VOIP security question

Posts: 10 · Vonage Forum Associate Joined: Nov 02, 2005 Posts: 10

Does anyone know what if any security Vonage includes? I'm hearing alot about SIP spoofing, SPIT, and other hacks for Voip, and I'm assuming these Voip boxes haven't had the extreme testing for hacking that other internet boxes have. Main concern for me is eavesdropping, secondarily, someone seeing who I call.

Posts: 233 · Posted: Wed Nov 02, 2005 9:28 am Post subject:

Here I speak from an amatuer point of view, but I have seen a lot of discussion on packet sniffing and how to pick up information. So maybe it would be possible to see who you are calling, but a lot of people are more qualified to answer that question than me. But, if you follow the news you will see stories where government agencies are frustrated with the inability to tap Voip lines. I would bet that is limited to a local level.

Here's a story from MSNBC that may explain what I am saying:
Groups slam FCC on Internet phone tap rule

And if you can't get to the link here are some interesting quotations from the article:

Quote:

New regulations making it easier for law enforcement to tap Internet phone calls will also make computer systems more vulnerable to hackers, digital privacy and civil liberties groups say.

Quote:

Acting on appeals from the Justice Department and other law enforcement officials, the Federal Communications Commission voted last week to require providers of Internet phone calls and broadband services to ensure their equipment can allow police wiretaps.

The decision applies to Voice over Internet Protocol providers such as Vonage that use a central telephone company to complete the Internet calls. It also applies to cable and phone companies that provide broadband services.

Hope this helps. With these requirements don't expect any more privacy than you have with POTs lines when the sun sets. But, I suspect you will have all the privacy you need for most residential and business needs. Companies or individuals who need more security I'm sure will have encryption methods or will develop some over time.

Posts: 2257 · Posted: Wed Nov 02, 2005 9:40 am Post subject:

There have been a couple of threads on "recording Vonage calls" here and there that I've read. One method that seems to work is to put a packet sniffer in place, and dump the results into a WAV file.

So, the upshot of transmitting voice over the Internet is that anyone in an intermediate location can pick it up unless the signal is scrambled, which Vonage does not do. It's about as secure as a postcard, or an email for that matter. Vonage does not provide encryption, and they really can't, frankly, because they'll eventually have to "dump" the signal out to the regular telco lines that also do not offer encryption. There are Voip services that do offer encryption, but understand that those will require (1) extra bandwidth to operate, since a scrambled signal will always be larger than an unscrambled one, and (2) the same Voip provider and specialized scramble/descramble apps on both ends of the connection (ie. no calling POTS lines).

So, just like regular phone, your call can be intercepted anywhere along the pipe. As your call gets out to the public routers, though, it'll take different directions and it will become harder and harder to intercept and interpret the further you get from the endpoints.

This is similar to someone being able, very easily, to sneak up to your house at night and install a battery operated transmitter into your home phone box, and listen in on your conversations remotely. However, once the signal gets into the telco lines, it's a little harder to pick out your discrete lines. Once it gets into the telco's switching network, generally you need their specialized gear to intercept a given call or line.

As to hacking, well, yes, technically someone could probably figure out how to spoof the MAC address of your specific adapter and take over your line. At that point, your line would stop working, you'd call Vonage and ask for help, and they'd probably say "hey, your adapter looks funny" and send you a new one with a new MAC. However, as long as you have international calling turned off (as I have), the worst they can do is make a bunch of calls on your line. In my case, since I have an unlimited plan, it might be inconvenient but not costly. Wink

Posts: 10 · Vonage Forum Associate Joined: Nov 02, 2005 Posts: 10

Encryption and authentication are the question. Vonage claims to use a unique security key to identify me on their network. Does anyone know if this is secure authentication or could anyone who sniffed that info get thru?

I agree that once it gets out of comcast's CMTS, it is probably difficult to trace without extreme resources and access (e.g. FBI's Carnivore). And since the Voip router itself is a fairly dumb box, there isn't much anyone could do to exploit it. About the only way I could see it being done is hacking the Voip box to redirect the servers it connects to and run a man in the middle attack. Sophisticated, but I'm not ready to say impossible.

I'm not so sure TLS encryption couldn't be done without too much bandwidth expansion tho, that doesn't seem impossible. True, it would have to be decrypted at Vonages POTS gateway, which is always the other weak point in the system. And there would be significant processing overhead, but the processors exist now. Cert managment also an issue.