Tag Info

Hot answers tagged

15

There are many VoIP services that provide ID-spoofing functionality Jumblo: Create an account and add some credit to it (10 Euros minimum excluding VAT), then install their Android app, login, the go to Settings and choose "Add Caller ID" then add the number. (Requires SMS verification) * Skype: You can create an online number (15 Euros minimum) then add ...


10

A secure phone line is conceptually possible; this is not really different from, e.g., a secure communication between a Web browser and a HTTPS server (there are technical subtleties about lost packets and whether they should be tolerated, but that is not the issue here). However, the movie-secure phone is not secure, and that's a structural problem. The ...


9

In general yes, there is ways of doing this, as a quick google search would've been able to tell you. When ever you call, write or send a file to a person on skype you make direct contact with the persons IP/ISP IP, and that you are of course able to track. A simple way to do it in windows is using netstat -n while in a call, and look for the port you know ...


8

Caller ID is always insecure, VOIP Caller ID is no more insecure than any other. If you want to know for sure who the caller is, you have to do a trace rather than trust the included information. Caller ID is kind of like politely asking someone for their name, they don't have to tell you the truth.


8

When the call is coming from an external PBX, then the Caller ID you receive is what the caller's service provider sends to your service provider. This could by anything the caller's service provider wants. Many service providers choose to respect that and send the real Caller ID to your service provider (and eventually, to you). Many SIP / VOIP service ...


8

Browsing through the source on GitHub, one learns that it uses ZRTP. From What are the vulnerabilities of VOIP-specific security protocols? : Prateek Gupta, Vitaly Shmatikov (2006) Security Analysis of Voice-over-IP Protocols We also demonstrate a man-in-the-middle attack on ZRTP which disables authentication and allows the attacker to ...


7

I'll have disagree with AJ's answer. When making a RedPhone call you're first authenticated by one the authentication servers and then a relay server handles connecting you to the call recipient. All of these communications are encrypted. Since the caller isn't directly connected to the recipient (most you need NAT traversal on mobile data networks) , your ...


5

The STIR IETF charter group is working on this problem now. (Literally right now, join the Jabber or listen) Namely this article highlights the need for CallerID due to Robocalling Phishing DoS attacks Former solutions include: RFC 4474 defines SIP "Identity", however this isn't compatible with existing deployments so it hasn't been used. ...


5

In the Skype protocol there are also "proxy nodes" that relay traffic for you. Every Skype client can in fact become such a proxy node if the network reachability is good, especially in regard to firewall conditions. So you can't be sure if the peer IP address you are seeing is the one of your call partner or of a random proxy node. In the latter case you ...


5

Yes they can be made secure by encrypting data or through mutual authentication of both parties. for more information check http://en.wikipedia.org/wiki/Secure_telephone and http://www.helpturk.org/telephone-line-encryption.htm


5

Avaya have a quick checklist here which is a two page list which is broadly vendor neutral. Key first steps include: H.235.5 for H.323 signaling encryption SRTP* for H.323 / SIP media encryption (10 bytes overhead per packet) Standalone AES encryption can also be used for H.323 media encryption TLS for SIP signaling encryption SRTP for voicemail ...


4

TLS doesn't provide end to end security in SIP, because of the routing architecture. SIP messages are transmitted from the user agent through SIP routers, and TLS encryption only happens between user agent and routers and between routers. You could use S/MIME to encrypt and/or sign parts of the SIP messages from one user agent to an other. For media ...


4

When you do a call from SIP to a regular phone line, somewhere in the middle it will exist a gateway which translates the phone call from IP network to a PSTN. So it is doable someone in the middle intercept the communication (in the IP network or PSTN), at least, to lawful interception. Only if two SIP peers call directly is less possible the have a ...


4

Considering every VOIP phone is different, it's kind of hard to standardize depending on where the storage module is located. There are companies who are specialized in hardware destruction, opting for performing destruction yourself can be very very tricky. Should you be able to locate the storage module you could use the Guidelines for Media Sanitization ...


3

Redphone is not designed to prevent meta-information capture. It still is possible for someone monitoring to figure out who you are talking to and how long you talked since no onion routing or similar system is implemented by it. However, it should protect the security of the contents of your communication since the encryption keys are unknown by anyone ...


3

I couldn't find any articles stating this and I highly doubt they would charge you for it (unless you are using their VOIP services instead of skype). The reason for this is that some providers prioritize this type of traffic on their network and some even have special separated networks (this only works for their VOIP phones/services). You can't really ...


3

Putting findings in an answer instead of comments seems to be the best approach. As usual, turns out this has been discussed before. A quick search on CiteSeerX gave 50 papers, however not quite up-to-date: Angelos D. Keromytis (2009) Voice over IP: Risks, Threats and Vulnerabilities Prateek Gupta, Vitaly Shmatikov (2006) Security Analysis of ...


3

Ethereal was renamed Wireshark back in 2006 due to trademark issues. Ethereal/Wireshark is just a packet capture tool with a GUI front end, there are many packet capture tools available. As to intercepting particular traffic, that would depend on particular network architecture and/or various attack methods that end up being a man in the middle.


3

This is more of an interesting tidbit than an answer: given a common way of implementing the compression and cryptography for VoIP (VBR and stream cipher), it is still possible to see the length (in time) of spoken words as the data goes past. Based on this information, you can do interesting things like infer the language being spoken or even recognize ...


3

These still exist, and many countries military and law enforcement agencies use them. Dedicated devices acting as line encryptors are very expensive to run, with requirement to securely deliver keys/certs to each endpoint so for most people software equivalents are appropriate. You can secure your VOIP link the same way you would encrypt any IP link - you ...


2

SIP is an interesting beast to deal with, simply because there is a lot of people who offer SIP solutions that have a lot of differences under the hood. In terms of SIP security, you have two options that I've seen deployed SRTP, ZRTP. ZRTP is supposed to be an improvement on top of SRTP, so it should be preferred. Since it is a DH key exchange, you could ...


2

If you can directly connect, you can tunnel just about anything over SSL using stunnel. Any other sort of port-forwarding arrangement would also work. If you're using something more complicated involving SIP, you'll have to build a custom application or a fancier proxy that works in tandem with directory services. I haven't used this in forever, nor has it ...


2

NIST has created SP 800-164, "Guidelines on Hardware-Rooted Security in Mobile Devices". It is a document that discusses not only the destruction of the device, but other security features that you should be considering, including remote wipe, certificate management, device integrity, using isolation to address various threats, key storage, BYOD, etc. ...


1

I agree with Sebastien that a VPN is the easiest route. I'll add that there are VOIP clients with strong encryption like Jitsi that you and the other party can use if you want end to end security w/out trusting axvoice. End-to-end encrypted VOIP is a better way of talking to people in a corruption-rich country as you only have to trust that person and ...


1

If you draw back your VoIP "data path" (to use a simple name for the way the data packets may go through the internet), you'll see something like this in terms of steps: You -> your ISP Your ISP -> axvoice axvoice -> wherever You're guaranteed that axvoice->wherever is secure, through what they have said. You, however, are not guaranteed of steps 1 or 2, ...


1

This option basically allows registered hosts to call without re-authenticating. According to this article: Never include the parameter “insecure=invite” or “insecure=very” when defining a dynamic SIP user account. If you do, it will disable password checking for that account. Where possible, restrict the range of IP addresses from which the user ...


1

This would depend on the how this is implemented (fail open versus fail closed). But since RADIUS is used as an authentication service, I would say confidentiality and integrity wouldn't be affected (unless you have access to the RADIUS server when crashing the machine). The availability will obviously go down. Just "crashing" the machines will not ...


1

Since you're mentioning Linux, if both PC's run Linux you can set up "IPSec transport" between the two systems and you'll get your manually keyed, encrypted VoIP sessions using whatever VoIP client you want! You can also use a VPN, and I recommend using OpenVPN. VoIP works best over UDP, and OpenVPN itself uses UDP, so it can be called an UDP-friendly VPN. ...


1

As far as I know Skype conversations are encrypted. It's proprietary technology and nobody knows who has which keys to it, but if I would have to guess, I'd say it's safer than SIP. Also this page lists VOIP software that supports encryption (usually either SRTP or TLS).


1

Some Issues to consider Are you sure that you captured all the traffic on the network interface ? Are you running the latest version of Wireshark ? Are you sure you didn't try to decode SIP traffic as RTP traffic ? My advice would be to download some pcaps that contain known RTP traffic from Pcapr ie the following PCAP SIP PCAP . Once your more ...



Only top voted, non community-wiki answers of a minimum length are eligible