Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sip]

Session Initiation Protocol. or SIP, is an application layer communications protocol that can be used in conjunction with other protocols for voice communications over IP or video calling.

2
votes
0answers
74 views

How to reproduce the RTP bleed vulnerability?

I need to demonstrate RTP bleed on an older version of Asterisk/RTPProxy, but I'm struggling with setting up the environment. Can somebody please tell me how to configure a proxy and two clients ...
0
votes
0answers
36 views

VoIP/SIP Secured Real Time Protocol (SRTP): Which key length is appropriate nowadays?

Many critics say that current key lengths for SRTP-encryption in popular phone apps like Linphone or CSipSimple are not sufficient anymore. What should be a recommended key length nowadays?
2
votes
1answer
113 views

TLS 1.2 Missing Finished Message

I'm setting up a TLS connection for the purposes of sending secure SIP. The remote gateway (Twilio) doesn't always send a finish message and as such those requests fail. Everything else appears to ...
7
votes
4answers
1k views

SIP UDP request breaking through iptables

I have been investigating a few instances recently where SIP UDP traffic has been somehow evading the ruleset defined in iptables leading me to suspect that there is a hole in our rules so i'm looking ...
1
vote
0answers
124 views

How to secure sip/voip server? [closed]

For registration on voip server the standard port is 5060. For security reasons, iptables rules forbade requests for port 5060 from any addresses except one static (customer support). Now the problem ...
1
vote
1answer
613 views

Elastix Asterisk CLI flooded with chan_sip.c / sip_xmit warnings

I'm still new to Asterisk/Elastix and apologize if this question is misplaced. Recently one of our larger clients was hacked and we remedied the situation by enabling fail2ban. It seemed to have ...
-1
votes
1answer
345 views

TLS handshake flow

Hi I wanted to confirm if this is a valid handshake flow as i dont see any finish message.
0
votes
1answer
28 views

SIP provider does not support SIPS

I am considering signing up with a low-cost SIP provider which, according to a current white paper, does not (yet) support SIPS (Secure Session Initiation Protocol). I understand that this means that ...
2
votes
2answers
26k views

How secure is FaceTime by Apple

Apple says their messages and FaceTime calls are end-to-end encrypted and nobody can access them. As I'm unfamiliar with cryptology, I've found security white paper from Apple, where says: ...
2
votes
1answer
117 views

VoIP protocols security

I have read a lot of papers about VoIP security issues. The main focus is on SIP protocol. You can find hundred of papers about securing SIP. Even though other signaling protocols like H.323 and IAX ...
4
votes
1answer
9k views

VoIP call security: How does encrypting signalling protocol (SIP) protects RTP?

Checking the data packets from many VoIP applications shows that SIP packets are encrypted with TLS. So the captured session shows no SIP signals at all, just simple TCP and TLS/SSL packets. But ...
1
vote
0answers
254 views

Is a direct SIP video call (encrypted) between two computers more secure than going through a registrar service?

I learned recently about ZRTP-encrypted video calls using an SIP client, such as Jitsi or Linphone or Blink. I was able to make a direct encrypted video call between two clients on the same local ...
3
votes
1answer
5k views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a pre-...
0
votes
1answer
54 views

How to restore devices like IP phones to productive use after unexplained activity? [closed]

I'm trying to consider how to properly vet devices that have exhibited unexplained activity for future deployment. Let's just consider my current scenario as an example, but I am interested in this ...
1
vote
0answers
788 views

Bash shell exploit using SIP

I have a SIP proxy server, that would like to test Shellshock on. I have used this https://github.com/zaf/sipshock to try and test. but this is what I get. So I just want to know generally what is ...
2
votes
1answer
276 views

SIP DoS classifications

I would like to understand below SIP DoS attacks Message Payload Tampering [implementation errors, SIP bugs] Flow Tampering [CPU, Bandwidth, Memory] Message Flooding [lack of authentication or ...
11
votes
3answers
884 views

Is secure Caller ID possible for SIP / VOIP?

Is there any way (standard, proposed or draft) that will allow for secure Caller ID over SIP / VOIP networks? I have constantly heard that Caller ID is insecure when used over these services. Can ...
9
votes
1answer
28k views

TLS Handshake gets torn down

I am trying to debug a TLS handshake between two SIP trunk endpoints: .75 and .82. Mutual authentication is being used. .75 sends: Client Hello Certificate, Client Key Exchange Certificate ...
2
votes
1answer
1k views

COMMUNITY SIP TCP/IP message flooding directed to SIP proxy

I have installed Snort IDS and most alarm is: "COMMUNITY SIP TCP/IP message flooding directed to SIP proxy" And i use home DSL Internet connection , should i be worried about this alarm ? I have ...
2
votes
2answers
3k views

How to mitigate SIP Reflection Attacks?

SIP has a practical need to be widely available, but its services are prone to being spoofed as reflectors used in DDoS attacks. A freeswitch server I manage has seen heaps of registration requests ...