Compressed VoIP Calls Vulnerable To Bugging

holy_calamity writes "Security researchers at Johns Hopkins report that a variable bit-rate compression scheme being rolled out on VoIP systems leaves encrypted calls vulnerable to bugging. Simpler syllables are squeezed into smaller data packets, with more complex ones taking up more space; the researchers built software that uses this to spot phrases of interest in encrypted calls simply by measuring packet size."

Comments

Re:Do what my grandparents do

[smitty97]

That or you could just learn Russian... I don't think they *have* any simple-syllable words in Russian :-) In Soviet Russia, VoIP bugs you!

Evasive, ummm, technology

[martyb]

FTFA

In tests on example conversations, the software correctly identified phrases with an average accuracy of about 50%. But that jumped to 90% for longer, more complicated words. Wright thinks these phrases may be the most important. "I think the attack is much more of a threat to calls with some sort of professional jargon where you have lots of big words that string together to make long, relatively predictable phrases," he says. "Informal conversational speech would be tougher because it's so much more random."

So, ummm, what we should do to, umm, well, protect ourselves from, ummm, yaknow, eavesdroppers, heh-heh, is well, make sure there's enough, ummmmmmm, yaknow, like extra noise, like, mixed in, dude.

Re:Evasive, ummm, technology

[gstoddart]

So, ummm, what we should do to, umm, well, protect ourselves from, ummm, yaknow, eavesdroppers, heh-heh, is well, make sure there's enough, ummmmmmm, yaknow, like extra noise, like, mixed in, dude.

Oh my god, thats like, totally, like, a great idea, yaknow. I mean, like, they'll never figure out what we're, like, saying, yaknow?

Oryoucouldspeakreallyfastwithoutpausesbetweenwords. Thatwaythey'llneverknowwhatyousaid =)

Or. We. Could. All. Speak. Like. Shatner. Random. Long. Pauses. Genius.

Cheers

Re:Evasive, ummm, technology

[Anonymous Coward]

Or. We. Could. All. Speak.
Like. Shatner. Random. Long.
Pauses. Genius.

You're missing one syllable in the middle line...

Here's a thought

[mhall119]

Encrypt the data first, then compress it.

Re:Here's a thought

[Anonymous Coward]

I just threw something together in Python that will compress encrypted data at a near 1:1 ratio.

Re:Here's a thought

[oodaloop]

Voice data just CAN'T be securely encrypted. Really? I have a Top Secret phone on my desk, and I can assure you it's pretty secure. (And no, it's not a shoe.)

Re:Here's a thought

[gstoddart]

In case you can't figure it out: good encryption makes data look completely random. Do you know of any algorithms which compress PURELY RANDOM data? I sure as hell don't.

Sure, drop every other byte. It'll be half as big. ;-)

Cheers

Re:Easy Solution:

[Daimanta]

""Music in the background" is not a security solution. In fact, that's a freaking joke."

Yes, but a joke you can dance on.

Re:Do what my grandparents do

[markana]

>That or you could just learn Russian... I don't think they *have* any simple-syllable words in Russian :-)

Da!

Re:Do what my grandparents do

[mlwmohawk]

Just speak arabic!! We already know the FBI and CIA don't have enough translators.

Re:Do what my grandparents do

[hummassa]

That or you could just learn Russian... Which would give you an advantage, if you ever have to pilot a bleeding-edge mind-controlled Russian jet fighter.

Re:Easy Solution:

[martin_henry]

Awesome....a VOIP dance party.

Re:Do what my grandparents do

[Anonymous Coward]

Da!

solution by obfuscation... heh.

[Anonymous Coward]

Merely utilize the stupendous wealth of complex language alternatives located in the voluminous expanse of your thesaurus to inflate your unimportant topics of conversation to prodigious lengths, and leave the vital ones to sound so simple they don't pay them any notice!

Anyway, what's the use of this? "Oh wow, they must be talking about something interesting. Now if I only knew what they were saying..." The simple fact that the communication is being encrypted would allude to that.

Re:Easy Solution:

[gstoddart]

Easy Solution. Music in the background.

Oh, sure, give the RIAA reason to get involved in encrypted phone calls.

They'll try to make sure you're not using unlicensed music to mask your conversations. We'll be seeing John Doe subpoenas to get access to what music you were playing. :-P

I'm only half joking.

Cheers

ode-cay

[fahrbot-bot]

Ust-jay eak-spay in ode-cay.

Re:Do what my grandparents do

[Samizdata]

I worked for a set of commodity trader brothers back in the 80's. One of them, who worked as their corporate attorney, was in a Club Fed for tax issues.

I saw more than one threat from the Bureau of Prisions warning them to stop using Latvian (their native tongue) during phone calls to the incarcerated.

Re:This is compressed, encrypted VOIP

[6Yankee]

the buggers in government

Oooh. Well played, Sir, well played.