Slashdot Mirror
Is Security Holding VoIP Back?
phoneboy writes "Voxilla is running a piece I wrote on security issues present in Voice over IP. While an increasing number of people are ditching their ILEC in favor of using Voice over IP from companies like Vonage, VoicePulse, Packet8, and Broadvox Direct, there are a number of potential security issues to be aware of. Is VoIP secure enough to replace the PSTN as we know it?"
Considering we've been using PSTN for about a hundred years, and we've had absolutely no security whatsoever, something based on IP should be better. There are workarounds, at least, for the lack of security in IP; there aren't as many (if any) for PSTN.
libertarianswag.com
Just look at how many unsecured wireless networks are out there. And most cordless phone users had no problem speaking of easily listenable frequencies for many years.
Whoever said PSTN was secure? All you need to sniff is a wire and the right equipment. And it's easy to do.
I don't want VoIP. Depending on the Internet for all communications (e-mail, IM, and phone) is just a bad idea.
As usual, Michael's title is misleading.
Security is not holding VOIP back.
Security is just one layer that needs to be implemented, particularly when VOIP becomes more widespread. It has very little to do with adoption- just look at how analog cellphones prospered. We all know how easy those were to listen to.
Nobody said landlines were particularly secure either. Anyone can tap a phone line or phone box for that matter and listen in on your conversations. There's few encrypted landlines around. It's also easy to listen in on cellular or wireless handsets with relatively inexpensive equipment. So for security, neither are very. If you want security you need fiber optic (VoIP or not) that measures light passing through the fiber and can detect if some of it is being diverted to listen in. Only the military and the Illuminati needs something like that.
What landlines ARE, though, are more reliable. I don't want to have my VoIP phone crash on me or have packet loss when I'm trying to call 911 because of a heart attack. You don't get two chances at that to call again, reboot, or whatever.
Today's Firewalls dynamically open and close multiple ports as required by VoIP signaling protocols such as SIP, they remain ineffective in securely supporting unsolicited incoming connections. NAT prevents two way voice and multimedia communication, because the private addresses and ports inserted by the client devices (SIP phones, video conferencing etc.) in the packet payload are unable to be routed in public networks. Therefore, incoming calls that are in any service intended to replace the PSTN just are not possible with todays existing NAT/Firewalls.
I think the main thing holding VOIP back is the Baby Bells, who have a lot to lose if they keep pushing it. SO it's up to the startups like Vonage to publicize the benefits and the low cost. Unfortunately that will take a LONG time as people just don't know about it.
Best Community for Gaming and Gadgets!
like PSTN 2 aligator clips and a regular handset secure? ;)
Hell, when I *ahem* hung around people who beiged boxed we didn't even have aligator clips. Holding onto the wires was cool until a the phone rang
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
regular phone service is secure (and does not need encryption) since the network it is using is considered secure. Climping up on phone poles is not only a lot of work, but gets you easily arrested as well.
On the internet on the other hand, you can take your pick of about 500k ready to use backdoored hosts at any day. Just pick one close enough to your target. If you are desperate, buy one of the routers in the path on IRC for a few stolen CC numbers.
What we need is a simple and fast encryption method for VoIP. Similar to the phone network, it doesn't have to be 'Fed prove'. This may make it possible to come up with something simple that will not cause excessive latency.
Of course, one issue with VoIP is that its kind of stretching the limits of current infrastructure. So any added overhead may break it.
---- join dshield.org Distributed Intrusion Detec
First and this one goes for cell phones too.
With most voip app's they just shutoff the microphone when the person isn't talking. This produces an weird silence. Cell phones have to do the same thing to conserver power but what they do is, Place confort noise. This keeps the person thinking that the call is still going. (This is what really turns me off about VOIP)
Another beef I have with voip.. NOthing seems to be standerdised. One voip app does not work with another.
I just think its not the correct way of going about creating a network that is designed to be directly connected. The network that pstn is based on has a niche. Where else are you doing to get a virtual connection without having to bury your own lines to every office. (forgot the terms at moment)
It's extremly hard to talk to someone when A. You have a delay. B. You have missing packets that interupt the signal, Thus you get dropouts.
Now I do like voip in games.. That confort noise I was talking about, Is now takin over by the sound the game makes, and so the silence inbetween isn't so weird.
I have heard about sprint doing voip networks with their own network to get around the ping/packetloss/QOS that is not a garantee on public networks. But I view it as if They want to have a packet based voice network they need to design it from the groundup to just work instead of just layering it ontop of IP. They then need to submit this to the standerd association, So that phone companys don't have to convert/recompress and signal with eath in and out on the network. Otherwords a more lossless operation.
Well thats my beef.
So which way are we headed?
It's quite ironic that the internet spread as rapidly as it did because people were able to use internet over dialup, and today, the discussion is about how to replace the existing PSTN architecture with VoIP.
However, I think sooner, or later, people will make ALL there phone calls using internet enabled mobile phones. So what protocol are they going to use? Or is it going to be a mix of protocols, say, if a Canadian were to talk to a friend in Australia?
Nothing to see here
..is the internet ready for the mass migration from PSTN?
With all the lag and overloading on the internet, is it really ready to handle a jillion voice streams running over it with the expectation of quality and reliability of PSTN?
As a geek type, I'd love to see it come together to widescale use. But as a business type, it seems to unreliable for official use yet. Most businesses can tolerate their internet connection being down for a period of time, but I don't know any business who can tolerate a phone outage short of sending everyone home.
-m
http://www.invisik.com
What annoys me the most is that cell phones still are not treated as "normal" phones by the key places where it matters, such as credit cards, etc. If I pay a monthly bill on a cell phone, and I need a positive credit rating to even get that service plan in the first place, why is that not good enough to establish credit? It annoys me that even though it seems like something that has been overlooked, it also looks like we're just giving extra business to land-line providers. I have no need for such a telephone line, but I will probably have to get one the next time I move as it still is a requirement for many things.
I am feeling fat and sassy
You try getting a trunk that has SS7. Oh wait you can't.
You say that you the pstn is insecure.. Have you tried lately to 'hack' into one, well besides being able to listen to whats on a analog line. Tell me how a cellphone is insecure (They have encryption and cdma is pretty secure by itself.), or how a isdn line is insecure.. Those are circuit based networks. (well cellphones are a hybrid)
Tell me how would you go about overhearing a circuit in this circuit based network? You can't. The fbi can, But that hardly makes it insecure. Circuit based networks by their very nature are actually highly secure networks. The only person you really have to worry about is the one in control of the line, if you dont' trust them you go with someone else and use encryption..
Now packet based networks are the ones you really should be worried about. Anyone that is on your network segment can sniff your packets. Now if they are encrypted or not is really kinda beside the point.
The modern ptsn network has out of band signaling (ss7) So you can't do alot of the attacks that the old phone networks were vurnable to. LIke playing your own tones (inband signaling.) So tell me again why a circuit based network out of band signaling is insecure?. (oh you can't get into the out of band signalling other then to dial and thats with isdn which uses isup for its out of band. Which is really limited and firewalled {for lack of a better term at the moment} the switch)
Spend some time using VOIP and you'll want to poke yourself in the eye. And that's on an internal network with QoS. You can put up with a delay on your mail, web, ftp, etc, or even jitter on video, but when audio starts to fart and burp, you'll go mad (MAD I SAY).
And with the cost of long distance nowadays, why would you want to drive the cost of your Internet access up by overloading the network with traffic that is doing perfectly well on it's current medium? I guess it comes back to the question of 'What are you trying to fix anyway?'
-- I care not for your foolish signatures.
It bugs me that the vast majority of cordless phones for sale and purchased are unencrypted mini-radios.
Digital Spread Spectrum phones provide a reasonable amount of security, certainly orders of magnitude better than 'regular' cordless phones. DSS phones have been around for years, but for the sake of a few bucks and a lack of product knowledge, way too many people buy the $49.99 special at Walmart.
One of these day's I should buy or modify something to pickup analog signals so that I can scare/shock my friends/relatives/customers into buying better phones...
Security is just one of the issues why VoIP has not caught on as an end user technology:
Pricing People think that VoIP is cheap compared to normal telephony. Average people spend around USD 200 per year on land line telephony. While VoIP might seam "free" you still have to pay around USD 300 for an ADSL connection.
Device type While it is technically feasible to install a VoIP client on a PC, it is not exactly the ideal device for a telephone. Also - remember that people usually have several phones in the house. To overcome this you would need VoIP "telephones" which look like a normal telephone. These are reletive expensive compared to normal phones, and requires a dedicated power supply.
Incoming calls In order to receive incoming calls you need to have you VoIP device turned on all the time and connected to the Internet.
Availability A normal landline telephone is usually available 99.98 % of the time. If your ADSL reaches 99.7% you should consider yourself lucky. Furthermore normal phones work during power outages. In some countries this is a regulatory requirement for emergency services.
Billing It would be nice if it was possible to make "free" VoIP calls. In most of the world however, it is the calling party who pays for the call. This means that a VoIP call terminated at a Spanish GSM phone will be charged backwards: The spanish GSM operator charges the VoIP "operator" for "terminating" the call, and the VoIP operator subsequently charges the VoIP "customer". The world has more than 1 billion GSM subscribers. In order to be able to call these you need the billing infrastructure in place even for VoIP. This requirement makes VoIP just as expensive to produce as traditional telephony.
Only a land line solution The world is moving voice calls to mobile phones. So far it has not been shown that VoIP is technically or economically feasible on mobile phones?
Quality It is pretty hard to beat the delay characteristics of a normal landline phone! VoIP has severe delay problems on thin access lines such as ADSL. Usually OK for 2Mb/s and up.
After all VoIP is only a matter of changing layer 3 and 4 in the protocol stack. Why would end customers care?
The places where VoIP is used today it is mostly invisible to the end-user: It is used as a cost cutting technology by a large number of long distance carriers. The service however is sold as normal "high quality" telephony. It is also used in a corporate setting for branch-to-branch calls as well as for PABX replacements. VoIP also makes a lot of sense sense as computer-telephony-integration in call centers.
The next majer breakthrough for VoIP will be VoADSL. VoIP all the way to the customer premises. The interface to the customer however will be a normal POTS jack, full customer service and the associated billing!
First of all, if VOIP is supposed to be less secure, what is it less secure than? Less secure than telco service? That doesn't really make sense, because essentially all the people who I call and who call me have telco service. There's no such thing as a 'VOIP call' or a 'telco call.' If you stay with the telco because you think it's more secure, and then you call me, guess what -- your call went through my VOIP provider, so you're not any more secure. Likewise if I got a VOIP box that did encryption on the voice data, it still wouldn't guarantee my security if the person I was calling was using an unencrypted wireless connection on their end. And BTW, even if you're a telco customer calling another telco customer, many of your calls probably go through the internet on part of their journey.
It's also not clear to me what real problems they're claiming the lack of security would cause. The beginning of the article seems to imply that the threat is unreliability due to attacks by hackers. Well, that just isn't the real reliability issue faced by actual VOIP users. The only real reliability issue I've encountered is that when my cable modem service isn't working, my phone stops working. (But so far it's always cured the problem if I just power cycle the cable modem.) It's also worth noting that one of the main reasons we switched from telco to VOIP was the poor reliability of the telco service. We went through a period of about two weeks recently where there were telco guys working continuously all up and down the street, all our neighbors had no telco service (or patchy telco service), and we were the only ones on the block who could actually make a phone call. According to the telco worker I talked to (the big green box is right in front of my house), the issue is just that the equipment is getting really old.
They also seem to imply that there's some sort of a threat of identity theft, or that someone may steal your service. Well frankly, I'm taking a bigger risk every time I let a waiter in a restaurant see my credit card number.
Find free books.
I see 911 as the biggest problem. If you are sharing the phone line with a normal internet, and you need to call 911 while someone decides to download the RedHat ISO's, you are in trouble.
Cheers,
RoadkillBunny
...over at SecurityFocus - Voice over IP Security by Matthew Tanase
Voice over IP actually creates some particularly hairy security problems that traditional approaches really, really don't manage well. Some disclosure: I work for Avaya, one of the big vendors of large scale VoIP systems, though much more for the enterprise market than for anything to do with the public space (Vonage, Packet8, etc).
Lets start by looking at the wire protocols. We have two separate domains within which VoIP operates: Signaling, which determines where a call should route, and traffic, which is the actual stream of speech that needs to arrive at its destination in under a tenth of a second. These are very different protocols. Signaling was originally implemented using H.323, which can be basically thought of as a port of the existing telephony protocols (SS7) to IP.
H.323 is...well...not entertaining to work with. It's a very messy protocol. To a first level of approximation, H.323 is being reimplemented with SIP, which applies the semantics of HTTP to VoIP signaling. SIP is still complicated, but in a more manageable way.
Whether one is using H.323 or SIP to route calls, the actual traffic is moved over a relatively simple protocol entitled RTP. RTP basically involves chunking compressed audio into small packets, attaching a timestamp and a codec identifier, and throwing the packet at the appropriate host. UDP Port selection is managed dynamically by whatever signaling protocol is being used, meaning a firewall either needs to open the entire range of ports that VoIP might use (not small) or it needs to directly parse the signaling traffic to determine what ports to open.
Remember how both SIP and H.323 are both very complex protocols? Add in that complex protocols can hide many security vulnerabilities, and put that complexity in the firewall: Mistakes are made. (That's not theoretical -- a recent mass audit of H.323 exposed holes not merely in VoIP endpoints, but VoIP-aware firewalls. Microsoft, who actually has a pretty impressive firewall solution, was hit pretty bad.)
It's now that we can start discussing the differences between Enterprise VoIP and the kind of PSTN-Bridge VoIP that Vonage sells. Phones in enterprises receive connections from every other potential phone -- in other words, there's generally no central proxy that copies all the traffic towards where it needs to be. In the enterprise world, there's relatively few firewalls inside the corporate network, those that are deployed can be made VoIP aware, and the "central gatekeepers" really only manage directory services (go to this IP for this extension), conference-call mixing, and in the Avaya case, encryption keys.
You don't have that situation in the public realm. Firewalls -- which are everywhere, as deployed through NAT -- simply won't accept incoming connections from hosts that a backend client wasn't communicating with in the first place. But that's almost OK, because the only host a Vonage box needs to communicate with is Vonage itself. So if you actually examine the Motorola device that Vonage is presently deploying, you'll see that it itself accepts almost no incoming connectivity of any form that doesn't appear to come from Vonage itself (just DHCP and ARP, basically). The public providers basically proxy all traffic, because they have to: Nodes on the public PSTN network (normal phone lines) can't be told to just send IP packets at the Motorola device. So the proxying is basically mandatory.
It's ironic that, at least at the moment, PSTN integration carries with it an architecture that's infinitely more wiretap-friendly than what VoIP could eventually become. Tapping a complex mesh where any node often communicates with every other node is difficult-to-impossible to do, at least with any form of reliability. Create a finite number of junction points that must be passed through in order for connectivity to be established, however, and tapping becomes feasible.
AOL Instant Messenger is the most interesting va
I'd say reliability of ones high speed internet connection is the major problem. With a normal phone you know its always going to work. Whens the last time you've had a phone problem with the line coming into your house. You can even use the phone when the power is out. But with voip, power outage or your provider going down takes out your phone too. Until they get reliability up on par with a normal phone line I'm staying away from it.
City College of San Francisco just switched to VoIP for their internal phone network.
It's been a disaster. Phones cut people off, the wrong people get transferred calls, weird noise on the phone line.
I'm waiting for the whole system to go dead any day now.
One of the IT guys who helped install it keeps an analog phone in his office just in case.
At least the fax phone line in Registration is still analog.
I read a Cringely report in InfoWorld where a company had VoIP and when it prevented customers from calling them, they didn't know it until the voicemail overflowed - and then they couldn't call support - because the phone didn't work.
VoIP - nice concept - bad execution.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!