What are the vulnerabilities of VOIP-specific security protocols?

Question

Existing relevant questions:

• How do you Secure VOIP in a large organization
• What are the main issues and best practice security controls when exposing SIP and H.323 to the Internet?
• Do secure phone lines exist? - especially advice by a certain member of the ursine race to use insecure SIP and H.323 over VPN

However, almost two years have passed since these questions were asked and answered, a few new vulnerability modes were discovered and patched, and I'm wondering how best to implement secure VOIP and videoconferencing in the coming several years.

Basically, which open real-time protocol will protect video- and phone calls better from casual eavesdroppers (who may have hacked a few servers along the route) and MitM'ers given present-day state of the art?

• insecure SIP/H.323 over TLS VPN;
• SRTP/ZRTP;
• anything else I have left out...

Answer 1

Putting findings in an answer instead of comments seems to be the best approach.

As usual, turns out this has been discussed before. A quick search on CiteSeerX gave 50 papers, however not quite up-to-date:

• Angelos D. Keromytis (2009) Voice over IP: Risks, Threats and Vulnerabilities
• Prateek Gupta, Vitaly Shmatikov (2006) Security Analysis of Voice-over-IP Protocols

We present a structured security analysis of the VoIP protocol stack, which consists of signaling (SIP), session description (SDP), key establishment (SDES, MIKEY, and ZRTP) and secure media transport (SRTP) protocols.

Using a combination of manual and tool-supported formal analysis, we uncover several design flaws and attacks, most of which are caused by subtle inconsistencies between the assumptions that protocols at different layers of the VoIP stack make about each other.

The most serious attack is a replay attack on SDES, which causes SRTP to repeat the keystream used for media encryption, thus completely breaking transport-layer security. We also demonstrate a man-in-the-middle attack on ZRTP which disables authentication and allows the attacker to impersonate a ZRTP user and establish a shared key with another user. Finally, we show that the key derivation process used in MIKEY cannot be used to prove security of the derived key in the standard cryptographic model for secure key exchange.

• G.Aghila, D.Chandirasekaran (2011) An Analysis of VoIP Secure Key Exchange Protocols against Man-in-the-Middle Attack

We have come to notice that the three key generation protocols ZRTP, SDES and MIKEY are vulnerable to the Man-In-The Middle attack. Our analysis suggests that the key management protocols that operate in the media layer are indeed suitable media keying protocols despite their operational differences.

As pointed out by Philippe Lhardy, audio streams in their compressed form present an attacker with an opportunity to infer: identity of the speakers, language being spoken and a few other details.

Two modes of compression have been analysed in the literature:

• VAD (Voice activity detection) - Speaker Recognition in Encrypted Voice Streams

• VBR (Variable bit recording) (pointed out by Seth from Crypto SE in this question)

  • Spot me if you can: Uncovering spoken phrases in encrypted VoIP conversations
  • Language identification of encrypted VoIP traffic

Would be grateful for any other ideas and suggestions, especially related to videoconferencing.

EDIT: A related question: Can voice chat be spied?

EDIT #2: Cryptocat is an implementation of Off-the-record messaging: Flaws in Crypto Cat

Any discussion of VoIP should include this possible requirement.

---

Following a suggestion from landroni, here's a link to vulnerabilities found in the ZRTPCPP library: http://blog.azimuthsecurity.com/2013/06/attacking-crypto-phones-weaknesses-in.html