Slashdot Mirror
Snooping on VOIP
EvilAlien writes "SecurityFocus is running an article on a joint Justice Department and FBI filing to the FCC which asks for broader communications interception powers:
FBI seeks Internet telephony surveillance. The move is very similar to the Lawful Access Consultation launched by the Canadian Government in August 2002. Both initatives discuss technological challenges and fears of communication "safe havens" for criminals on broadband services such as Internet, VoIP, and wireless services. Holes in existing legislation, such as Communications Assistance for Law Enforcement Act (CALEA), can provide unintended exclusions for services such as Free World Dialup."
What's the encryption like on VOIP? Would something like PGP be possible?
Join the Free Software Foundation
Let me guess. Previously known as French World Dialup. /Pedro
In other news, criminals are now able to use "cars", new transportation means that allow them to quickly escape after perpetrating crimes. FBI is looking for a way to monitor all cars in order to ensure security.
This is getting boring. Really.
Karma cannot be described by words alone.
Won't people who value their privacy (which, sadly, may also include criminals) just revive a project like PGPfone? I don't think it's been updated in a while, but the source code is still there...
people used ssh to tunnel their calls (assuming it's possible), or made calls over VPNs?
He tried to kill me with a forklift!
In other news, orwell rolled over in his grave today, as a confused nation scrambled to hand over their individual freedoms for the sake of percieved security.
Do not surrender your freedoms, granting increased voip snooping is just one more step to a totalitarian nation, where we justify acts like pre-emptive wars, racial profiling, internetwide snoop network with evil McCarthy databases,...
Oh shit it already happened...
I really wonder how they will sniff ipsec't packets..
I'm not a complete idiot... Some parts are missing.
Seriously. I know most people send postcards (e-mail) and not letters (encrypted e-mail) but wouldn't you at least do a simple public key exchange for VoIP? I feel I have much more privacy in a phone call than I do on an unencrypted Internet chat that is being relayed through a bunch of unknown servers.
;)
Even the simplest of key exchanges would stop any eavesdroppers, and making a man-in-the-middle attack requires so much more work, not to mention being detectable if verified through a secure channel.
That being said, I can understand the law enforcement agencies. It's not like it's the difference between a postcard and an envelope - it's the difference between a postcard and an indestructable envelope. Giving the police special permissions (e.g. to open your letters with a court order) doesn't work well in a world where encryption is in black and white - secure and insecure. Escrow keys and stuff like that to make it work like in the "real world" doesn't work well either.
Personally, I think I'd just write a AES wrapper if I'm busy planning to Take Over The World(tm Pinky & the Brain). Either that or I'll just send some PGP'd blueprints over freenet through a proxy from a webcafe wearing gloves or something
Kjella
Live today, because you never know what tomorrow brings
What if the VOIP program was directly from my computer to the other party's computer with no "central server" as such that all the traffic flows through. As I see it, CALEA is only feasable on systems such as POTS or cellular where all calls go through a switch of some sort. If one were to set it up so that my computer talks directly to your computer over an encrypted link (maybe with SSL etc) there is no central switch to be compromised...
i nutes'-worth
Of course, one can always use a pay phone. Cash still works.
Just my please-deposit-nintey-cents-for-the-first-three-m
RickTheWizKid
"safe havens" for criminals
Us non-criminals can't have a safe haven either? Thanks.
Developers: We can use your help.
Speak freely has IDEA encryption built in and the client can exchange session keys with PGP. I doesn't use a PGP IDEA key to DO the encryption, it generates it's own but once the key exchange is done with PGP. *poof* fbi still AS ALWAYS needs to get off their fat ass and drop this Ubiqitous Law Enforcement Rampage and do the HUMAN INTELLEGENCE that they get paid to do.
I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
Remember when we used to have sigs that included keywords that were designed to attract the attention of spooks using Echelon to monitor e-mail traffic? Well, we can easily add recorded voice clips to the end of our VOIP calls to similar effect. Go to the library, check out a book of war poetry, and start recording those keyword-rich sound bites. Or select passages from Gravity's Rainbow.
Hmm, we could put this stuff on our answering machines too. As a way of supporting America's martial spirit, of course.
"with their freedom lost all virtue lose" - Milton
We can give up all our remaining freedoms but the only "tech" a "terrorist" really needs is the commitment to die for their cause. How do you 100% guard against that? I fear for our children's children.
He was completely off by about 19 years.
134340: I am not a number. I am a free planet!
Sounds like its time for the geeks of America to unite and do something. Reading stories like these make me feel lucky that I live in Europe. I Feel sorry for u people.
perhaps i'm just naive or ignorant, but how would the government being able to snoop on a voip call be any different from a wiretap on your hard line phone? it would have the same effect, and i'm assuming that if the government were allowed to snoop on voip calls, they would be subject to the same guidelines that they have to follow when tapping a regular phone line. can someone with more information clarify please?
"I just want to thank my coach Eric a.k.a. Disco for shattering my reality..."
The law enforcement community has been begging for the unrestricted right to spy on the american people for some time now. I don't know about the rest of you, but I'm much more fearful of government agents with gestapo-like powers than I am of deluded wackos from the 3rd world. The intelligence community already spies on the rest of the world, which is where the threat is coming from. That should be enough. If not, then that is what our military is for, to defend the country against our enemies...which are OUT THERE, not HERE. I'd rather have terrorists over to my house for dinner three nights a week than see law enforcement aquire unnecessary powers that are a greater danger to the public than the terrorism they are purported to prevent.
The abundance of those who would trade freedom for the temporary illusion of security are proof positive that 50% of the population is of below average intelligence.
Muslim community leaders warn of backlash from tomorrow morning's terrorist attack.
I wonder if it would be plausible to get these guys to cease-and-desist under the DMCA.
IANAL, but I kinda doubt it, but it's nice to dream about, no?
This is the real signature
(Beats those shadows on the cave wall, don't it?)
You too can listen in to VOIP with voice over misconfigured internet telephones or vomit for short. It only works for Cisco IP phones, but I hear that this Cisco company may become a medium to large business in the networking industry.
Why can't I moderate something "Wrong" or at least "Grossly Misinformed"?
Encryption? Privacy? There's always VOMIT!
The way things are going, that should read: "safe havens" for dissidents...
Excellent timing yet again for an article related to something I wanted to ask this crowd about.
/.ers!
I just moved into a new office, and the customer left behind a detached Cisco IP phone tossed in the corner. What free software options do I have to put this puppy into service? Best I could find so far was that I need to run Cisco CallManager on the network. I was hoping to find that the proprietary protocol has been cracked and is supported by Gatekeeper or something. So far, no such luck.
This unit is a 12 SP+. What can I do with it?
Thanks
Intelligent Life on Earth
They now include Canada in the free calling area. No more international fees to call Vancouver. Yay! Oh, and the "virtual number" thing is cool. For an additional $4.99/mo, I can get a (916)xxx-xxxx phone number that routes to my home phone.
Pretty cool setup.
VoIP already stresses the networking and hardware limits in order to provide the "quality" that they do now. Many people think that encryption is a solution, but I don't think it is right now. PGPphone is NOT VoIP, but software encrption for the landline telephone network (i.e. audio encryption). But adding encryption to actual VoIP would lower the quality of service considerably. Ever try using VoIP over VPN? It is really bad. You can use google to find articles about how to turn VPN off for just VoIP so that you can still have good sound quality.
The only protection against eavesdropping is strong end-to-end encryption. We got the ECPA (86 - US) shoved down our throats so cellular companies could claim their systems were "protected" from unauthorized monitorin without having to actually spend money on embedding crypto hardware in subscriber units.
CALEA was just a pitiful attempt to keep LE agencies from having to spend big bucks on upgrading their monitoring hardware.
If an individual, organization, government agency, or other entity wants to monitor your communications badly enough they will. If you don't like that then use stong end-to-end encryption.
--BEGIN RANT MODE--
Instead of wringing you hands over the evil and unfair world we live in just deal with it and work around it.
Its not exactly difficult to properly encypt just about anything you send. How many actually do it? Want to bet those same people that can't be bothered to use strong encryption are some of the first to whine about monitoring?
--END RANT MODE--
In God we trust -- All others we monitor
Ofcourse we should be worried about terrorists using Voice Over IP, because I'm sure that Bin Laden has a computer in that cave of his and Hussein has a better knowledge of computing than Linus Torvalds (heaven forbid lol)... Seriously though, I think this is just another excuse for the larger government agencies to have a better grip on the people of their country, take Echelon or Carnivore for example... Both made for security but at the cost of many individuals privacy. I'm not necessarily against more protection for our countries, I'm just saying that our privacy is a big price to pay in order to get it.
Now let me get down to the goverment conspiracies, oh wait... someone's at my door, brb...
BOOM! **dead**
Business \Busi"ness\, n.;
A scam in which all people involved perceive as beneficial...
People have been saying "Orwell was only off by {abs(year-1984)}" or variations thereof since 1949, at least.
I just replaced my home phone with a voip phone from packet8.net. I also considered vonage.com
Am I to understand then, that currently law enforcement could _not_ get a wiretap order to listen in on my calls? Being a privacy advocate I like this very much, maybe a temporary solution for criminals everywhere. FYI vonage uses cisco ATA's but packet8 has a proprietary solution. I hope that when people listening in on voip calls becomes more common place they upgrade to an all encrypted system.
Then all we'd need to do is get more people using PGP/GPG for email and all the spy power in the world isn't gonna help big brother. boo hoo.
My Linux Command of the Day site : LCOD
This is just another job for good encyption.
It's a done deal.
It's Christmas everyday with BitTorrent.
Been around for a long time. I used the STU-III secure phone back in the late 1980s. http://www.tscm.com/STUIIIhandbook.html
WTF?!? Is anything that does not pass through a "normal" distribution channel now comparable with Napster? Other than using a computer network, how is VOIP anything like Napster?
It seems like journalists love to compare things with Napster just to give those things an slight taint of naughtiness.
The right choice is to build the encryption into the VOIP protocols themselves, which the initial H.323 and (I think) SIP standards didn't do. That way, it's not something that might or might not get patched on later, it's secure by default. The amount of CPU overhead is trivial - RC4 is blazingly fast, but even if you're using Triple-DES, it's on data you've compressed down to 8-16kbps, and the voice compression takes a lot more horsepower than encryption. I think some of the later standards have some crypto, but I don't know if they're in use.
Of course, crypto only covers the VOIP part - if you're using a VOIP-to-telco gateway in either direction, the telco side is unencrypted and subject to CALEA regulations, which are as technically onerous as they are invasive.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
that the public accepts reasons like this as valid; the only reason wiretaps were allowed in the first place was because it made sense in some situation.. like
"Hey, we are trying to solve this here crime, and we think this guy is using thsi here phone, can we listen in? OH cool."
Now the ability to snoop has become a feature that must be present or the government has a fit.
Another problem is non-telco VOIP carriers. The regulations are pretty clear for regulated telcos - they're much less clear for people who aren't. For instance, if the PBX at your office acts as a gateway for all your coworkers who have VOIP hardware phones or software phones on their PCs, and DSL at home with VPNs to the office - CALEA lets the telco wiretap your company's phone system at the telco trunk, but they don't know that extension 1234 is your coworker "Bob" who's also selling ganja on the side. And as VOIP carriers become less legacy-telco dependent, what about calls that only use the carrier as a presence server (e.g. ICQ or equivalent) to set up the connections and do the actual VOIP part user-to-user - they'd like to be able to wiretap your ISP.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
FYI,
Jeff Pulver is a great guy to network with in the SIP VoIP industry.
The German's also have a similar site to Jeff's at iptel.org. The iptel.org Web site appears to have over 65,000 accounts. They are working on SIP Instant Messaging and Presence Leveraging Extentions (SIMPLE) server infrastructure that could give the Microsoft RTC a run for its money.
There are plenty of providers or carriers that provide SIP services here are a few.
Business Grade:
1) Worldcom
2) Webley
3) Denwa
Consumer Grade:
1) Delta Three
2) Vonage
Because SIP servers proxy and registration servers can be anywhere in the world CALEA can't be enforced at the server end. Thus, support for US CALEA laws would have to be provided by the ISP or carrier providing the broadband service. (Most of the SIP VoIP phones support or default to G.711 CODECs that consume 90 kilobits per second of bandwidth.)
I highly recommend using the Intertex IX66 firewall with SIP hard and softphones. Its OS is Linux and interoperates with a very large array of SIP products. (The ipDialog hard phones are also Linux-based.)
There is plenty of open source SIP server software on the Internet:
1) http://iptel.org/ - FhG Fokus spin off, written in C
2) http://www.vovida.org/ - really Cisco, written in C++
3) http://dns.antd.nist.gov/proj/iptel/ - The National Institute of Standards is to release Java JAIN v1.1 reference implementation shortly
4) http://www.siptrex.org/news/ - an IP Centrex framework using older NIST software from the University College London guys
Bye,
Skaht
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Amazing what the consequences of 157 votes and some hanging chads can be...
Actually, I agree -
I made the mistake of Googling for the list and came up with someone's modified list. (And failed to read it before posting)
I first saw that feature years ago, back when I used to use emacs, but since then I have switched to vi and don't even install emacs any more.
The original list was a bit better, though now really dated.
I thought the whole idea of inserting keywords was a bit useless back then, but mildly amusing.
-- My Weblog.
I never said the answer was easy or convenient. I only said there was an available set of solutions.
Laws only exist to keep honest people honest and punish those who break them when they are caught.
I would not depend on the rule of law to protect my sensitive communications from interception and exploitation by entities that may desire to do so. Its illegal (in most countries) to steal credit card information and use it to make fraudulent purchases. We don't, however, rely solely on the protection of law. We insist that vendors we do online business with use proper cryptographic protection of our card information during the transaction, and we hope they take steps to protect it once they've got it. Why should our voice communications be any different?
I find the likelihood of effectively constraining the evil and unfair world very low. Its good to work toward it, but in the meantime I'll keep running encryption where I feel it is warranted.