this crowd about.
/.ers!
I just moved into a new office, and the customer left behind a detached Cisco IP phone tossed in the corner. What free software options do I have to put this puppy into service? Best I could find so far was that I need to run Cisco CallManager on the network. I was hoping to find that the proprietary protocol has been cracked and is supported by Gatekeeper or something. So far, no such luck.
This unit is a 12 SP+. What can I do with it?
Thanks
Intelligent Life on Earth
They now include Canada in the free calling area. No more international fees to call Vancouver. Yay! Oh, and the "virtual number" thing is cool. For an additional $4.99/mo, I can get a (916)xxx-xxxx phone number that routes to my home phone.
Pretty cool setup.
You sir,have over stepped your boundaries.While the other fellow was obvious posting in jest,your tone was that of seriousness nature,demanding investigation.
I will immediately inform my prayer group of your foul words and we shall then,with our focus prayers, attempt to banish you to hell.You may already feel the sensation of your limbs stiffening.This is normal.Please do not fight it,you will only succeed in swallowing your tongue.My best advice to you,is to lie down and die.You have fallen from the grace of the USA Super Power and God.
VoIP already stresses the networking and hardware limits in order to provide the "quality" that they do now. Many people think that encryption is a solution, but I don't think it is right now. PGPphone is NOT VoIP, but software encrption for the landline telephone network (i.e. audio encryption). But adding encryption to actual VoIP would lower the quality of service considerably. Ever try using VoIP over VPN? It is really bad. You can use google to find articles about how to turn VPN off for just VoIP so that you can still have good sound quality.
The only protection against eavesdropping is strong end-to-end encryption. We got the ECPA (86 - US) shoved down our throats so cellular companies could claim their systems were "protected" from unauthorized monitorin without having to actually spend money on embedding crypto hardware in subscriber units.
CALEA was just a pitiful attempt to keep LE agencies from having to spend big bucks on upgrading their monitoring hardware.
If an individual, organization, government agency, or other entity wants to monitor your communications badly enough they will. If you don't like that then use stong end-to-end encryption.
--BEGIN RANT MODE--
Instead of wringing you hands over the evil and unfair world we live in just deal with it and work around it.
Its not exactly difficult to properly encypt just about anything you send. How many actually do it? Want to bet those same people that can't be bothered to use strong encryption are some of the first to whine about monitoring?
--END RANT MODE--
In God we trust -- All others we monitor
Ofcourse we should be worried about terrorists using Voice Over IP, because I'm sure that Bin Laden has a computer in that cave of his and Hussein has a better knowledge of computing than Linus Torvalds (heaven forbid lol)... Seriously though, I think this is just another excuse for the larger government agencies to have a better grip on the people of their country, take Echelon or Carnivore for example... Both made for security but at the cost of many individuals privacy. I'm not necessarily against more protection for our countries, I'm just saying that our privacy is a big price to pay in order to get it.
Now let me get down to the goverment conspiracies, oh wait... someone's at my door, brb...
BOOM! **dead**
Business \Busi"ness\, n.;
A scam in which all people involved perceive as beneficial...
People have been saying "Orwell was only off by {abs(year-1984)}" or variations thereof since 1949, at least.
Now the FBI is going to knock on my door and ask me why I curse so much in CounterStrike.
I've been thinking for a while that it's surprising that no one has made a "phone" that does encription over regular twisted pair. Doesn't seem like it would be all that difficult, take something like speex or other voice codec, packet-ize, encrypt, transmit...process in reverse on the receiving end. Package it in a normal looking phone and make a million. Seems to me there would be a pretty big market for this, especially in big business. OR does this already exist???
I just replaced my home phone with a voip phone from packet8.net. I also considered vonage.com
Am I to understand then, that currently law enforcement could _not_ get a wiretap order to listen in on my calls? Being a privacy advocate I like this very much, maybe a temporary solution for criminals everywhere. FYI vonage uses cisco ATA's but packet8 has a proprietary solution. I hope that when people listening in on voip calls becomes more common place they upgrade to an all encrypted system.
Then all we'd need to do is get more people using PGP/GPG for email and all the spy power in the world isn't gonna help big brother. boo hoo.
My Linux Command of the Day site : LCOD
This is just another job for good encyption.
It's a done deal.
It's Christmas everyday with BitTorrent.
TRy Speak Freely By the founder of autodesk
(Who relocated to switzerland to escape from US
Crypto/Tax regulations.)
www.fourmilab.ch
WTF?!? Is anything that does not pass through a "normal" distribution channel now comparable with Napster? Other than using a computer network, how is VOIP anything like Napster?
It seems like journalists love to compare things with Napster just to give those things an slight taint of naughtiness.
The right choice is to build the encryption into the VOIP protocols themselves, which the initial H.323 and (I think) SIP standards didn't do. That way, it's not something that might or might not get patched on later, it's secure by default. The amount of CPU overhead is trivial - RC4 is blazingly fast, but even if you're using Triple-DES, it's on data you've compressed down to 8-16kbps, and the voice compression takes a lot more horsepower than encryption. I think some of the later standards have some crypto, but I don't know if they're in use.
Of course, crypto only covers the VOIP part - if you're using a VOIP-to-telco gateway in either direction, the telco side is unencrypted and subject to CALEA regulations, which are as technically onerous as they are invasive.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
that the public accepts reasons like this as valid; the only reason wiretaps were allowed in the first place was because it made sense in some situation.. like
"Hey, we are trying to solve this here crime, and we think this guy is using thsi here phone, can we listen in? OH cool."
Now the ability to snoop has become a feature that must be present or the government has a fit.
Another problem is non-telco VOIP carriers. The regulations are pretty clear for regulated telcos - they're much less clear for people who aren't. For instance, if the PBX at your office acts as a gateway for all your coworkers who have VOIP hardware phones or software phones on their PCs, and DSL at home with VPNs to the office - CALEA lets the telco wiretap your company's phone system at the telco trunk, but they don't know that extension 1234 is your coworker "Bob" who's also selling ganja on the side. And as VOIP carriers become less legacy-telco dependent, what about calls that only use the carrier as a presence server (e.g. ICQ or equivalent) to set up the connections and do the actual VOIP part user-to-user - they'd like to be able to wiretap your ISP.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
FYI,
Jeff Pulver is a great guy to network with in the SIP VoIP industry.
The German's also have a similar site to Jeff's at iptel.org. The iptel.org Web site appears to have over 65,000 accounts. They are working on SIP Instant Messaging and Presence Leveraging Extentions (SIMPLE) server infrastructure that could give the Microsoft RTC a run for its money.
There are plenty of providers or carriers that provide SIP services here are a few.
Business Grade:
1) Worldcom
2) Webley
3) Denwa
Consumer Grade:
1) Delta Three
2) Vonage
Because SIP servers proxy and registration servers can be anywhere in the world CALEA can't be enforced at the server end. Thus, support for US CALEA laws would have to be provided by the ISP or carrier providing the broadband service. (Most of the SIP VoIP phones support or default to G.711 CODECs that consume 90 kilobits per second of bandwidth.)
I highly recommend using the Intertex IX66 firewall with SIP hard and softphones. Its OS is Linux and interoperates with a very large array of SIP products. (The ipDialog hard phones are also Linux-based.)
There is plenty of open source SIP server software on the Internet:
1) http://iptel.org/ - FhG Fokus spin off, written in C
2) http://www.vovida.org/ - really Cisco, written in C++
3) http://dns.antd.nist.gov/proj/iptel/ - The National Institute of Standards is to release Java JAIN v1.1 reference implementation shortly
4) http://www.siptrex.org/news/ - an IP Centrex framework using older NIST software from the University College London guys
Bye,
Skaht
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Well a couple of things, Mr "I have all the answers."
1-It has to be universal (Pity the lone person with a fax machine).
2-It has to be economical (Why do you think it's mostly governments and large companies that use it?)
3-It has to be easy to use (Tech 'twister' for the uninitiated).
4-There has to be education (Why do you think it's only 'geeks' complaining?).
5-"Instead of wringing you hands over the evil and unfair world we live in just deal with it and work around it."
BEGIN pseudo-rant mode.
Why should "we" have to "work around" the bad behavior of others? Why not simply constrain the "evil and unfair" world so that one doesn't have to "work around" it?
END pseudo-rant mode.
Sheesh! Talk about putting the drunk before the bottle.
Amazing what the consequences of 157 votes and some hanging chads can be...