Skip to main content

Questions tagged [voip]

VoIP is an acronym for "Voice over IP (or Internet Protocol)" which is a term that encapsulates the technologies that enable telephonic communication using the Internet as the carrier network rather than the traditional publicly switched telephone network.

Filter by
Sorted by
Tagged with
2 votes
0 answers
159 views

Are phone calls via WiFi VOIP encrypted by A5/1, A5/2, and A5/3?

I have enabled a function in my mobile phone, that uses my home Wi-Fi network to make calls when the cellular signal does not exist. As far as I know, the cellphone provider charges me as though I ...
user958473's user avatar
0 votes
1 answer
124 views

VOIP call encryption

Regarding voice over IP, I'm trying to understand how vulnerable it is to someone intercepting one or both sides of the audio. Logically, it seems like there are 3 "legs" to each ...
whitelightning's user avatar
1 vote
1 answer
840 views

Is it safe to call banks from Skype?

Say, you call Wells Fargo's or Fidelity's customer support number, from Skype. Example number: 1-800-869-3557 You use Skype because you're overseas and because Skype lets you call US numbers for free. ...
user274763's user avatar
0 votes
0 answers
402 views

Penetration Testing on SIP-TLS Network?

Is it possible that SIP tools like sipvicious and other SIP tools work on SIP-TLS networks where all of the devices (IP-Phones) have a certificate verify feature?
Commodus's user avatar
1 vote
1 answer
753 views

Does my ISP have a clue about what type of activity I'm doing on WhatsApp/Viber/Telegram?

Can my ISP see the difference between sending messages, making video call, and simply engaging with communities - building on traffic types?
Colin's user avatar
  • 25
1 vote
1 answer
158 views

Trying to determine if our application login constitutes 2FA

Our organization uses a Voip "push to talk" type app on Android and IOS devices. The application connects to a server on premises through the internet. To use the app, the user is assigned ...
Frank's user avatar
  • 113
3 votes
1 answer
231 views

Privacy in P2P vs relayed connections for VoIP

I'm developing some sort of VoIP application for mobile devices for fun. I initially planned to rely on P2P connections only. I didn't want to use a relay server because I thought (1.) there would ...
j3141592653589793238's user avatar
0 votes
0 answers
307 views

How is malicious code executed on android devices without owners' knowledge?

I was wondering how hackers were able to gain remote access to one's android device with the help of just a .PNG file. This vulnerability was announced by Google but they didn't provide much ...
idoitforfun's user avatar
2 votes
0 answers
259 views

How to reproduce the RTP bleed vulnerability?

I need to demonstrate RTP bleed on an older version of Asterisk/RTPProxy, but I'm struggling with setting up the environment. Can somebody please tell me how to configure a proxy and two clients ...
clockwork-orange's user avatar
1 vote
3 answers
4k views

Is it advisable to accept STUN server connections?

My firewall reports outgoing connection attempts via com.apple.WebKit.Networking to a number of STUN servers (namely, stun.nas.net, stun.node4.co.uk, stun.voxox.com and stun.wwdl.net). This is ...
Alex Ixeras's user avatar
0 votes
0 answers
134 views

VoIP/SIP Secured Real Time Protocol (SRTP): Which key length is appropriate nowadays?

Many critics say that current key lengths for SRTP-encryption in popular phone apps like Linphone or CSipSimple are not sufficient anymore. What should be a recommended key length nowadays?
Dave's user avatar
  • 101
3 votes
2 answers
219 views

Possibility of business calls/leads being professionally stolen? [closed]

Is it possible our VoIP calls being redirected from our intended phone number to another phone number unknown to us? Our VoIP number is currently forwarded to mobile phones and computer phones. ...
Patty's user avatar
  • 39
1 vote
0 answers
125 views

Sniffing devices in a serial topology

I have the following setup: PBX Server -> Internet -> LAN -> IP Phone -> Workstation (PC) Which means that my computer is connected to the LAN, through a Dual Ethernet card on the IP ...
Nomad's user avatar
  • 2,399
13 votes
1 answer
23k views

Connection to ports 2000 and 5060 successful despite filtering

I run my own (Ubuntu based) router and have iptables configured to drop all incoming packets by default. To my surprise, running an nmap scan (from the WAN side) shows two open ports related to VOIP: ...
Christian David's user avatar
1 vote
0 answers
184 views

IPSec and traffic mirroring [closed]

I have a VoIP server on which several SIP clients are connected to through IPSec tunnels. This is kind of an automated attendant so I both have RTP and SIP signalling flows. I need to be able to ...
autresrhumbs's user avatar
1 vote
0 answers
254 views

How to secure sip/voip server? [closed]

For registration on voip server the standard port is 5060. For security reasons, iptables rules forbade requests for port 5060 from any addresses except one static (customer support). Now the problem ...
user8130599's user avatar
15 votes
1 answer
507 views

Why is caller ID spoofing so simple, and catching offenders so hard?

There is plenty of software which allows a user to input a recipient's information, and a fake-originator's information, and the software will complete the caller ID spoof. I'm trying to understand ...
user3.1415927's user avatar
1 vote
1 answer
192 views

How to block access from a single computer, other than blocking the IP?

Here is the scenario: I have an application, whose one feature/part is to generate voice calls. I have also provided a (working) demo to generate calls from the website, by inputting your number (...
kadamb's user avatar
  • 199
4 votes
2 answers
471 views

How do 2FA (and other account verification) systems identify true mobile numbers vs VoIP numbers?

I've been dabbling with VoIP carriers which offer SMS with relatively mixed results when trying to use VoIP numbers to receive 2FA messages. My goal was to have a dedicated DID/number which I don't ...
TheDave's user avatar
  • 41
1 vote
0 answers
262 views

What is the target hash for a certain security level in TeamSpeak 3? [closed]

In the VoIP software TeamSpeak 3 there are "security levels" to proof someone's identity. According to [this question][1], it is based on the proof-of-work algorithm Hashcash, generating hashes of a ...
user2975189's user avatar
1 vote
1 answer
2k views

Elastix Asterisk CLI flooded with chan_sip.c / sip_xmit warnings

I'm still new to Asterisk/Elastix and apologize if this question is misplaced. Recently one of our larger clients was hacked and we remedied the situation by enabling fail2ban. It seemed to have ...
Son of Sam's user avatar
2 votes
1 answer
361 views

What does this suspicious activity in my log suggest?

I found following log lines on my asterisk program (VoIP) running on debian Jessie server 3.4.112 for arm [2016-12-25 01:58:52] NOTICE[12054] res_pjsip/pjsip_distributor.c: Request 'INVITE' from '"...
AXANO's user avatar
  • 899
2 votes
0 answers
837 views

Security risks/benefits of using Google voice?

A small business that handles sensitive information needs to implement a VOIP system that provides better security than the regular cellular network. What are the security risks/benefits of using ...
lasdfasf's user avatar
3 votes
4 answers
1k views

What makes VoIP more vulnerable than a "normal" phone line?

NIST is deprecating VoIP SMS authentication. I don't understand the decision. What makes VoIP any more vulnerable than a traditional phone line? From the consumer side, I don't even know how to tell ...
user541686's user avatar
  • 2,572
4 votes
3 answers
6k views

How are whatsapp calls banned even with VPN in countries like UAE

As you may know, some countries are blocking access to whatsapp calls, but users usually overcome that with a VPN service, but today even with that powerful internet anonymity solution, ISPs and ...
Bassel Alkhateeb's user avatar
1 vote
0 answers
129 views

What information can be seen when I'm using SRTP via XMPP?

Just as the title goes, basically what data/information can be tracked when using SRTP via XMPP? As client I'm using Jitsi. If things works in some aspects similar to HTTPS, I guess that maybe it ...
Gruber's user avatar
  • 115
3 votes
0 answers
839 views

What vulnerabilities are associated with port triggering?

Background To address a VoIP voice lag issue, my provider added port triggering rules for over 42,000 ports on my router, which seemed sloppy. And as I understand it, port triggering should only be ...
BolasStone's user avatar
0 votes
3 answers
354 views

Best way to keep cell day to day phone calls private - is VOIP better?

This question is about preventing eavesdropping by hackers, thieves, or other smart people collecting information for shady purposes. Is it better to buy a smartphone and install a VOIP service on it ...
MM1926's user avatar
  • 89
-2 votes
2 answers
2k views

How secure are Skype calls?

How secure are Skype voice and video calls? Obviously they do not use end-to-end encryption, so anything transmitted can be read and stored by Microsoft. But what about other 3rd parties? What do we ...
Martin Eden's user avatar
2 votes
1 answer
211 views

VoIP protocols security

I have read a lot of papers about VoIP security issues. The main focus is on SIP protocol. You can find hundred of papers about securing SIP. Even though other signaling protocols like H.323 and IAX ...
Hanna's user avatar
  • 129
5 votes
2 answers
2k views

How secure is VOIP?

I was at a friend's house who uses VOIP on his own private WiFi for his phone calls. He made a call over VOIP (Voice Over Internet Protocol) that included the need to verbally state his credit card ...
End Antisemitic Hate's user avatar
6 votes
1 answer
1k views

How to pentest DTLS-SRTP?

I'm currently working on a penetration test about DTLS-SRTP strengths and weaknesses. But I'm stuck on an eavesdropping test using Wireshark. Yes, it's protected by SRTP, but: What's DTLS actually ...
alsterisk's user avatar
1 vote
0 answers
130 views

VOIP: Tampering RTP data [closed]

Is it possible to take an encrypted RTP stream, one that has no integrity, and somehow edit the conversation to produce another conversation, i.e. make the person say something they didn't mean to? I ...
dylan7's user avatar
  • 747
0 votes
0 answers
499 views

Is Facebook to Facebook (mobile application call) encrypted?

I understand Facebook uses WebRtc to send voice data packet in network if any one end client is on the browser. Use of DTLS packets can be seen in captured (wireshark) file. But in case of mobile app ...
Shasi's user avatar
  • 41
4 votes
1 answer
10k views

VoIP call security: How does encrypting signalling protocol (SIP) protects RTP?

Checking the data packets from many VoIP applications shows that SIP packets are encrypted with TLS. So the captured session shows no SIP signals at all, just simple TCP and TLS/SSL packets. But ...
Shasi's user avatar
  • 41
1 vote
4 answers
329 views

Will my existing VoIP phone work if I install Tor?

I currently don't use Tor and I have VoIP - a physical phone using a provider's VoIP service over my Internet connection. If I install Tor, will I still be able to make and receive phone calls with my ...
Tesla's user avatar
  • 49
0 votes
1 answer
880 views

Can you get someone's IP if you have their Skype number?

I was reading about capturing packets during skype sessions to get the other person's IP address... sounds like you can do this mainly while in a live skype chat / call between skype to skype, but Is ...
Freshfruitness's user avatar
1 vote
1 answer
432 views

Secure voice app [closed]

When I look in the Google play store (android apps market), I see that there are a lot of apps to make secure phone calls. However, all the apps I have seen so far all seem to use data packets over 3G/...
user3231622's user avatar
1 vote
4 answers
6k views

DMZ-Hosting for VOIP services...To Use or Not To Use?

I have VOIP service from PhonePower... They give their users an MTA device to connect to their network, however their instructions are that the user must turn on DMZ-Hosting for this device, to allow ...
zeroday1's user avatar
6 votes
4 answers
1k views

Does a separate internet connection increase security for remote users?

Our network admin has requested that a single remote employee purchase a separate modem in their house for "work" traffic. I question if this is a legitimate security practice of any kind especially ...
J K's user avatar
  • 221
3 votes
1 answer
505 views

User Binding Request with credentials in Lync Dump

I've dumped a call between two lync clients and saw that there were some UDP packets that look like this: Server -> Client 1132 14.495362000 <serverip> <clientip> STUN 146 ...
user857990's user avatar
1 vote
0 answers
246 views

DLP for Phone calls [closed]

I would like to know if there is a DLP system that can monitor phone conversation, in order to search for sensitive data leakage by the company users to external users. We know NSA does that :) Is ...
user2490763's user avatar
11 votes
2 answers
12k views

Is Mumble encryption end to end?

Is it possible for a Mumble server operator to monitor or record users' conversations? Or are Mumble conversations encrypted end-to-end?
user47127's user avatar
  • 113
9 votes
3 answers
4k views

How do countries block encrypted protocols like Skype?

I can't make Skype calls outside of my country because they are blocked. As far as I understand, Skype uses strong encryption for the calls, thus, making Deep Packet Inspection unable to detect it. ...
Mr.voip's user avatar
  • 93
2 votes
1 answer
504 views

Can IP phones be eavesdropped upon if administrator access is available?

I am interested in demonstrating an attack to my university's security team on IP phones installed at the university. The IP phone models are Siemens optipath410. Basically, using nmap, I identified ...
M T's user avatar
  • 21
12 votes
4 answers
35k views

How are "security levels" of identities in TeamSpeak 3 implemented?

TeamSpeak 3 VoIP communication system uses a concept of so called identities to identify the client to the server. These identities are basically public/private key pairs. In order to prevent people ...
Max Truxa's user avatar
  • 223
5 votes
2 answers
709 views

How to destroy VOIP phone in a proper way?

Are there any standards which consider safe destroying of VOIP phones? I would like to prevent eventual data leakage after devices which have left the company.
boleslaw.smialy's user avatar
1 vote
1 answer
784 views

Are there any potential security risks in connecting to a Murmur (Mumble) server?

I've created a free server on a website, but I'm a bit cautious on connecting to it. Are there any potential security risks in connecting to a Murmur (Mumble) server?
slippery's user avatar
  • 113
1 vote
0 answers
863 views

Configure Asterisk for lan with SRTP enabled SipDroid [closed]

I want to have a secured call over internet between two android phones. I have found SipDroid which is an open source SIP client for Android. And also I have followed this to install Asterisk, Dahdi ...
Harsh Vardhan's user avatar
1 vote
0 answers
713 views

Does ZRTP provide useful protection, given that the SAS is not verified?

Firstly, some important backstory. I'm producing a corporate version of an IM/VOIP/Screensharing client using the Open Source Jitsi. We are going to be using a central server and have already ...
Toby Pinder's user avatar