Slashdot Mirror
VoIP Security
An anonymous reader writes "Whitedust are running an interesting article on the security aspects of VoIP. From the article: "The fact that VoIP operates across standard networks makes it vulnerable to all manner of IP hacking - including man in the middle attacks,sniffing, session hijacking, etc." Considering it's recent growth, how secure is VoIP?" PCM2 sent us a wired bit about Phil Zimmerman of PGP working on a privacy system for Voice over IP calling
From TFA:And all these errors are in just the introduction.
Now, I don't expect perfection, but the sheer amount of errors present here is beyond the pale, and renders the reader incapable of trusting the subject matter presented, or taking the author seriously.
Mr. Anderson, about 98% of the errors in your article could have been avoided by the use of a simple spell-checker. Nowadays, people don't actually need to know how to spell, as we have software to do that for us...but you have to actually use the software.
____
~ |rip/\/\aster /\/\onkey
I use Gentoo; how does this affect me?
I have never worried about man in the middle attacks on the internet. To be successful, it requires very good access to my ISP or the backbone carrier's network which is hard to do. Even if they can get that access all they can do is listen to my calls, have a chat with me and the other person or maybe hang up the call. Any attacker listening to my calls is going to get very bored very quickly. If they do the later two, it could cause them to get caught because I'll complain about the problem.
The only security problem I see is if the attacker can learn information that lets him make calls billed to my account. This becomes the VOIP vendors problem anyway. When I notice something wrong with the bill I'll do a chargeback on my credit card for the bill and simply change VOIP providers. If this happens a lot, the VOIP vendor will do something about their security problem.
Or am I missing something?
Cant we just stick to regular telephones? I dont want my 911 call to be interrupted by a denial of service attack...
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
Hi Hun, I am gonna be a bit late tonight
I thought you were going to give me a lift to Tinas?
Thats tomorrow, have you been taking my pain killers again?
No... erm... ok I'll see you later
*click*
Wait, we are being line-tapped
Oh my god! Execute the Omega 13 Device!
*end of world*
Really - if you want security, talk in tongues, or use a third party audio scrambler, plus encrypt the session. (then unencrypted it will just sound like noise). Plus standon one foot while you talk, and occassionally look through the venetian blinds for snipers across the rooftops.
#hostfile 0.0.0.0 primidi.com 0.0.0.0 www.primidi.com 0.0.0.0 radio.weblogs.com
http://www.homestarrunner.com/tgs1.html
Kristin, you look burnt or DEAD.
Because there is no way in the world I could just go to you telephone access box with a phillips head screwdriver and pull your connection.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
There is a program called Cain that can sniff VoIP traffic (as well as other things) and turn it into a wav file if it understands the codec. There is a video on how it works at: http://www.irongeek.com/i.php?page=videos/cainvoip 1
Of course, now ask how many cable compaines are actually deploying fully PacketCable-compliant systems with all the security turned on the way it was designed to be.
Please visit the VoIPsec archives, before assuming that any one article could cover it all. There you could find links and comments from some of the most pertinent contributors to this subject.
== With enough Will Power, one could move mountains. With enough Brains, one would just leave them where they are ==
Was a neat little app a few years back for simple IP-IP VoIP that was (supposedly, never checked) well encrypted, it converted the key in to english words that you could say in your own voice to confirm that you weren't a victim of a MITM attack
http://web.mit.edu/network/pgpfone
/* FUCK - The F-word is here so that you can grep for it */
I think you're mostly correct. The only thing I worry about is the casual call to a company you do business with that requires you tell them your SSN over the phone to set up or make changes to your account.
I'm a big tall mofo.
The majority of people are going to be getting their VOIP service from someone sitting in their basement, or from Skype or somesuch. Their going to get it from their ISP, which will provide a security layer of some sort - separate VPN, encrypted trunks, etc.
Anyone who believes that this is some 'golden age' of free communications is on crack. And cheap crack at that.
-- I care not for your foolish signatures.
If you have a set of aligator clips and a phone. Or a set of diaganol cutters (DoS attack).
I mean, really
- Brian Roach
Wouldn't it be simpler, more effective and thus cheaper to secure IP communication instead of securing Voice over IP, HTTP over IP, SMTP over IP, FTP over IP and whathaveyou over IP? There even is a standard for secure IP communications, inconspicuously called IPSec. Stop the nonsense and start using encryption where it benefits all protocols.
Can't something like OTR (Off The Record messaging - http://www.cypherpunks.ca/otr/) be applied to SIP or IAX conversations? I know it was designed for slow, IM-type packet traffic, but the crypto is there. It can't be that hard :)
There was once a product called PGPFone that would do VOIP with PGP encryption. I have not seen anythign about this is wuite a while. Is the project still around?
I mean, negotiating a private key between two hosts is trivial, just use the good old DH key exchange thing. Could even use IPSEC for the actual encryption, no need to reinvent the wheel and add crypto to the VOIP protocols, just do those security associations when you setup a call.
:(
The downside is, that a MITM is possible to get the key, but that's pretty damn unlikely compared to people just sniffing and listening to your call or blindly injecting data to an existing one. From what information is available about Skype, it does something like this, I believe.
But, designing horribly complicated systems that cover the corner cases seems to be the norm, and those get ignored due to complexity and thus everyone does the unencrypted thing in the end
Their website lists their numbers as: "Tel: 00353 - (0)87 - "...etc numbers, so they're not in North America.
This: (Mon, 14 Feb 2005 16:57:12 +0000) also suggests a European country (I think). So maybe English isn't their first language.
Anyone have experience or opinion on Speakeasy's VoIP service? They claim it all takes place inside their 'private network', but is it really safe? As an alternative to the bells it's very attractive, plus it's less expensive. It would be handled through my DSL, which I get from them, and it hasn't been down since we got it in feb of this year.
bad_outlook
--
Is this vague enough for you?
The Cisco callmanager can set up calls to be encrypted end-to-end.
My biggest concern for VOIP is SPAM. Imagine the network sniffing your VOIP (or data) traffic and deriving the hours you are most likely to be at home. Useful info for direct marketeers or for your bombardment with pre-recorded audio advertisements per VOIP. Your VOIP phone will pollute as quickly as your email inbox. Icreased nuisance at a yet unknown magnitude.
Since when have good old fashioned telephone systems been secure? I can't count the number of times I've picked up a neighbor's conversation from their cordless phone. Although I'll agree that the scope of the attack may be broader with VOIP (after all, my neighbors phone only puts out enough power to be picked up within a certain proximity), I think an expectation of privacy on any current phone system is a flawed assumption at best.
>POTS is damn near 100% reliable
My phone company charges $12 for my no-frills service. Somehow the bill I pay is $45 after all the fees and taxes. Those extra charges are the main reason I'm considering bailing from POTS to VoIP. They'll catch up sooner or later, but for a time, I can keep some of my money.
Heck I might have some cash to enter the sucker mill^H^H cell phone subscriber pool.
VoIP not secure?! Oh noes!
Next they'll be telling us that crazy things can happen like getting your regular phone line tapped...I mean, total crazy talk here.
http://www.acmqueue.org/modules.php?name=Content&p a=showpage&pid=209
Considering I can walk up to 90% of the houses on the street. open up the phone box, and plug a lineman's handset (or anything else) into the phone line...how secure is the PSTN?
If you think the PSTN is really secure, you might want to look through some old issues of 2600...
-- OpenVerse Visual Chat: http://openverse.com
It's all about communications. Some will argue that we should overlook the errors. I try to do this, and I sometimes succeed when there is enough meat on the article to make it worthwhile to mask out all the bad spelling and grammar "noise." When the article is as basic as this one is, however, I find myself in your shoes -- very unhappy about how hard it is to read the darn thing.
On the other hand, I find your complaint somewhat hard to read as well, because (IMHO) the mistake of writing "amount of errors" when you should write "number of errors" is almost as egregious as the original spelling mistakes.
ARE YOU GAY WASTE OF BITS AND one common goal - I thought It Was my core team. They some of you have are looking very were compounded
Wow, I *never* realized that you could do all of the same things to VOIP that you could do to a regular phone line with a couple alligator clips.
Folks, you have to remember that this article talks about the so-called nomadic voIP-services.
I've been using VoIP for the better part of two years now, and it's maintained by my ISP. I run it over the Ethernet hookup I have, and as far as functionality is concerned I hardly notice the difference from POTS.
Outages? I've had two. Once when my apartment lost power (thus the VoIP-box lost power) and once when some major link in my ISP's chain went down. As a matter of fact, I've had FEWER problems with VoIP than POTS. My ISP/Telco also didn't charge for the days (two) of outages, of course.
As for packet priority, I can max my line, and since the phone is a non-nomadic VoIP the sound is still crystal clear since the ISP uses traffic-shaping (or something) to always put priority on the VoIP-packets.
I enjoy large posteriors and I cannot prevaricate.
I wonder how long it will be until things like VoIP encryption is illegal to implement on the user-to-user end. Once the government catches wind via some wacked-out organization, they're going to be pushing legislation to ban such products - all in the name of preventing terrorism, of course.
Heck, my opinion is it's only because of the history of the open nature of computing that this industry is allowed to have encryptions like SSL where the government can't tap the line.
And if you don't believe me, see the recent treaty discussions going on in the senate right now that requires participating nations to take up laws which include wiretapping.
A community-oriented lyrics site
Why not to try Skype and then talk about VOIP security? Skype uses AES (Advanced Encryption Standard) - also known as Rijndael - which is also used by U.S. Government organizations to protect sensitive, information. Skype uses 256-bit encryption, which has a total of 1.1 x 1077 possible keys, in order to actively encrypt the data in each Skype call or instant message. Skype uses 1024 bit RSA to negotiate symmetric AES keys. User public keys are certified by the Skype server at login using 1536 or 2048-bit RSA certificates. It's really strong VOIP encription. I think skype is great, and skype community is growing, thank to share.skype.com blog. Skype gives free SkypeOut day's, two more left. And I use http://skype.i-loveyou.info/ to don't miss any of that days.
Why not to try Skype and then talk about VOIP security? Skype uses AES (Advanced Encryption Standard) - also known as Rijndael - which is also used by U.S. Government organizations to protect sensitive, information. Skype uses 256-bit encryption, which has a total of 1.1 x 1077 possible keys, in order to actively encrypt the data in each Skype call or instant message. Skype uses 1024 bit RSA to negotiate symmetric AES keys. User public keys are certified by the Skype server at login using 1536 or 2048-bit RSA certificates. It's really strong VOIP encription. I think skype is great, and skype community is growing, thank to share.skype.com blog. Skype gives free SkypeOut day's, two more left. And I use http://skype.i-loveyou.info/ to don't miss any of that days.
Try telling this to a judge. In the event that a security breach does take place (resulting in, for instance, loss of customer data), businesses don't want to be in the position of saying "but you could have sniffed that traffic just as easily on a POTS network, your Honor." Using POTS is the standard for security, and as bad as it is, you don't unduly expose yourself to liability by using traditional telephone lines.
If you run a business and dicuss sensitive information over the phone, you're exposing yourself to an unncessary risk by using VoIP. The addition of encryption would make VoIP more appealing to businesses, and (done properly, ideally with end-to-end capability) would even be a significant selling point.
I would have thought the obvious solution would be something like SIP over SSL {which should be easy enough to set up, if Asterisk doesn't already have such a feature}, but maybe I'm missing something obvious about SSL that would preclude it.
PGP-type encryption would be good {key servers, if you use them properly, are incredibly powerful: post your out-of-date private keys and now nothing you ever signed using any of them can be authenticated!}, but it isn't transparent.
Whatever solution is adopted, it must be network-transparent, and the user must have the right to view the source code. The Authorities no doubt would love us to be using something they can tap, on the basis of "protecting" us from terrorists and drug dealers; but if terrorists and drug dealers are known not to be using the system because they know it can be tapped, then there's no point tapping it in the first place!
Je fume. Tu fumes. Nous fûmes!
Considering it's recent growth
"its".
There's already an encryption spec for VOIP. Nobody seems to use it.
I'd worry about the market for a new product when the demand has already been tested and found wanting.
Then there's always the option of running your calls on a VPN, as several people have pointed out already. That's what I would suggest to a potential client in an initial consultation.
VoIP is *more* secure then your PSTN... with the PSTN any doofis with a butt-set can climb the pole outside your house... or worse yet go OUTSIDE your house and tap into your line.
With VoIP you have to actually be on the network.. and not just on the network.. but IN the packet stream.
Hacker A who is on a server off the switch can't listen to your conversation... they woudl have to interrupt the packet stream flowing through the router.
WTF mate! I found out my ex-wife was cheating on me by picking up the extension phone in the other room and listening to her talk to her boyfriend. With POTS, anyone with a $10 Walmart phone set and a set of alligator clips can open the phone box on the side of your house and listen to (or for a few dollars more record) your conversations. And anyone who understands Signalling System 7 can conference themselves into your calls through the phone company switch.
Calling VOIP insecure is by comparison like a nudist complaining that a woman's skirt is too short.
"Sic Semper Path of Least Resistance"
We work with a bunch of local phone vendors who always dictate that for site to site voip to be used, we need to setup a site to site VPN (or point to point circuit). It is my suspicion that they do this so that
1. they don't have to be bothered with trying to figure out what ports to forward on the firewall and
2. they have so much difficulty in troubleshooting their own systems that they love to blame everything on us.
In any event, I picked up the new o'reilly book on voip and they talk a lot about avoiding vpn as it creates lag. They also indicate that sending all of your QOS flagged traffic down a VPN tunnel eliminates the ability of the upstreams to "see" the QOS flags as they are encrypted. Anyone else have experience with this?
If you have physical access, you can do a lot. The problem otherwise with anything-over-IP is the potention that a kid in Russia can hack your connection while you are in Canada....
We all abuse the apostrophe, just by posting on Slashdot.
--
make install -not war
This article http://acmqueue.com/modules.php?name=Content&pa=sh owpage&pid=209
covers the subject of VoIP security nicely
every stain tells a story
It is far easier to intercept the middle than you could ever believe (though, about 3 years ago, I would have agreed with you).
The real problem is that the man in the middle may handle the conversation in any way that they see fit. They can then place any set of words in your mouth (and the other parties). It becomes possible for various groups to total misdirect you or the other parties into certain directions. Interestingly enough, this can be used to provide for false convictions. And yes, this is very doable.
Think of somebody doctoring a photo. 7 years ago, it was hard to do, but it was doable. Now, it is trivial to do so. The same is true of VOIP.
VOIP security should have been designed in (with a clean policy/implementation seperation), but it is never too late to start.
I prefer the "u" in honour as it seems to be missing these days.
The key difference between traditional telephony and VoIP is the way the calls are handled across the network. Traditional POTS telephony uses circuit switched connections, meaning that an attacker needed physical access to some piece of copper along the called path to perform a man-in-the-middle attack. With IP communications it is possible for attackers to "touch" the path of the call from a remote location. http://ettercap.sourceforge.net/ Both methods are insecure and suffer from physical security issues. It's just that without proper network security the physical area of an IP network is easily extended and therefore susceptible to more attackers.
"Who could blame him [Phil Zimmerman] for laying low for a while after the Justice Department launched a three-year criminal investigation of him in 1993? Officials accused him of violating a ban on exporting cryptography when he made PGP available for download on the internet. The government finally dropped its investigation in 1996."
The Justice Department officials who "investigated" Zimmerman (persecuted him) set back the availability of privacy tech by at least half a decade, right when the Internet exploded into everyone's private and professional lives. They never found anything bad on Zimmerman, and crypto export restrictions were sensibly lifted in light of the extremely favorable cost:benefit to American economic security (the basis of all national security). But those officials, who did such damage, suffered no repercussions for their fruitless persecution of Zimmerman.
How long, after Zimmerman's VoIP privacy tech gets some buzz, will it take for some new Justice Department freak to target Zimmerman this time? With the context of "cyberterrorists", portrayed as "out of government reach" with Internet cryptophones, so easily saleable to the American public terrorized daily by government actions in the Terror War? Zimmerman's willingness to reenter that war, after being burned, shows that he's the kind of patriot that the government can only pretend to be when naming laws and missiles.
--
make install -not war
To be successful, it requires very good access to my ISP or the backbone carrier's network which is hard to do.
Actually it's trivial - by subverting the call setup negotiation. They don't even need to subvert the carrier's servers - replacing or inserting a SIP proxy via, for instance, DNS cache poisoning would do the job. With call setup corrupted the actual streams can be routed through any machines and paths they want.
Even if they can get that access all they can do is listen to my calls, have a chat with me and the other person or maybe hang up the call.
I take it you're OK with, say, a spook agency, police departnemt, business competitor, or foreign government agent recording all your conversations (and their endpoints) and feeding them through voice recognition algorithms to identify those of interest. Also with a phisher tapping your conversations with your bank and credit card company?
And with anybody with adequate tech carefully putting words in your mouth - but only as heard by the ear of the person you're talking to (or words apparently from THEIR mouth to YOUR ear)? Maybe your rival for the other person's affections? Or with a new COINTELPRO operation by the FBI convincing your Significant Other that you're cheating (as they did to a number of '60s/'70s activists)?
I could go on listing potential bad stuff all day. The more tech, the worse it gets.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
...Then create SSL VPN tunnels with OpenVPN (X509 PKI, TLS) between PBXs and enjoy.
It's amazing what good design can do to improve security.
"Oh you mean just setting up random SIP connections over the net is a bad idea?"
I care about security as much as the next guy but comparing POTS or even centrix security to VoIP is ridiculous. What about physical security that many have mentioned? I want to maintain 99.999 without having to worry about some jagoff with a backhoe whether he is driven by some virulent strain of Islam or is just a stupid ass. Much less a single leaky capacitor that has no backup system in place. So far it seems that even above ground, in my area, the ISPs have put more into redundant paths than the PSTN.
Hell, we ran into a single point of failure 120 miles away at a NOC on a cellular data network back haul router. Which took 6 hours to pinpoint by AT&T -> Sprint -> SBC -> Cingular -> AT&T/Cingular -> AT&T finger-pointing. At which point it was determined that the endpoint (AT&T GPRS private APN firewall router middleman) was flaky.... but they were totally able to loop up the T1 from the TELCO which proved there was no problem, bah!
The tech support were friendly but clueless and equipped with all the right info from the first minutes of the outage by myself...which WE detected 30 min after it happened through our own standard public safety system troubleshooting, and they were still totally unaware of it. Yeah 30 minutes is quite a lag time but consider I had to dial in from 3 towns away(26,400) after 10 minutes on the phone to verify dispatch wasn't just crazy. It took 10 minutes for them to notice the problem and qualify it for emergency service.
Yet a simple ISP with some nagios running would've found it faster but had dual paths to prevent (more than 30 seconds of) downtime. We intentionally took down our Internet link in an infrastructure replacement and the poor guy in the ISP NOC dug through outdated contact info for a while until he called his boss and eventually my cellphone to report the outage THAT'S SERVICE. He was actually concerned when he called too, could've been related to his boss but still. *I* had to calm *him* down, and there was definitely a sigh of relief on his end when I explained. I felt bad for not notifying him. He insisted I call back when we were done to verify connectivity. Where do you find that type of service?
TELCO didn't see the problem, or go to the trouble of calling us if they had. When we called them they were courteously-flippant and blamed us at every turn until they found they were wrong. Guilty until proved innocent is definitely their modus operandi.
Maybe my region is better, but I'm pretty much in Podunk. My vote is for VoIP. I realize that the cost is much more significant for the telco to do the same thing with available technology and infrastructure, that is my point exactly.
The author failed to mention that the Avaya SNMP community string can be changed using the "SNMPSTRING" parameter. Even though the MIBS are read-only, SNMP access can also be restricted to administered IP addresses using the "SNMPADD" parameter in the phone configuration file. For more information see the following: http://support.avaya.com/elmodocs2/4600/233507_2_1 .pdf