0

Regarding voice over IP, I'm trying to understand how vulnerable it is to someone intercepting one or both sides of the audio.

Logically, it seems like there are 3 "legs" to each transmission.

  1. subscriber's phone to provider
  2. provider to provider
  3. provider to "other" subscriber's phone

It seems VOIP providers can offer encryption, which I assume only covers "1)" in the above list.

How do the other "legs" of the trip (typically) look when

  1. other side of the call is a cell phone
  2. other side of the call is a bank
  3. other side of the call is another VOIP provider of a home user or small business that doesn't deal with sensitive data.
Improve this question
10
  • There is no single "VoIP". VoIP just means voice over IP networks - compared to voice over POTS (plain old telephone system). There is VoIP used by the phone providers internally, even used directly to the subscriber of the "land line", there is VoIP in LTE, there is VoIP in Skype, Teams, WhatsApp, Zoom, ... . There are standards like SIP, H.323, WebRTC, XMPP, ... There is some overlap in the technologies but there are also many differences. Since you are asking about generic VoIP this question is too broad in my opinion.
    – Steffen Ullrich
    Mar 18 at 17:05
  • Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer.
    – Community Bot
    Mar 18 at 19:26
  • If you want end to end encryption basically on VoIP environments is used ZRTP (non commercial solution), with that you can provide that extra layer of security in an easy way.
    – camp0
    Mar 19 at 21:51
  • @SteffenUllrich Understood. I will try to think more about how to rephrase. Thinking out loud- maybe a question like, "How can someone protect calls that have sensitive information from black hat hackers when the other side of the call might not be motivated & insists on using actual ph numbers?" Still too vague?
    – whitelightning
    Mar 20 at 1:10
  • 1
    @whitelightning To answer that last question, "as an individual home user, how can I increase the chance that calls with big organizations (banks, health insurance company, etc) in the US are encrypted on each leg of the transmission (from black hat hackers)?", the answer is simple: you can't. Or ok, you can go petition your banks and alike. And you can work on your side (leg 1) being encrypted, same, by petitioning (your telco) or changing for one that supports it if yours doesn't.
    – user1532080
    Mar 20 at 7:50

1 Answer 1

Reset to default
2

Depending on the country you live in, the "POTS"/PSTN (Public Switched Telephone Network) may have already disappeared or is disappearing (as in all or most calls are now going over packet networks and not dedicated phone lines).

I'll answer your question with regards to the SIP protocol, which is the most commonly used protocol for telephony (as in the one supported by many "modem-routers" you'll get from your ISP, the one offered by countless telecom companies for business lines...).

On leg 1, many equipment simply don't support encryption.

I do not have information about the encryption on leg 2. Interconnection between telcos is often handled thru SS7, which is known to be extremely "trusting and open", leading to many vulnerabilities. That does not bode well.

On leg 3, it's actually the same as leg 1. Just a different customer.

Over the last 15 years I have myself dealt with a few (10+) SIP telcos across several countries. At the moment, I'm "still using 4". Only one offers standard encryption support (as in, following established standards, TLS/SRTP in that instance), with another one offering encryption, with a very specific piece of hardware (that I don't use).

My own view: I assume my communication are intercepted. And that whoever listens to them died of boredom, but that's another issue.

Improve this answer
2
  • What do you mean when you say "complete encryption support?"
    – whitelightning
    Mar 20 at 5:54
  • @whitelightning Initially I was thinking "that is not tied to a specific hardware", but your comment made me edit my answer. The telco in question offers TLS (aka SIPS)/SRTP.
    – user1532080
    Mar 20 at 7:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.