I'm a student and currently try to create demonstration of libzrtp mitm attack. I've spent hours searching trough google - and there is no any useful information. Does anyone have any experience with ZRTP? All sources just tell - oh ZRTP is so secure and protected from mitm attacks. But how exactly this can be demonstrated? For example: I have two iphones with installed SilentCircle or similar application with implemented ZRTP. Than I sniff traff with Kali Linux like a mitm-man, but what should I do to simulate notification about mitm? I also research about five different application and there is no such information. My first question was - If Zrtp is so secure so where all demonstrations of mitm attacks? Or all just use lib from zfoneproject and don't carry about security tests? Please help me if you have any related information. My primary target - to create testlab for ZRTP live attacks. Thank you!
ZRTP protocol isn't secure because it can't be MiTM'ed. It is secure because a MiTM attacker can not easily predict when and how the short authentication string (SAS) exchange will take place during the conversation.
To successfully MiTM a voice call, an attacker has to know when and how the SAS exchange will take place, and then send synthesized voice packets to the users during the exchange. Moreover, the synthesized voices should sound like the actual voices of the users to successfully pull this off.
- SAS exhange can take place during any moment of the conversation.
- SAS can be encoded and spelled using a method that's previously known to the users (eg: NATO phonetic alphabet)
- If it is a video call, SAS can be exchanged using sign language, or writing SAS on paper and showing it to the other user.
A good place to start would be RFC 6189 - ZRTP: Media Path Key Agreement for Unicast Secure RTP.