Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [voip]

VoIP is an acronym for "Voice over IP (or Internet Protocol)" which is a term that encapsulates the technologies that enable telephonic communication using the Internet as the carrier network rather than the traditional publicly switched telephone network.

0
votes
0answers
18 views

Security risks in allowing IP phones to easily auto-configure

I wonder what are the main security risks in allowing Voice VLAN ports to provide QoS and most VoIP deployment configurations (via auto configuration) to the phones? Since it's best practice to ...
2
votes
0answers
60 views

How to reproduce the RTP bleed vulnerability?

I need to demonstrate RTP bleed on an older version of Asterisk/RTPProxy, but I'm struggling with setting up the environment. Can somebody please tell me how to configure a proxy and two clients ...
0
votes
1answer
217 views

Is it advisable to accept STUN server connections?

My firewall reports outgoing connection attempts via com.apple.WebKit.Networking to a number of STUN servers (namely, stun.nas.net, stun.node4.co.uk, stun.voxox.com and stun.wwdl.net). This is ...
0
votes
0answers
36 views

VoIP/SIP Secured Real Time Protocol (SRTP): Which key length is appropriate nowadays?

Many critics say that current key lengths for SRTP-encryption in popular phone apps like Linphone or CSipSimple are not sufficient anymore. What should be a recommended key length nowadays?
3
votes
2answers
133 views

Possibility of business calls/leads being professionally stolen? [closed]

Is it possible our VoIP calls being redirected from our intended phone number to another phone number unknown to us? Our VoIP number is currently forwarded to mobile phones and computer phones. ...
1
vote
0answers
52 views

Sniffing devices in a serial topology

I have the following setup: PBX Server -> Internet -> LAN -> IP Phone -> Workstation (PC) Which means that my computer is connected to the LAN, through a Dual Ethernet card on the IP ...
7
votes
1answer
2k views

Connection to ports 2000 and 5060 successful despite filtering

I run my own (Ubuntu based) router and have iptables configured to drop all incoming packets by default. To my surprise, running an nmap scan (from the WAN side) shows two open ports related to VOIP: ...
1
vote
0answers
66 views

IPSec and traffic mirroring [closed]

I have a VoIP server on which several SIP clients are connected to through IPSec tunnels. This is kind of an automated attendant so I both have RTP and SIP signalling flows. I need to be able to ...
1
vote
0answers
108 views

How to secure sip/voip server? [closed]

For registration on voip server the standard port is 5060. For security reasons, iptables rules forbade requests for port 5060 from any addresses except one static (customer support). Now the problem ...
14
votes
1answer
287 views

Why is caller ID spoofing so simple, and catching offenders so hard?

There is plenty of software which allows a user to input a recipient's information, and a fake-originator's information, and the software will complete the caller ID spoof. I'm trying to understand ...
0
votes
0answers
55 views

Can the man in the middle attack on TURN protocol reveal logins and passwords?

When connecting to a TURN server, the client uses login and password. If the TURN server isn't configured for TLS, is the password visible when sent? (I think that I've seen at least a login in the ...
1
vote
1answer
91 views

How to block access from a single computer, other than blocking the IP?

Here is the scenario: I have an application, whose one feature/part is to generate voice calls. I have also provided a (working) demo to generate calls from the website, by inputting your number (...
2
votes
1answer
113 views

How do 2FA (and other account verification) systems identify true mobile numbers vs VoIP numbers?

I've been dabbling with VoIP carriers which offer SMS with relatively mixed results when trying to use VoIP numbers to receive 2FA messages. My goal was to have a dedicated DID/number which I don't ...
1
vote
0answers
123 views

What is the target hash for a certain security level in TeamSpeak 3? [closed]

In the VoIP software TeamSpeak 3 there are "security levels" to proof someone's identity. According to [this question][1], it is based on the proof-of-work algorithm Hashcash, generating hashes of a ...
1
vote
1answer
559 views

Elastix Asterisk CLI flooded with chan_sip.c / sip_xmit warnings

I'm still new to Asterisk/Elastix and apologize if this question is misplaced. Recently one of our larger clients was hacked and we remedied the situation by enabling fail2ban. It seemed to have ...
2
votes
1answer
229 views

What does this suspicious activity in my log suggest?

I found following log lines on my asterisk program (VoIP) running on debian Jessie server 3.4.112 for arm [2016-12-25 01:58:52] NOTICE[12054] res_pjsip/pjsip_distributor.c: Request 'INVITE' from '"...
2
votes
0answers
691 views

Security risks/benefits of using Google voice?

A small business that handles sensitive information needs to implement a VOIP system that provides better security than the regular cellular network. What are the security risks/benefits of using ...
3
votes
4answers
468 views

What makes VoIP more vulnerable than a “normal” phone line?

NIST is deprecating VoIP SMS authentication. I don't understand the decision. What makes VoIP any more vulnerable than a traditional phone line? From the consumer side, I don't even know how to tell ...
3
votes
3answers
3k views

How are whatsapp calls banned even with VPN in countries like UAE

As you may know, some countries are blocking access to whatsapp calls, but users usually overcome that with a VPN service, but today even with that powerful internet anonymity solution, ISPs and ...
1
vote
0answers
53 views

What information can be seen when I'm using SRTP via XMPP?

Just as the title goes, basically what data/information can be tracked when using SRTP via XMPP? As client I'm using Jitsi. If things works in some aspects similar to HTTPS, I guess that maybe it ...
4
votes
0answers
414 views

What vulnerabilities are associated with port triggering?

Background To address a VoIP voice lag issue, my provider added port triggering rules for over 42,000 ports on my router, which seemed sloppy. And as I understand it, port triggering should only be ...
0
votes
2answers
104 views

Best way to keep cell day to day phone calls private - is VOIP better?

This question is about preventing eavesdropping by hackers, thieves, or other smart people collecting information for shady purposes. Is it better to buy a smartphone and install a VOIP service on it ...
-2
votes
2answers
2k views

How secure are Skype calls?

How secure are Skype voice and video calls? Obviously they do not use end-to-end encryption, so anything transmitted can be read and stored by Microsoft. But what about other 3rd parties? What do we ...
2
votes
1answer
114 views

VoIP protocols security

I have read a lot of papers about VoIP security issues. The main focus is on SIP protocol. You can find hundred of papers about securing SIP. Even though other signaling protocols like H.323 and IAX ...
4
votes
2answers
959 views

How secure is VOIP?

I was at a friend's house who uses VOIP on his own private WiFi for his phone calls. He made a call over VOIP (Voice Over Internet Protocol) that included the need to verbally state his credit card ...
7
votes
1answer
591 views

How to pentest DTLS-SRTP?

I'm currently working on a penetration test about DTLS-SRTP strengths and weaknesses. But I'm stuck on an eavesdropping test using Wireshark. Yes, it's protected by SRTP, but: What's DTLS actually ...
1
vote
0answers
64 views

VOIP: Tampering RTP data [closed]

Is it possible to take an encrypted RTP stream, one that has no integrity, and somehow edit the conversation to produce another conversation, i.e. make the person say something they didn't mean to? I ...
0
votes
0answers
420 views

Is Facebook to Facebook (mobile application call) encrypted?

I understand Facebook uses WebRtc to send voice data packet in network if any one end client is on the browser. Use of DTLS packets can be seen in captured (wireshark) file. But in case of mobile app ...
4
votes
1answer
8k views

VoIP call security: How does encrypting signalling protocol (SIP) protects RTP?

Checking the data packets from many VoIP applications shows that SIP packets are encrypted with TLS. So the captured session shows no SIP signals at all, just simple TCP and TLS/SSL packets. But ...
1
vote
4answers
151 views

Will my existing VoIP phone work if I install TOR?

I currently don't use TOR and I have VoIP - a physical phone using a provider's VoIP service over my Internet connection. If I install TOR, will I still be able to make and receive phone calls with my ...
0
votes
1answer
537 views

Can you get someone's IP if you have their Skype number?

I was reading about capturing packets during skype sessions to get the other person's IP address... sounds like you can do this mainly while in a live skype chat / call between skype to skype, but Is ...
1
vote
1answer
327 views

Secure voice app [closed]

When I look in the Google play store (android apps market), I see that there are a lot of apps to make secure phone calls. However, all the apps I have seen so far all seem to use data packets over 3G/...
1
vote
4answers
4k views

DMZ-Hosting for VOIP services…To Use or Not To Use?

I have VOIP service from PhonePower... They give their users an MTA device to connect to their network, however their instructions are that the user must turn on DMZ-Hosting for this device, to allow ...
6
votes
4answers
633 views

Does a separate internet connection increase security for remote users?

Our network admin has requested that a single remote employee purchase a separate modem in their house for "work" traffic. I question if this is a legitimate security practice of any kind especially ...
3
votes
1answer
329 views

User Binding Request with credentials in Lync Dump

I've dumped a call between two lync clients and saw that there were some UDP packets that look like this: Server -> Client 1132 14.495362000 <serverip> <clientip> STUN 146 ...
1
vote
0answers
114 views

DLP for Phone calls [closed]

I would like to know if there is a DLP system that can monitor phone conversation, in order to search for sensitive data leakage by the company users to external users. We know NSA does that :) Is ...
11
votes
2answers
7k views

Is Mumble encryption end to end?

Is it possible for a Mumble server operator to monitor or record users' conversations? Or are Mumble conversations encrypted end-to-end?
8
votes
3answers
3k views

How do countries block encrypted protocols like Skype?

I can't make Skype calls outside of my country because they are blocked. As far as I understand, Skype uses strong encryption for the calls, thus, making Deep Packet Inspection unable to detect it. ...
2
votes
1answer
413 views

Can IP phones be eavesdropped upon if administrator access is available?

I am interested in demonstrating an attack to my university's security team on IP phones installed at the university. The IP phone models are Siemens optipath410. Basically, using nmap, I identified ...
9
votes
4answers
24k views

How are “security levels” of identities in TeamSpeak 3 implemented?

TeamSpeak 3 VoIP communication system uses a concept of so called identities to identify the client to the server. These identities are basically public/private key pairs. In order to prevent people ...
5
votes
2answers
409 views

How to destroy VOIP phone in a proper way?

Are there any standards which consider safe destroying of VOIP phones? I would like to prevent eventual data leakage after devices which have left the company.
1
vote
1answer
583 views

Are there any potential security risks in connecting to a Murmur (Mumble) server?

I've created a free server on a website, but I'm a bit cautious on connecting to it. Are there any potential security risks in connecting to a Murmur (Mumble) server?
1
vote
0answers
712 views

Configure Asterisk for lan with SRTP enabled SipDroid [closed]

I want to have a secured call over internet between two android phones. I have found SipDroid which is an open source SIP client for Android. And also I have followed this to install Asterisk, Dahdi ...
1
vote
0answers
601 views

Does ZRTP provide useful protection, given that the SAS is not verified?

Firstly, some important backstory. I'm producing a corporate version of an IM/VOIP/Screensharing client using the Open Source Jitsi. We are going to be using a central server and have already ...
11
votes
3answers
869 views

Is secure Caller ID possible for SIP / VOIP?

Is there any way (standard, proposed or draft) that will allow for secure Caller ID over SIP / VOIP networks? I have constantly heard that Caller ID is insecure when used over these services. Can ...
20
votes
3answers
19k views

Is Signal a secure and secret way to communicate via voice calls?

Signal (former RedPhone) provides end-to-end encryption for your calls, securing your conversations so that nobody can listen in. But really, how is the probability that a voice conversation is ...
1
vote
1answer
7k views

Asterisk trunk config 'insecure=very'

I had to add 'insecure=very' configuration to a SIP trunk on my freePBX box for it to register. Does this configuration open possible threats for my infrastructure?
23
votes
1answer
14k views

How can I spoof a phone call and make it appear to come from another phone?

I'm performing a penetration test against a company. Part of my social engineering procedure is to contact the IT department and try to convince them to that I'm an employee in the company and get ...
1
vote
2answers
1k views

How to increase VoIP call security?

I am using VoIP for my office because I can use the same number whether I am in USA or anywhere else. I am using it on my laptop and I have to visit India in the next few days. My friends say rules ...
9
votes
1answer
1k views

What are the vulnerabilities of VOIP-specific security protocols?

Existing relevant questions: How do you Secure VOIP in a large organization What are the main issues and best practice security controls when exposing SIP and H.323 to the Internet? Do secure phone ...