Slashdot Mirror
VoIP's Security Vulnerabilities
garzpacho writes "Experts predict that attacks on VoIP systems could be right around the corner, and are calling for preemptive security measures. The BusinessWeek article compares the current state of voice-over-IP to the pre-spam email era and suggests that spammers could be the first to exploit the system. From the article: 'Here's what VoIP security breaches could mean for consumers. For starters, it's a big channel for spammers. Think of the Viagra ads that flood your e-mail inboxes now. They work because the cost of e-mailing thousands of people at once is so low, only 1% to 3% or so need to respond for it to be worth it, Ingevaldson says. Comparable economics apply to VoIP calls, he says. Then there are potential phishing attacks, where fraudsters posing as banks lead consumers to fake sites. Those and other attempts at identity theft could spring up via VoIP accounts too, experts say. Imagine the messages from relatives of deposed Nigerian dictators -- only this time they're on voice mail, too.'"
Yet Again, I say: use public key crypto and a web-of-trust to authenticate that a call is from somebody who has a reputation to lose.
Nothing to lose? Then the call is lowest priority, probably the bit bucket unless you're expecting an unverified call, or you're just bored and feel like risking a talk with a telemarketer.
(Sorry, it's not my fault that so many current topics are related to problems that PK happens to solve. Really, I do know that there is more to life than spreading-the-gospel-of-openpgp.)
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Am I correct in assuming much of this spam will originate internationally (meaning outside the US and major European countries)?
I would imagine that the "do not call" registry will still apply to VOIP and that national companies will still have to abide by it.
If this is the case, could not a VOIP inbox be set to filter unsollicited international calls to a spam-inbox?
Yes, I understand that there is still the possibility that an unsolicited, international call may be warrented for some or even many - but this seems like at least one way of combating the enevitable deluge of voice advertisement.
My Computer Music Tutorial Videos
All high-speed Internet providers that I have ever had (Comcast, Yahoo/SBC/AT&T) suffer outages periodically - say, about once every two months for several hours on the average, and this is only the outages that I know about, since I don't use my home computer all the time. Happens at work too - at one time our business DSL was out for two days (thank you "new" AT&T). The electrical power has also been out several times. At the same time I don't remember a single problem with my land line. Note that I live in the San Francisco Bay Area, so this is a relatively high-tech place.
You end up depending on both consumer-grade Internet service and electrical power, neither of which is completely reliable. Which is probably OK, esp if you have your cell phone, so I am not advocating against Vonage.
However it strikes me that people generally do not realize that the Internet connection (as the Internet itself) is not completely reliable. At a trade show a sales person was trying to convince of the benefits of their credit card authorization software, which resides on their own server and is accessible as a web service. The idea is that the consumer pays for a service (e.g. in a hair salon) in advance and then gets to use it for a period of time. Not bad stuff, actually, but that is beside the point. When I told her that I am worried about reliability in case the internet connection is down and the customer will not be able to be authorized for the service they already paid for, she looked at me silly and said: "Ihe Interned connection down ? Does that ever happen?" Duh! It happens!
I solved the spam problem a long time ago. It's called 'delete'.
This solution work for me for a while to. But, after wearing out three keyboards in as many months, I realised that it was just not cost effective.
May the Maths Be with you!
Skype has a nice swathe of privacy options for its voice calls. It also supports filtering for a SkypeIn number if you have one, so it only rings if the person is a 'known number' (ie on your contacts list) and everyone else is shoved to voicemail.
I haven't seen options like this on any other VoIP service with a public phone number, anybody suggest any?
How many people can read hex if only you and dead people can read hex?
The way SIP works makes voice spam impractical. Basically, a call is set up in two steps. 1) The calling party sends an INVITE message to your provider's PBX / main server / whatever. This would be vonage, or whoever your VOIP provider is. This 'call' connects, and an audio path is established between your provider and the calling party. From the caller's perspective, he has a live, answered, call at this point. 2) your provider sends an INVITE message to your phone. This establishes an audio path from your phone to the carrier. At this stage, the carrier either connects the two audio streams internally, or can use another pair of INVITE messages to direct the audio streams of the two phones to each other. There's no way for the calling party to identify when that second audio stream has been established; from their perspective, the call exists as soon as the provider accepts the initial INVITE message. Obviously, you could start playing audio at that stage, but there's no guarentee someone's actually on the other end of the line. If you're doing a recorded audio play, you're faced with either loosing part of the message, or playing dead air for a while. The only way around this is to dial the direct SIP extension of the customer's phone, but you need know their userext (which is different than their actual phone number) and the IP address of the user's phone, which is highly unlikely since the end user doesn't even have those bits of information (usually) Furthermore, filtering is easy. An INVITE message has to specify a valid IP for the audio stream to be set up. It's trivial to simply block INVITE's from certain IP's in software, if your carrier / phone supports that. Spoofing an IP at this stage is impossible, since that would just prevent the RTP stream from working, and it also makes it easy to figure out who's actually calling you, since you have the IP of the server the audio is coming from. (assuming your provider did the reinvite bit, which virtually all SIP implementations do) That's totally ignoring the much higher bandwidth requirements of transmitting that many audio streams and associated problems with that.
- News release announcing the arrests
- Complaint filed against Edwin Pena
- Complaint filed against Robert Moore
They do make for interesting reading and outline how Edwin Pena put his scam together.Dan York
Best Practices Chair, VoIP Security Alliance (VOIPSA)
Producer & Co-host, Blue Box: The VoIP Security Podcast
Why do you say this? I have personally been VERY happy with the DNC list. Yes, market surveys, charitable organizations and political campaign calls still get through, but they are a very small quantity as compared to the "WASTE YOUR MONEY NOW!!" calls we used to receive. And you can still ask all of the orgs who can legal call you to put you on their DNC list, which keeps them from calling again.
GreyPoopon
--
Why is it I can write insightful comments but can't come up with a clever signature?