|
VoIP EavesdroppingQ: What is VoIP eavesdropping?A: Eavesdropping on VoIP calls takes place when unauthorized third parties monitor call signal packets. By eavesdropping, third parties can learn user names, passwords, and phone numbers thereby gaining control over calling plans, voicemail, call forwarding, and billing information. More importantly, third parties may also gain access to confidential business and personal information by eavesdropping on actual VoIP based conversations.
Q: What precautions should be taken against VoIP security threats?
Encryption with Negligible Impact on Voice QualityThe Arlinx IP-PBX Platform, SIPhonix, uses a hardware encryption accelerator for very fast and efficient encryption and decryption. This means a negligible effect on voice quality due to excellent encryption performance resulting in minimal throughput latency and zero effect on overall system performance.
Simple VoIP Eavesdropping How ToTo demonstrate how simple it is to eavesdrop by recording a VoIP conversation, read the following excerpt from the book VoIP Hacks. As the author warns eavesdropping is unethical if performed where you are not authorized to do so. It is illegal in many instances.This excerpt refers to the free "network tool" Cain and Able. Cain and Able is free "network administrators tool" software but is often used as a hackers tool. One feature of Cain and Able is to record VoIP conversations using it's network packet sniffer. Other features include Password Cracker and Brute Force Attacks. There are open source VoIP Eavesdropping sniffer software available such as VoiPong, Oreka, VOMIT, and Ethereal. These programs can be used for legitimate purposes as well as hack tools. If your VoIP system is properly secured. none of these programs will work. If you want to use a program like Oreka for legitimate call recording on a minimally secure VoIP system you would have to modify the source by adding decryption and authentication.
VoIP Hacks Tips and Tools for Internet Telephony By Ted Wallingford Once intercepted, the packets must be forwarded to the correct MAC address, or a denial of service will occur on the device you're snooping. In the case of VoIP, your PC can record (or play in realtime) the media stream before passing the packets to the actual intended receiver. A classic man-in-the-middle hack, this technique is simplified by the outstanding network tool, Cain and Abel. To get started, use Cain's host discovery tool. Click the Sniffer tab, then the Hosts tab at the bottom of the GUI. Then, click the + in the toolbar. This will pop open a dialog where you can tell Cain to discover all of the devices on your network. I used it to discover the IP and MAC addresses of my Cisco 7960 phone (10.1.1.104), and my Asterisk server (10.1.1.10). [Two explanatory paragraphs skipped here] Now, start the sniffer and the ARP poison router by clicking the “Start/Stop Sniffer” icon and the “Start/Stop” APR icon (which looks like a radiation symbol). Wait for a VoIP call to be placed on the targeted host-or place one yourself on that host-and watch the call list in the VoIP tab. In a moment, an entry will pop up, indicating that the call is in progress and being recorded into a WAV file by Cain. Check out the Amazon review by Patrick Young Arlinx.com Click "Buy From" to put it in Amazon's Shopping Cart |