How Secure Is VoIP?
BY Ahmar Ghaffar
With most major telecommunications carriers currently in the process of readying Voice-over-IP (VoIP) services for mass deployment, it’s clear that IP telephony is finally headed for prime time. However, the promise of mass VoIP consumption also increases the risk of widespread security violations, spawning a new sense of urgency to fill in potential security gaps now before hackers wreak havoc on corporate voice networks.
Until now, VoIP security has been easily overshadowed by the attractiveness of this new technology and the extensive features it promises to provide. Security hasn’t been a particularly critical subject since in the past, most IP voice traffic remained on local and wide area enterprise networks, which were more or less secure and protected from the public Internet. But as VoIP usage is becoming widespread and Internet telephony is coming into play, enterprises and home users are becoming subject to the same security risks that have affected data networks for decades, thus opening the door to a whole new realm of security risks. This is largely due to the fact that next-generation voice networks are IP-based and all IP protocols for sending voice traffic contain flaws.
Who Is At Risk?
An Internet environment can be considered particularly hostile for VoIP deployments for a number of reasons. Most important is that attacks are not traceable and the whole network is exposed to all sorts of spoofing and sniffing. There have never been enough safeguards and protection in an Internet environment for it to be considered safe, and the potential vulnerability to danger of devices communicating on the Internet makes security threats commonplace. This signifies that any VoIP device communicating insecurely in an Internet environment is at the risk of security breaches.
What sorts of vulnerabilities exist? Let’s start with the basics. Because most VoIP traffic over the Internet is unencrypted, anyone with network access can listen in on conversations. Eavesdropping is one of the most common threats in a VoIP environment. Unauthorized interception of audio streams and decoding of signaling messages can enable the eavesdropper to tap audio conversations in an unsecured VoIP environment. To put it simply, imagine John in the mailroom overhearing your CEO and HR director discussing the latest round of layoffs. Or how about listening to Bob giving his credit card number to an airline booking attendant? All the eavesdropper needs is a packet capture tool (freely available on the Internet) to start capturing voice traffic on the network. Then he can save it in a nice wav file and take it home. Convenient isn’t it?
But that’s just the tip of the iceberg. Hackers can spoof SIP messages and IP addresses and hijack whole conversations. The attacker could masquerade as a user, forging the real identity of the client, which implies that the receiver cannot be sure of the identity of the transmitter.
Sounds interesting? Or imagine a man-in-the-middle attack where your customer ends up talking to an organized crime syndicate masquerading as your telesales group. Your customer’s credit cards, personal information, maybe even Social Security number, gone in a flash. And better still he thinks he talked to your telesales group whereas they never actually got to talk to him.
Or what about denial of service? An attacker can bombard a VoIP server or voice-gateway device on the Internet with inauthentic packets. This sort of attack will flood the server with requests and make the services it provides unavailable to legitimate users. A hacker could easily flood your SIP server with bogus requests, making it impossible to send or receive calls. Or how about replay attacks? Imagine a hacker spamming a 4MB file to 4,000 phones? Or transmitting 500 bogus voice mail messages instantly? It can all be done. Imagine having your phone ringing constantly. You pick up, no answer, hang up, and it rings again. The only way to stop it is to remove the battery. Or throw it out of the window!
What Are The Alternatives?
VoIP traffic can be classified into call signaling, call control, and media communications. Depending on the VoIP protocol and policies used, these communications may use either one channel or many different channels. Channels are TCP/UDP connections between two network elements. From a security point of view, all of these connections may need to be secured, i.e. authenticated and encrypted. Some of the mechanisms that may provide security in a VoIP environment are:
- Transport Layer Security (TLS)
- Media encryption (SRTP)
VoIP call signaling and call control can be secured by implementing some form of Authorization, Authentication or Transport Layer Security (TLS/SSL) mechanism.
Authorization implies that the devices might be configured in such a way to allow traffic from only a select group of IP addresses. This mechanism shields the device to an extent from denial-of-service attacks.
Authentication may require two communicating VoIP devices to authenticate each other before the actual communication starts. This mutual authentication might be based on a shared secret that is known prior to the communication, making it difficult if not impossible for an attacker to masquerade identities.
Transport Layer Security
Transport Layer Security (TLS) can provide a secure communication channel between two communicating entities. The primary goal of the TLS Protocol is to provide privacy and data integrity between two communicating applications. The protocol allows client/server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery. A device incorporating TLS can be configured to allow only secure SIP signaling with other devices. This mandates that the client first sets up a TLS/SSL connection to the server and then exchanges encrypted SIP messages with it on the secure connection. Since this secure communication is based on a shared secret known only to the server and the client, this mechanism makes it very difficult, and again perhaps impossible, for an eavesdropper to view, manipulate, or replay the messages exchanged.
Media communications can also be secured by incorporating some form of encryption mechanisms. VoIP phones may encrypt audio streams via SRTP (Secure Real-time Transport Protocol). SRTP is a security profile for RTP that adds confidentiality, message authentication, and replay protection to that protocol.
SRTP is ideal for protecting Voice over IP traffic because it can be used in conjunction with header compression and has no effect on IP Quality of Service. It creates a unique key stream for each RTP packet, therefore making it almost impossible for eavesdroppers to retrieve the original RTP stream from the encrypted SRTP stream.
SRTP also provides replay protection, which is undoubtedly important for multimedia data. Without replay protection it would be possible for an adversary to perform simple manipulations on data and subvert security. For example, in a voice application, the phrase “yes” could be substituted for “no” if replay protection is not present.
SRTP achieves high throughput and low packet expansion by using fast-stream ciphers for encryption, an implicit index for synchronization, and universal hash functions for message authentication. SRTP proves itself to be a suitable choice for the most general scenarios as well as the most demanding ones.
The main security goals of SRTP are to ensure the confidentiality of the RTP payload, the integrity protection of the entire RTP packet (including protection against replayed RTP packets), and implicit authentication of the header
By using ‘seekable’ stream ciphers, SRTP avoids the denial of service attacks that are possible on stream ciphers that lack this property.
How Critical Is Security?
Having said all that, there’s no denying the fact that the migration of voice onto data networks has been viewed as a growing attraction for hackers and various other wrongdoers; and various service providers and end-users have become somewhat skeptical about the whole idea of VoIP. However there’s also no denying that the VoIP security issue is not “as” critical as the hype suggests. If the service providers or end-users want more security in VoIP systems, they can pay extra for phonesets, gateways or proxies that provide encryption technology. As for denial of service attacks, the PBX can also have its lines all jammed by automated dialers; with these devices and flat-rate calling plans, the time or cost is not hugely different from that caused by e-mail spamming.
To go back to John in the mail room listening in on the CEO — realistically speaking, to be a real VoIP-tapping threat, John needs to be something more like a network administrator. Since switches have replaced hubs, it is difficult, if not impossible for anyone to eavesdrop on LAN-broadcasted traffic; it’s not broadcasted to the whole LAN. Since calls hit the switch and are immediately routed on specified ports to their destinations, it takes someone with access to the networking closet and rights to access the switch. That someone also has to know the port of the conversation that he wants to hear and tap in on. This is at least as difficult as sneaking into the locked telecom closet with a pair of pliers. And if that someone gets that far he probably deserves it for his sheer spying skills!
Much has already been written regarding the measures that one can and should take to maximize security on converged voice/data networks; most of these coming under the category of commonly accepted network hygiene. SIP (Session Initiation Protocol) itself, if properly applied, has authentication mechanisms built in.
More importantly, the claim of VoIP vulnerability to the open Internet is largely misunderstood because VoIP is not about toll bypass, although it did start off that way for hobbyists.
Telecom managers at big companies can negotiate such low-cost per-minute rates from the telcos that at least domestically, there’s little to be saved in circumventing the circuits of long-distance carriers. The IP-PBX vendors tout such wonderful features as buddy list-driven phone calling, but in fact, most VoIP systems being installed today are hooking up to the same PSTN (public switched telephone network), T1s or PRI trunks as the key systems and legacy PBXs they have replaced or are targeting to replace. These early installations are only using IP protocol to send and route calls across their own LANs, or perhaps to other branch offices on voice VLANs carved out of the company data network, before the call is routed over to PSTN. As such, they inherit all of that WAN’s authentication precautions and they do not touch the Internet. And even if they do, spoofing and sniffing on the Internet is not as simple as it’s been made out to be.
In a nutshell, VoIP security sounds like a nice idea and definitely makes the telephony environment more secure, thereby gaining end-user confidence. But it’s certainly not a hurdle preventing VoIP from making it big in the telecom industry.
Ahmar Ghaffar is senior software engineer at snom AG. For more information, please visit the company online at www.snom.com.
If you are interested in purchasing reprints of this article (in either print or HTML format), please visit Reprint Management Services online at www.reprintbuyer.com or contact a representative via e-mail at firstname.lastname@example.org or by phone at 800-290-5460.
[ Return To The November 2004 Of Contents ]