VoIP eavesdropping: Hardening network security to contain VoIP risks

searchsecurity.techtarget.com

Every organization considering a Voice over Internet Protocol (VoIP) telephone system deployment hears the same dire warnings: “Routing voice calls over a data network exposes calls to eavesdropping.”

While it’s certainly true that any telephone call carries a certain degree of eavesdropping risk, is it true that VoIP calls have an inherently higher degree of risk? In this tip, we explore the ins and outs of VoIP eavesdropping.

VoIP eavesdropping is possible First, it’s important to be clear about one thing: It is absolutely possible to eavesdrop on a VoIP telephone call. It’s also possible to eavesdrop on a telephone call placed using the traditional public switched telephone network (PSTN). The difference lies in the tools and skill set needed to conduct the eavesdropping.

On a traditional telephone network, someone seeking to eavesdrop on a call generally must have physical access to either the telephone or telephone cable, at least at the initiation of the attack. This type of attack is typical in the movies. Whether it’s the good guys or the bad guys conducting the eavesdropping, someone gains access to either a telephone handset or the telephone network interface box -- sometimes located outside a home or office -- places a wiretap listening device on the box, and then monitors calls on an ongoing basis.


More...

Mobile to VoIP anti-tapping solution launched by PrivateWave

scmagazineuk.com

PrivateWave has introduced a mobile phone anti-tapping solution.

Designed to combat the threat of industrial espionage and the implications to businesses in terms of cost due to loss of confidential data through unprotected conversations, the Enterprise VoIP Security Suite (EVSS) is designed to secure phone conversations between landline, VoIP phones and mobile devices.

According to PrivateWave, the integrated system guarantees full protection of voice communications from intrusions, securing all PBX conversations from landline phones to mobile devices and vice versa, resulting in privacy of all employee conversations.

The software is compatible with Nokia, iPhone and Blackberry mobile devices and will soon be fully compatible with devices based on Android.

More...

Technical Surveillance Threat: Hack IP voice and video in real-time

I can't tell you how many times I've been called into a corporation to perform a Technical Surveillance Countermeasures Sweep, only to be informed upon arriving that "It won't be necessary to audit any of our VoIP or network protocols, our IT dept has that under control".

Really?....Take a moment to read this article, and let me know how you really feel about it...JDL

networkworld.com
BOSTON -- Corporate video conferences can still be easily hacked by insiders using a freeware tool that allows attackers to monitor calls in real-time and record them in files suitable for posting on YouTube.

While the exploit was demonstrated a year ago at security conferences, most corporate networks are still vulnerable to it, says Jason Ostrom, director of VIPER Lab at VoIP vendor Sipera, where he performs penetration tests on clients' business VoIP networks.

He says he sees only 5% of these networks are properly configured to block this attack, which can yield audio and video files of entire conversations. "I almost never see encryption turned on," he says.

To eavesdrop on the calls, someone with access to a VoIP phone jack -- including the one in the lobby of the business -- plugs a laptop with the hacking tool on it into the jack. Using address-resolution protocol (ARP) spoofing, the device gathers the corporate VoIP directory, giving the hacker the ability to keep an eye on any phone and to intercept its calls. There's a tool within UCSniff called ACE that simplifies capturing the directory.

More...

Android App Aims to Allow Wiretap-Proof Cell Phone Calls

Forbes.com
Worried about the NSA, the FBI, criminals or cyberspies electronically eavedropping on your private phone calls? There may be an untappable app for that.

On Tuesday, an independent hacker and security researcher who goes by the handle Moxie Marlinspike and his Pittsburgh-based startup Whisper Systems launched free public betas for two new privacy-focused programs on Google's Android mobile platform: RedPhone, a voice over Internet protocol (VoIP) program that encrypts phone calls, and TextSecure, an app for sending and receiving encrypted text messages and scrambling the messages stored in their inbox.

Marlinspike says the apps will interface with users' contact lists and other functions on the phone to take the hassle out of making calls and sending texts that can't be eavesdropped by third parties. "Our main aim is to make this as easy as possible," he says. "We want it to be a secure and anonymous drop-in replacement for the normal dialing system on your phone."

More...

10 Bizarre-but-True Ways Your Home Is Susceptible to Hackers

foxnews.com

Reality is scarier than fiction -- especially when it comes to what hackers can do. In many bizarre-but-true ways, your home is wide open to hacker attacks. Right now.

While you're reading this, a criminal could be logging in to your router and using it as a porn server. He could be using a Bluetooth "sniper rifle" (like the one shown above) to tap into your phone while you chat by the window. He could even physically steal your printer and capture from its circuitry the financial records you printed last week.

Here are 10 scary -- and real -- home-security threats hackers may try, and how to block them -- if you can.

More...

Is Cisco spying on users ?

networkworld.com

Is Cisco spying on users? A story in U.K.'s The Inquirer states that Cisco has unveiled a bandwidth usage monitoring application designed to provide insight into what type of traffic - such as video -- is using available bandwidth.

Indeed, the application, which runs on Windows Vista and XP, is involved with Cisco's Visual Networking Index PC Pulse project. It is currently in beta, The Inquirer reports.

Cisco claims none of the information collected by the client software is personally identifiable to the user generating it. Indeed, Cisco spokeswoman Sara Cicero posted a comment to The Inquirer story reaffirming that claim.

More...