Expert Unveils 'Scary' VoIP Hack 103
Kurtz'sKompund passed us a link to a Techworld article on a frightening new vulnerability for VoIP. The UK's Peter Cox has put together a proof-of-concept software package to illustrate the flaw, a program he's calling SIPtap. "The software is able to monitor multiple Voice-over-IP (VoIP) call streams, listening in and recording them for remote inspection as .wav files. All that the criminal would need would be to infect a single PC inside the network with a Trojan incorporating these functions, although the hack would work at ISP level as well. The program can index 'IP-tapped' calls by caller - using SIP identity information - and by recipient, and even by date."
Holy hyperbole, Batman! (Score:5, Insightful)
In other news, experts have revealed that water is scarily wet, the sun is frighteningly hot, and occasionally rain terrifyingly falls from the sky. We'll interrupt your surfing with more news as it unfolds. Meanwhile, please continue to tremble in fear of the obvious.
Re: (Score:2, Informative)
Re:Holy hyperbole, Batman! (Score:5, Funny)
Re: (Score:2)
Re: (Score:1)
So to which politics-critter should I write to get that rain thing taken care of? It's responsible for most of the rust on my car.
Funny how many of this stories surface, which basically just state the same "everything that is not encrypted on the network can be seen pretty easily" over and over again.
Re:Holy hyperbole, Batman! (Score:5, Insightful)
I'm sure he's set up his test network appropriately (hubs not switches, no VLANs in sight, every Ethernet packet visible at each node...) to spread FUD and market his services.
Very l33t, I'm sure.
Just a Slashdot advertisement feature again - there seem to be more and more of these appearing.
I'm waiting for the announcement that a program to increase penis size has been written by a bloke in the pharmaceutical industry - that'll make the fromt page for sure :P
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I'm sure he's set up his test network appropriately (hubs not switches, no VLANs in sight
If you think a switch protects you from sniffing, thing again. There's several ways to sniff switch traffic, arp poisoning, faking dhcp responses, etc. VLANs might be a bit trickier, but it isn't always practical to have a separate network for just the voip traffic. The general rule is to not rely on your traffic being kept secret if someone can get inside your network.
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
sensationalized wording of mundane "discovery" (Score:2)
No Shit?! (Score:1)
Wow (Score:5, Funny)
Others will be pleased (Score:5, Insightful)
Re: (Score:2)
Telecom companies and VOIP (Score:2)
Re: (Score:3, Funny)
Dates... (Score:1)
Göring would have been very disappointed.
Intentional (Score:1)
Many ppl here probably believe that. (Score:2)
zfone (Score:2)
Zfone [zfoneproject.com] - free (as in beer) encrypted VoIP.
Get it while it's still legal!
Re: (Score:2, Interesting)
This is soo old! (Score:3, Informative)
I recall seeing a project on freshmeat in 1999-2000 about the exact same functionnality. Granted, it wasn't as refined as this one, but it did exactly what it had to do; sniff packets over the wire, decode them, and send them to your DSP.
This is old, and that's why people today use VLAN tagged phones to seperate VOIP traffic onto another network, combined with switches that don't allow promiscuous activities, intrusion detection systems, picky switches that don't like MAC changes, and voilà, problem solved for the distribution networks.
There will always be ways to tap coversations, and if you think you pots land line is secure *chuckle*, get real.
Re: (Score:2)
For example:
http://www.orecx.com/ [orecx.com]
Re: (Score:2)
I'm not up on IP phone networking/security concerns. Should I be concerned that staff at this office just dropped the shiny new IP phones on the same network as the PC's? I have one port in my cube: CAT-5 daisy-chain
Re: (Score:2)
More tin foil. Most phone system vendors will set a company's office phone system up on a separate VLAN, then allow access to that VLAN through any port on a wall that a phone was supposed to g
Re: (Score:2)
Sorry, I could have phrased that better. What I meant to say is that, yes, companies' networks use separate VLANs for VoIP, but I've never seen such a network configured to effectively prevent a rogue device, such as a PC, from accessing that VLAN. Yes, my own observations are anecdotal - I'm sure a few people out there are doing things the right way.
Re: (Score:1)
Is your office on a switched network? (Score:3, Informative)
The vulnerable points come after the switch, for example if all the phones use a switch, and that switch has a connection to the PBX, than if you could insert a hub between the pbx and the switch you could use this ha
And that is relevant how? (Score:2)
More Info? (Score:5, Interesting)
Re: (Score:3, Insightful)
Re: (Score:1, Informative)
Re: (Score:1)
ARP-jacking the traffic for the VOIP PBX (Score:2)
Re: (Score:2)
Re: (Score:2)
Still, technology is frightening (ooooh, lookat all em numbers)
Obvious but a wake-up call (Score:4, Insightful)
Although this is obvious to many—if you're transmitting data unencrypted from A to B, someone monitoring the communication channel can of course read the data too—the reality is that it probably takes a concrete, real-world package like this, plus media coverage, to before many organizations will grasp the risk.
In other words, although much of the slashdot crowd will say "well, duh", this is a very practical wake-up call for real-world organizations that have deployed VoIP. Of course they'll need to either use encryption of trust everyone and all machines on the network.
Coming up next: An attacker with appropriate radio gear can eavesdrop on cell phone conversations!
Scary! (Score:1)
I wonder why he decided to publish such a scary VoIP hack?
FTA:
Cox is currently running a series of workshops on VoIP threats in conjunction with SIP Services Europe, and has published his own Video podcast on the topic.
He was inspired to write the software after conversations with encryption guru Phil Zimmermann, creator of Zfone, the latter designed to protect against SIPtap-like hacking by using VoIP call encryption.
This isn't an attack (Score:2)
PS can any hack just say they are a security researcher nowadays?
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
SIP Encrypt (Score:2)
At any rate, this is why I really wished SIP would have required a mandatory encryption scheme. Skype does, but I'd rather use a protocol that's open and interoperable. SIP does have encryption provisions (SRTP, TLS, etc..), but they are a bit difficult and not widely used (so completely pointless). It should have been something mandatory, though I can understand that encryption latency would have ramifications o
Re: (Score:2)
Encrypting SIP Signalling vs. Media Channel (Score:2)
Encrypting the signalling channel is a pretty straigh
old news (Score:2)
Re:old news, ...may I refer you to see VOIPONG? (Score:1)
see Voippong: http://www.enderunix.org/voipong/ [enderunix.org]
for more info: http://www.4devz.com/voipong/ [4devz.com]
I presented this info to a client for enhanced security funding, to shore up the intranet, (which sort of worked).
FUD (Score:1)
Capture filters exist for most products to re-assemble rdp traffic, but the simple solution would be to use srd
Re: (Score:1)
Finally... (Score:2)
The future of VOIP isn't P2P, it looks more like Mail servers. Asterix boxes with a central lookup table, routing calls and availability based on specific connections to servers.
Unfortunately this system quickly becomes encrypted and impossible to monitor, so the fact that everyone could be using the 64kbps required for voip at the same time and not saturate a fraction of the wireless spectrum won't be enough to d
Uhh.. Yes.. (Score:5, Interesting)
Re:Uhh.. Yes.. (Score:4, Interesting)
Doesn't take a genious (Score:2)
http://www.watchguard.com/infocenter/editorial/135324.asp [watchguard.com]
Re: (Score:2)
Supposing the location has a high degree of security, only allows user level access to workstations and has auto lockout on screensaver on every workstation. Just presuming perfect, or nearly perfect, physical security on the user access side. The users still having a common vlan...
Presuming the above and having 2 open network drops to shove a pocket system onto.
For instance, physical access attacker:
Nic 1 listens for arp from the target and
Need help from service providers to fix this! (Score:3, Insightful)
The current problem for anyone using VoIP is that it's necessary to pay some outside company to do the termination into "real world phone service", aka PSTN, so that you can make and receive calls to the normal phone network. Until the VoIP service providers start letting you do encryption all the way to their end, there's a lot of people who can listen to your phone calls much easier than in the analog days. However, this is going to cost them CPU time. But is this something that people would pay more for? I think the answer might be yes...
In any case, slightly off-topic, I highly recommend Voicepulse Connect [voicepulse.com] as an IAX/SIP termination/originiation provider to anybody who can run their own Asterisk PBX and who wants to punt the local phone company.
--
Educational microcontroller kits for the digital generation -- a great gift! [nerdkits.com]
Re: (Score:2)
Re: (Score:2, Interesting)
sip has always been insecure. (Score:2, Insightful)
SIP was never intended to be anything other than a means to negotiate RTP streams. Any decent voip sysadmin would know that SIP is only trusted as far as the wires it runs on.
'Wiretapping' a sip calls is not as difficult as people may assume it to be. Im sure you would find some relatively basic instructions on doing just that using Ethereal/Wireshark online.If you can capture the traffic,
Anyone know of a Vonage-compatible implementation? (Score:2)
My Vonage VOIP box sits behind a Linux-based router/home fileserver with 2TB of storage, and I'd love to have something that would automatically record, decode and store all of my phone conversations. In the same way that I find it useful to log IM chats and save all my e-mail, I think it could be very handy from time to time to have complete logs of my phone conversations. Not so much as proof of conversations but as a way to backstop my very poor memory and abysmal note-taking skills.
I experimented wi
Re: (Score:2)
Re: (Score:2)
Most services like this use G.729. You can find code at www.vovida.org
Thanks. Indeed, my VOIP box uses G.729 when in "low bandwidth" mode, some unidentified codec when in medium mode (RTP packet type 2) and PCMU when in "high bandwidth" mode. I haven't found a free G.729 implementation that runs on Linux, but I did find that orkaudio can already decode PCMU. I installed orkaudio, configured it to output pcmwav files, hacked a quick shell script to convert them to ogg and installed it in a crontab. Works perfectly.
Sometime I'll also have to write a script to parse the
Re: (Score:2)
Re: (Score:2)
http://www.callcorder.com/phone-recording-law-america.htm [callcorder.com]
I was going to just post the states and whether they are 2 party or 1 party (see middle of link above) however Slashdot kicks me out with a Lameness filter. Derp.
Re: (Score:2)
I am (Utah). I looked up the law before I started trying to do it the first time.
Re: (Score:1)
While the U.S. federal law only requires one-party consent, many states have accepted different laws. In some states all parties must give their consent or at least be notified that the call is about to be recorded (with necessary opt-out option: if you dont like them to record the call, you can ask them to stop recording). There also was a case law decision from many years ago (the 1950's) that went to the Supreme Court and affirmed that the federal law does not supersede state authority/statutes unless the call or the tap crosses state lines that is why each state went ahead and established their own guideline/statute
(emphasis mine) IANAL, but what if I set up a system where I record the conversation, but before sending it to my storage server I proxy it (to another state, or even another country)? Would I be able to waive the notification requirement?
Snake oil vendors? (Score:2)
*ahem* wireshark can do this too (Score:2)
First public demonstration... (Score:1)
Done before (Score:1)
Saw this at Shmoocon last year (Score:1)
Scroll down to Sunday - March 25th, 10:00 am presentation
Joel Bruno and Eric Smith
VOIP, Vonage, and Why I Hate Asterisk
You can download video of their presentation.
Basically, intercepting RTP (voice traffic) is as trivial as any other traffic.
The question is, does the equipment respond to unsolicited ARP replies?
Not new.. (Score:2)
Can it grok my blowfish? (Score:1)
Encrypt your streams, encrypt your data, encrypt your voice.
Few, but more than you would think, devices and providers understand Secure Real-time Transport Protocol (SRTP) [wikipedia.org] for SIP channels.
It's important that we get this working in the free software world as well:
http://www.voip-info.org/wiki/view/Asterisk+encryption [voip-info.org]
Blowfish or not, any encryption is better than no encryption.
This is pure crap (Score:2)
Second, if you already have direct access to the network, the victim has bigger problems than a SIP sniffer. Why not corrupt the TFTP server and own every phone?
Third, on any plausible network, having a trojan on one PC would only let you sniff that PC's traffic. I'm going to assume they set up a fake network with hubs from the 1990s.
That article is horrible, and obviously written by someone with zero VoIP experience.
This may be poo poo'd as naive... (Score:2)
SIP Snooping Devices (Score:2)
Here's a good example. Most of the SIP hardphones on the market right now have a feature that allows them to be answered automatically when phoned. You just pass a non-standard header in the Invite message telling the other end to auto-answer. This feature is useful for manufacturers that want to sell "consoles" which allow an operator to control all the phones or do thi
cain (Score:2)
Guess what (Score:2)
Nothing to see here kids, move on
Sheesh
Mark