Slashdot Mirror
U.S. Government Issues Report on VoIP Security Holes
ranson writes "PC World is reporting on VoIP technology's threat of being manipulated by hackers, through call interception and DoS attacks on users' internet connections. While these threats are nothing new, the article cites an interesting government report on the topic, as well as its author, who believes a VoIP user's best protection is security by obscurity."
"BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
This has been discussed at great lengths on the Vonage VoIP Forum here: http://www.vonage-forum.com/ftopic5604.html and also here: http://www.vonage-forum.com/ftopic3422.html
Chances of slashdoters reading that 99 page government report are about the same as VoIP being secure.
"As VoIP is rolled out en masse, we're going to see an increased number of subscribers and also an increased number of attackers," says David Endler, chairman of the VoIP Security Alliance
it's easy to see he's an expert. i mean, who else could come up with such an idea? the very premise of it is far-fetched to the point of hillarity. to think that as a product becomes more widely used it is targeted by a larger population...craziness.
The only way to get rid of a temptation is to yield to it.
-Oscar Wilde
I can find a little bit of humor in the situation... If the government finds that a communications system is insecure, they make reports complaining about it (motivating engineers to secure it). If the government finds that a communications system is too secure, they go to court so they can tap into it. (remember the voip wire-tapping ordeal?)
I'm not giving up my copper! No way! It is protected by law. And it is more insecure than most any other form of communication. But has a high degree of reliablity. So I'm sticking to it.
Big buisness is who wants VOIP cause they want to get rid of the expensive telcom infrastructure and gain a higher degree of control.
Rick B.
... sigh, here we go again.
/. story, with a link to an applicable article. You've just desperately clicked the link to the aforementioned article. Five minutes later, you begin to wonder three different and distinct things.
Imagine this, you're far, far away in some distant, lost, Internet cafe. You are deeply in the backwoods of the third world. Your cellular 911, for some reason, isn't working. You see a
1) Is the system locked up?
2) How much is this going to cost now?
3) Is that MODEM actually starting to smoke?
IMHO, PDFs or links, especially unlabelled ones, are less than professional. Please, just say no.
Words to men, as air to birds.
Security through obscurity is one of those strange concepts.
Imagine every person in the world standing in a gigantic field. In the direct center of everyone is a rifle pointed at the sky.
When the rifle fires, the bullet will go up and then come down and hit some poor sap. But if one were standing in that crowd one could virtually count one's self out as being crowned that sap.
Virtually, but not completely.
That's the problem with security by obscurity. Sure it lowers the chances of being hit. But it's not really security at all.
Is it?
You can drastically speed up PDF load times if you disable all the unneeded plugins:
t
1. Install Adobe Reader 6.0 and notice where it is installed.
2. Navigate to that folder in Explorer, locate the plug_ins subfolder and rename this folder to plug_ins_disabled.
3. Create a new plug_ins folder.
4. Move the files EWH32.api, printme.api and search.api from plug_ins_disabled to plug_ins.
From http://www.mozilla.org/support/firefox/faq#acroba
Ok I didn't read the 99 page report (probably some good info in there) but this PC World article is pointless.
Ok so they can DOS your network connection and kill your VOIP. Uhhh, if you're being succesfully DOS'ed you've got bigger problems than your VOIP not working.
Oh and the other horror? They can listen to your calls? As the article points out this is currently trivial with the POTS, and again if someone can succesfully listen in on your full network connection you've got bigger problems than your VOIP not working.
So why should I be scared again? Sounds like anti-VOIP F.U.D. to me.
Iay cryptenay ithway igpay atinlay.
paintball
Yes, it has encryption -- but it's a closed, proprietary solution that's virtually impossible to integrate with anything else.
Convincing all the SIP implementations to support SRTP is the Right Thing as a long-term solution -- heck, just implementing SRTP support for Asterisk would be a big improvement. As an immediate-term solution (particularly for companies using VoIP to connect with remote users or branch offices), running over a VPN (particularly with IAX trunking if you're connecting branch offices, such as to reduce the number of packets sent and so the damage done by per-packet VPN overhead) works well too.
Since the government can't crack/control it, they release FUD to discourage the public from using the system.
In this world only the paranoid survive.
VOIP is actually more physically secure then PSTN. You can't just hook a speaker up to a DSL line and hear the conversation on it. The problem is, your computer, and every router between you and your VOIP provider, is a general purpose device. Other people and services have access to it for all kinds of legitimate reasons; each of these provides places where people/programs can input data that can potentially directly effect your voice communications or get privilage escilation on the device and indirectly effect it. ANY security person knows to be wary of input! And think of all the ways of getting input to (and theoretically compromising) a PC. What we need is a dedicated physical console for VOIP (a small linksys network device running OpenBSD or Linux and asterix sounds good). The actual VOIP data should be sent through an SSH tunnel or some kind of VPN.
------ Take away the right to say fuck and you take away the right to say fuck the government.
i figured you'd be able to get a stream cipher in there without adding more than a couple of milliseconds.
I'd imagine stream compression would be a harder problem than stream encryption.
Of course you've still got to do some sort of shared key or PK exchange, but that's call setup latency so it's no big deal.
This report says absolutely nothing new. If you're going to take VoIP seriously, you need to recognize the application's needs. In this case, some amount of QoS is important, particularly at conjestion points such as the last hop to the consumer. You also need to recognize that like any other application on the Internet DDOS is a possibility. Ain't no different.
;-)
On the other hand, IPv6 will solve all our problems, right?
In the security field, obscurity is not at all considered secure.
isn't the security. Phone calls haven't been secure since shortly after the first one was made. No, the problem with VOIP is working with the fucking idiot phone vendors who do not understand what they are trying to do. I've gotten several calls from local phone guys who don't understand networking in the least and insist that they've assigned proper IP's to the phones at two seperate locations but they won't talk so it is my network problem. They then inform the customer that the problem is with the network and walk off. The phone at location #1 had an IP of 192.168.39.3 and the phone at location #2 192.168.40.5. No VPN between them. They were trying to route the traffic out over the internet connection.
These dipshits sell the customer on thsese solutions and then when it doesn't work (routing probs or dropouts from no QOS) they call us in to sell the customer a couple thousand dollars worth of services and hardware to sell the problem. I don't mind the business but working with a customer who is on the brink of becoming an axe murderer isn't pleasant.
Sending your calls over VoIP is more difficult to tap. Wiretaps grew by 19% last year (pops new window) and not a one was turned down.
VoIP is much tougher to tap by comparison. Remember kids, "Terrorism" is the new "Communism"(tm)