What makes VoIP more vulnerable than a "normal" phone line?

Question

NIST is deprecating VoIP SMS authentication.

I don't understand the decision.

What makes VoIP any more vulnerable than a traditional phone line? From the consumer side, I don't even know how to tell the difference! And I imagine if my service provider wants to intercept something, they could intercept either one (heck, traditional might even be easier). And if we're talking about "stringrays", well, again -- they can intercept the whole mobile connection.

What's the real issue? I just don't buy the explanation, but no one seems to be questioning it!

Answer 1

First off, I like the amount of passion you have for the subject!

Now for the answer:
VoIP is a digital way of sending voice communications using IP. An example for this would be sending voice over the internet between two VoIP nodes.

Because VoIP uses the internet to communicate, the access to the nodes and to the servers handling the requests are at risk to the whole world. This means that if I scanned the internet and found a VoIP node and I found a vulnerability then I can use the node's OS for any malicious purposes (Example: using it as a bot in a DDoS attack, sniffing the traffic and there for listening to the calls and etc...).

On a traditional phone line the communication is done via a private closed off network that is wired to your house from a control box that is probably somewhere in your neighborhood (And that box is connected to another and so on until the main control system). In order to hack that you would have to connect to this wired network. This requires physical access which already makes it harder to hack then a VoIP network.

There are many more small reasons and each have there own good and bad sides but in general the reason VoIP is more vulnerable is because it uses the internet or any other network to communicate which makes it vulnerable to all standard attacks. Either way, they are both pretty hackable each in their own way.

Note: Some service providers have already mixed together there control systems for the phone lines with the internet making it also vulnerable.

Answer 2

VoIP is not more insecure than a conventional phone. In all cases, there is no end-to-end encryption, and in most cases no encryption at all. A landline can be eavesdropped on just by connecting wires together, and cellular can be broken by jamming the more secure bands (3G and LTE) and making the phone downgrade to 2G which uses broken crypto. Not to mention the carrier can eavesdrop on the calls and messages by design, and from the horror's I've seen at a carrier in regards to their own systems I won't be surprised if their management infrastructure is already compromised.

However, with the right tools, VoIP can be made more secure than any standard phone, assuming both ends of the call support it. Using TLS to encrypt signaling and SRTP to encrypt the audio data makes it pretty bulletproof. I've successfully deployed such a system for an internal phone system. Unfortunately you can't really use this kind of security if you want to make calls to the PSTN, as it inherently does not support encryption.

Answer 3

SMS is really a poor second factor as it can more often than not be cracked at the same time with the primary factor in a targeted attack.

In the specific case of VoIP, it is subject to all kinds of manipulations on the internet, especially of the DNS and routing system. For example, "China can redirect the web" kind of fear.

Also, many VoIP deployments use weak or no encryption for payload and most clients do not warn about these.

Answer 4

If the adversary you're worried about is a telephony service provider then the type of phone service doesn't matter. If the adversary is physically present near the recipient's phone then SMS on a “VoIP” service might actually be safer as there's a better chance that it uses proper crypto. However, just because a defense is ineffective against certain adversaries doesn't mean that it's useless.

A phone number that goes through some website and eventually ends up on a PC crosses more systems that are vulnerable to common attacks than one that goes directly from the mobile operator to a basic phone. The chance that some part of the chain in a VoIP service has been breached via a generalist, automated attack is higher than with a classical phone service. I'm not saying that non-VoIP services are always secure, just that they have a smaller attack surface and so they're on average a bit safer.

I don't know if that's NIST's reasoning, this is just my personal analysis.