Tag Info

Hot answers tagged

15

There are many VoIP services that provide ID-spoofing functionality Jumblo: Create an account and add some credit to it (10 Euros minimum excluding VAT), then install their Android app, login, the go to Settings and choose "Add Caller ID" then add the number. (Requires SMS verification) * Skype: You can create an online number (15 Euros minimum) then add ...


10

A secure phone line is conceptually possible; this is not really different from, e.g., a secure communication between a Web browser and a HTTPS server (there are technical subtleties about lost packets and whether they should be tolerated, but that is not the issue here). However, the movie-secure phone is not secure, and that's a structural problem. The ...


9

In general yes, there is ways of doing this, as a quick google search would've been able to tell you. When ever you call, write or send a file to a person on skype you make direct contact with the persons IP/ISP IP, and that you are of course able to track. A simple way to do it in windows is using netstat -n while in a call, and look for the port you know ...


9

Browsing through the source on GitHub, one learns that it uses ZRTP. From What are the vulnerabilities of VOIP-specific security protocols? : Prateek Gupta, Vitaly Shmatikov (2006) Security Analysis of Voice-over-IP Protocols We also demonstrate a man-in-the-middle attack on ZRTP which disables authentication and allows the attacker to ...


8

Caller ID is always insecure, VOIP Caller ID is no more insecure than any other. If you want to know for sure who the caller is, you have to do a trace rather than trust the included information. Caller ID is kind of like politely asking someone for their name, they don't have to tell you the truth.


8

When the call is coming from an external PBX, then the Caller ID you receive is what the caller's service provider sends to your service provider. This could by anything the caller's service provider wants. Many service providers choose to respect that and send the real Caller ID to your service provider (and eventually, to you). Many SIP / VOIP service ...


7

I'll have disagree with AJ's answer. When making a RedPhone call you're first authenticated by one the authentication servers and then a relay server handles connecting you to the call recipient. All of these communications are encrypted. Since the caller isn't directly connected to the recipient (most you need NAT traversal on mobile data networks) , your ...


7

Mumble's home page states it uses public-key cryptography. This is done by using the TLS protocol, which is mentioned in the FAQ. With public-key cryptography, the private key is always known by the server. Thus, a Mumble server administrator indeed has access to the private key - usually in the form of a X.509 certificate - which can be used to decrypt the ...


5

Avaya have a quick checklist here which is a two page list which is broadly vendor neutral. Key first steps include: H.235.5 for H.323 signaling encryption SRTP* for H.323 / SIP media encryption (10 bytes overhead per packet) Standalone AES encryption can also be used for H.323 media encryption TLS for SIP signaling encryption SRTP for voicemail ...


5

In the Skype protocol there are also "proxy nodes" that relay traffic for you. Every Skype client can in fact become such a proxy node if the network reachability is good, especially in regard to firewall conditions. So you can't be sure if the peer IP address you are seeing is the one of your call partner or of a random proxy node. In the latter case you ...


5

Yes they can be made secure by encrypting data or through mutual authentication of both parties. for more information check http://en.wikipedia.org/wiki/Secure_telephone and http://www.helpturk.org/telephone-line-encryption.htm


5

Or dedicated, isolated phone lines, such as the famous "red phone" between the US president's office and the USSR premier, back in the days of yore (Don't know if this is still around). (or the batphone in Commisioner Gordon's office...)


5

The STIR IETF charter group is working on this problem now. (Literally right now, join the Jabber or listen) Namely this article highlights the need for CallerID due to Robocalling Phishing DoS attacks Former solutions include: RFC 4474 defines SIP "Identity", however this isn't compatible with existing deployments so it hasn't been used. ...


4

When you do a call from SIP to a regular phone line, somewhere in the middle it will exist a gateway which translates the phone call from IP network to a PSTN. So it is doable someone in the middle intercept the communication (in the IP network or PSTN), at least, to lawful interception. Only if two SIP peers call directly is less possible the have a ...


4

TLS doesn't provide end to end security in SIP, because of the routing architecture. SIP messages are transmitted from the user agent through SIP routers, and TLS encryption only happens between user agent and routers and between routers. You could use S/MIME to encrypt and/or sign parts of the SIP messages from one user agent to an other. For media ...


4

Considering every VOIP phone is different, it's kind of hard to standardize depending on where the storage module is located. There are companies who are specialized in hardware destruction, opting for performing destruction yourself can be very very tricky. Should you be able to locate the storage module you could use the Guidelines for Media Sanitization ...


3

Ethereal was renamed Wireshark back in 2006 due to trademark issues. Ethereal/Wireshark is just a packet capture tool with a GUI front end, there are many packet capture tools available. As to intercepting particular traffic, that would depend on particular network architecture and/or various attack methods that end up being a man in the middle.


3

Redphone is not designed to prevent meta-information capture. It still is possible for someone monitoring to figure out who you are talking to and how long you talked since no onion routing or similar system is implemented by it. However, it should protect the security of the contents of your communication since the encryption keys are unknown by anyone ...


3

Putting findings in an answer instead of comments seems to be the best approach. As usual, turns out this has been discussed before. A quick search on CiteSeerX gave 50 papers, however not quite up-to-date: Angelos D. Keromytis (2009) Voice over IP: Risks, Threats and Vulnerabilities Prateek Gupta, Vitaly Shmatikov (2006) Security Analysis of ...


3

I couldn't find any articles stating this and I highly doubt they would charge you for it (unless you are using their VOIP services instead of skype). The reason for this is that some providers prioritize this type of traffic on their network and some even have special separated networks (this only works for their VOIP phones/services). You can't really ...


3

These still exist, and many countries military and law enforcement agencies use them. Dedicated devices acting as line encryptors are very expensive to run, with requirement to securely deliver keys/certs to each endpoint so for most people software equivalents are appropriate. You can secure your VOIP link the same way you would encrypt any IP link - you ...


3

This is more of an interesting tidbit than an answer: given a common way of implementing the compression and cryptography for VoIP (VBR and stream cipher), it is still possible to see the length (in time) of spoken words as the data goes past. Based on this information, you can do interesting things like infer the language being spoken or even recognize ...


2

Here in the Netherlands, until recently all electronic payments with a debitcard (and creditcard) were done through a secured telephone line. This was demanded by the government to ensure consument security. Hence, the simple answer to you question is yes, you can secure a telephone line.


2

SIP is an interesting beast to deal with, simply because there is a lot of people who offer SIP solutions that have a lot of differences under the hood. In terms of SIP security, you have two options that I've seen deployed SRTP, ZRTP. ZRTP is supposed to be an improvement on top of SRTP, so it should be preferred. Since it is a DH key exchange, you could ...


2

If you can directly connect, you can tunnel just about anything over SSL using stunnel. Any other sort of port-forwarding arrangement would also work. If you're using something more complicated involving SIP, you'll have to build a custom application or a fancier proxy that works in tandem with directory services. I haven't used this in forever, nor has it ...


2

Vomit was an old one I think Cain and Able has this functionality as well.


2

NIST has created SP 800-164, "Guidelines on Hardware-Rooted Security in Mobile Devices". It is a document that discusses not only the destruction of the device, but other security features that you should be considering, including remote wipe, certificate management, device integrity, using isolation to address various threats, key storage, BYOD, etc. ...


2

Payload encryption means they can't know what the communication content is, but in some cases they can still know what protocol you're using (In this case Skype). This is how countries block Tor, for example. Methods to detect the protocol being used even if it's encrypted: IP-based: TCP is not encrypted even if the payload is encrypted (So that computers ...


1

A secured phone line would indicate that there is encryption in place. This would be similar to how we do encryption in networks using TLS, etc. The line on it's own would not typically be encrypted, but the data flowing over the line would be encrypted. Typically, there is encoding software/hardware built into the phone units or you could encrypt the data ...



Only top voted, non community-wiki answers of a minimum length are eligible