VoIP eavesdropping: Hardening network security to contain VoIP risks

searchsecurity.techtarget.com

Every organization considering a Voice over Internet Protocol (VoIP) telephone system deployment hears the same dire warnings: “Routing voice calls over a data network exposes calls to eavesdropping.”

While it’s certainly true that any telephone call carries a certain degree of eavesdropping risk, is it true that VoIP calls have an inherently higher degree of risk? In this tip, we explore the ins and outs of VoIP eavesdropping.

VoIP eavesdropping is possible First, it’s important to be clear about one thing: It is absolutely possible to eavesdrop on a VoIP telephone call. It’s also possible to eavesdrop on a telephone call placed using the traditional public switched telephone network (PSTN). The difference lies in the tools and skill set needed to conduct the eavesdropping.

On a traditional telephone network, someone seeking to eavesdrop on a call generally must have physical access to either the telephone or telephone cable, at least at the initiation of the attack. This type of attack is typical in the movies. Whether it’s the good guys or the bad guys conducting the eavesdropping, someone gains access to either a telephone handset or the telephone network interface box -- sometimes located outside a home or office -- places a wiretap listening device on the box, and then monitors calls on an ongoing basis.


More...

Wiretap suits OKd against U.S., not telecoms

sfgate.com

The nation's telecommunications companies can't be sued for cooperating with the Bush administration's secret surveillance program, but their customers can sue the government for allegedly intercepting their phone calls and e-mails without a warrant, a federal appeals court ruled Thursday.
In a pair of decisions, the Ninth U.S. Circuit Court of Appeals in San Francisco upheld a 2008 law immunizing AT&T and other companies for their roles in wiretapping calls to alleged foreign terrorists, but revived a suit that accused the government of illegally intercepting millions of messages from U.S. residents.
That lawsuit was partly based on testimony in 2003 by former AT&T technician Mark Klein about equipment in the company's office on Folsom Street in San Francisco that allowed Internet traffic to be routed to the government.

'Dragnet' surveillance

The Electronic Frontier Foundation, a privacy-rights organization representing AT&T customers, claimed the company had similar installations in other cities and used them for "dragnet" surveillance of everyday e-mails and phone calls, which the National Security Agency purportedly screened electronically for connections to terrorism.
"We look forward to proving the program is an unconstitutional and illegal violation of the rights of millions of ordinary Americans," said Cindy Cohn, the foundation's legal director.
Justice Department spokesman Dean Boyd declined comment.

More...

Government Investigates Cellphone Wiretapping

theatlantic.com
As the government begins an investigation into Carrier IQ's cell phone-tracking software, memories of its own wiretapping scandal resurface


"Spy on unsuspecting Americans? That's our job," you can imagine federal officials indignantly declaring as they investigate cell-phone tracking by the mobile software company, Carrier IQ. The National Security Agency began secret, illegal surveillance of our phone calls and Internet activities in 2001, as we belatedly learned in 2005. Yes, 2005 is a long time ago these days, when yesterday seems like old news; but the NSA scandal deserves to be remembered, especially when the government presumes to be outraged by telecom spying.  

When it began spying on us after 9/11, the Bush Administration enlisted the assistance of telecoms willing to engage in illegal activities at its behest. (Former Qwuest CEO Joseph Nacchio later claimed that after he declined to cooperate with the surveillance program, in 2001, the government retaliated, denying the company lucrative contracts. In 2007, Nacchio was convicted of insider trading.) After the NSA program was exposed, complicit telecoms faced the risks of losing expensive civil suits. AT&T, in particular, was badly exposed, thanks to incriminating documents released by a whistleblower and a lawsuit filed by the Electronic Frontier Foundation. But not surprisingly, Congress intervened. In 2007, it retroactivelyimmunized the companies for illegal activities authorized by the president. As the late, disgraced Richard Nixon explained, prematurely, "when the President does it, it's not illegal." Voting in favor of telecom immunity, then candidate and Senator Obama apparently agreed.


More...

Israel Convicts Conspirator Who Wiretapped Michael Cherney

israelnewsagency.com

Jerusalem, Israel --- October 26, 2011 .... On October 24th the Jerusalem Magistrate's Court in Israel convicted far-right activist Avigdor Eskin of ordering the illegal wiretapping of associates of Israel businessman and philanthropist Michael Cherney (Mikhail Chernoy).

The plea bargain consists of a penalty of six months of community service, probation and a fine of NIS 20,000.

According to the original indictment, filed in January 2011 by the Israel State Attorney's office, Eskin was contacted in 2007 by a Russian citizen, Alexei Drobashenko, who asked him to gather information about Michael Cherney in order to use it in a smear campaign.

At that time Alexei Drobashenko was the head of the External Relations Department at Basic Element, a financial and industrial group that belongs to Oleg Deripaska. Deripaska and Cherney are former partners in an aluminum business. In 2006 Cherney filed a law suit against Oleg Deripaska in the UK's High Court.

Cherney is seeking a 20 percent stake in RUSAL, a multinational aluminum producer. The trial is expected to go ahead in April 2012.

In February 2008, Cherney filed a suit in a Tel Aviv court, accusing a group of 10 conspirators, allegedly funded by Oleg Deripaska, of illegal wiretapping, hacking the computers of his charity fund - The Michael Cherney Foundations, publishing slanderous articles, harassing him with insulting graffiti and leaflets, hiring a UK PR company to plant hoaxes about Cherney into the UK media and Wikipedia.

The purpose of that smear campaign was allegedly to derail Cherney's lawsuit against Deripaska in UK's Commercial Court.

Aviv Mor, an Israel private investigator, together with another PI, Rafael Pridan, carried out wiretaps against Cherney's secretary Elena Skir and another of Cherney's associates, the indictment contended.

The indictment further charged that Eskin was the link between Mor and Pridan and Drobashenko, that he paid them each NIS 50,000 in cash for their services and that he also received translations of the wiretapped conversations.

More...

Illinois Wiretapping Law Reaching A Boiling Point

pixiq.com

Illinois police officers have to be the most smug cops in the nation knowing they have the power to arrest citizens on felony charges for recording them in public while they themselves have every right to record citizens.

That smugness is very evident in the latest case to emerge from the Land of Lincoln.

Watch the below video, and read more here...

Appeals Court OKs Challenge to Warrantless Electronic Spying

wired

A legal challenge questioning the constitutionality of a federal law authorizing warrantless electronic surveillance of Americans inched a step closer Wednesday toward resolution.

The 2nd U.S. Circuit Court of Appeals, for the second time, rejected the Obama administration’s contention that it should toss a lawsuit challenging the 2008 Foreign Intelligence Surveillance Amendments Act. Among other things, the government said the plaintiffs — Global Fund for Women, Global Rights, Human Rights Watch, International Criminal Defence Attorneys Association, The Nation magazine, PEN American Center, Service Employees International Union and others — don’t have standing to bring a constitutional challenge because they cannot demonstrate that they were subject to the eavesdropping or suffered hardships because of it.

The lawsuit, backed by the American Civil Liberties Union, was lodged within hours of the FISA Amendments Act (.pdf) being signed into law by President George W. Bush in July 2008. The legislation is being challenged because it allows the National Security Agency to electronically eavesdrop on Americans without a probable-cause warrant if one of the parties to the communication resides outside the United States and is suspected of a link to terrorism.

“It is the glory of our system that even our elected leaders must defend the legality of their conduct when challenged,” (.pdf) Judge Gerard Lynch wrote.

More...

How 9/11 Completely Changed Surveillance in U.S.

wired

Former AT&T engineer Mark Klein handed a sheaf of papers in January 2006 to lawyers at the Electronic Frontier Foundation, providing smoking-gun evidence that the National Security Agency, with the cooperation of AT&T, was illegally sucking up American citizens’ internet usage and funneling it into a database.

The documents became the heart of civil liberties lawsuits against the government and AT&T. But Congress, including then-Sen. Barack Obama (D-Illinois), voted in July 2008 to override the rights of American citizens to petition for a redress of grievances.

Congress passed a law that absolved AT&T of any legal liability for cooperating with the warrantless spying. The bill, signed quickly into law by President George W. Bush, also largely legalized the government’s secret domestic-wiretapping program.

Obama pledged to revisit and roll back those increased powers if he became president. But, he did not.

Mark Klein faded into history without a single congressional committee asking him to testify. And with that, the government won the battle to turn the net into a permanent spying apparatus immune to oversight from the nation’s courts.

More...

Administration Wiretaps Israeli Embassy

foxnews.com

Leak Offers Look at Efforts by U.S. to Spy on Israel
By SCOTT SHANE, New York Times

WASHINGTON — When Shamai K. Leibowitz, an F.B.I. translator, was sentenced to 20 months in prison last year for leaking classified information to a blogger, prosecutors revealed little about the case. They identified the blogger in court papers only as “Recipient A.” After Mr. Leibowitz pleaded guilty, even the judge said he did not know exactly what Mr. Leibowitz had disclosed.

“All I know is that it’s a serious case,” Judge Alexander Williams Jr., of United States District Court in Maryland, said at the sentencing in May 2010. “I don’t know what was divulged other than some documents, and how it compromised things, I have no idea.”

More...

Court Affirms Legality Of Recording Police Officers

wbur.org

Last Friday, the U.S. First Circuit Court of Appeals issued a ruling that affirmed, stronger than ever, the rights of individuals to openly record the actions of police officers.

In 2007, a young lawyer named Simon Glik was walking through Boston Common when he saw three police officers arresting a teenager. Glik thought the officers were getting a little rough, so he flipped open his cellphone camera and started shooting video.

The officers arrested Glik for, in their minds, violating the state’s wire-tapping law, even though the whole incident happened out in public and Glik didn’t try to conceal the fact that he was recording.

The ACLU took up Glik’s cause and the courts threw out the charges against him. Since then, the Boston Police Department has been instructing personnel that the state’s wiretapping law does not apply to people making unconcealed audio or video recordings in public. But Glik and the ACLU have pressed on, suing the BPD and the individual officers for violating his First Amendment rights.

The officers moved to have the suit dismissed, saying they were just enforcing an interpretation of the law that was handed down to them by their superiors. But on Friday, the federal court disagreed.

More...

Hackers turn Cisco phones into remote bugging devices

theregister.co.uk

Internet phones sold by Cisco Systems ship with a weakness that allows them to be turned into remote bugging devices that intercept confidential communications in a fashion similar to so many Hollywood spy movies, SC Magazine reported.

The publication quoted consultants from Australia-based HackLabs, who said customers had lost $20,000 a day from exploits, which also included attacks that forced the devices to make calls to premium phone numbers. The consultants said the underlying weaknesses were present in the default settings and could be fixed only by making changes to the phones' configuration settings. “The book says to shut off web services,” HackLabs' Peter Wesley was quoted as saying, referring to the manual that shipped with the phones. “Who's going to read all that.”

More...

When Wiretapping Runs Wild

wsj.com

Despite voluminous restrictions on when they can and can’t be used, government wiretaps are still a blunt instrument.

While they can be used to land powerful evidence against insider-trading suspects, recent case have raised fresh questions about when government surveillance crosses a line into unwarranted invasion of privacy.

The WSJ’s Michael Rothfeld provides a look at the issues in this story, out Friday.

It seems that more than 40 secret recordings played for jurors at the trial of Galleon Group founder Raj Rajaratnam, which will head to the jury on Monday, have contained stretches of dialogue that appear exclusively personal.

Yes, personal. In other words: snippets of dialogue that focus on marriages and alleged extramarital affairs, social visits and vacations.

There’s a limit, it seems, to just how much personal information a judge will allow the government to tape. In a ruling on Wednesday, a judge overseeing a different but related insider-trading case excoriated the government for monitoring intimate calls between trader Craig Drimal and his wife about their marriage, which had nothing to do with the case.

The FBI is supposed to stop monitoring conversations that aren’t relevant to an investigation or involve relationships that legally are privileged, such as those with a spouse, attorney, doctor or clergy member. They are allowed, however, to tune back in periodically to make sure the discussion hasn’t changed.

More...

US dragging its feet on wiretapping rules

presstv.ir
Citing the need to protect intellectual property and consumer information like the emails that were leaked in this week's massive Epsilon hack, the Senate Judiciary Committee called a hearing Wednesday to update the Electronic Communications Privacy Act.

Committee member Sen. Sheldon Whitehouse (D-RI) emphasized that while amending the law and taking the time to define privacy took time, that is time that U.S. cyber security remains vulnerable.

"It's thousands of attacks a minute, not thousands of attacks a day," he said. "It's a necessary process, but it's one that's not without peril and it's not one without cost."

However, ECPA, more familiarly known as the wiretapping law, will probably not see a change in the immediate future. The Judiciary Committee called a hearing for the same reasons last year, and the process has been languishing since then. Without an official position from President Obama's administration, the amendment process will not move forward. Raw Story

More...

DOJ To Congress: We Shouldn’t Need A Warrant To Snoop Through Gmail

For years, privacy advocacy groups have been trying to make sure digital data has the same kinds of search and seizure protections that physical documents have. In recent times, even some major companies like Microsoft (NSDQ: MSFT) and AT&T (NYSE: T) have joined together in the Digital Due Process coalition, which wants to modernize the nation’s out-of-date wiretapping laws. Those corporations want law enforcement agents to get a warrant issued by a judge before they are able to tap into sources of data stored in the cloud, such as web email. It’s been an uphill fight—to say the least—and today, the Department of Justice took a position that’s going to make their quest even harder.

According to a report from CNET, a DOJ lawyer told a Senate committee that if cops are required to get a search warrant to tap into email stored online, it could have an “adverse impact” on investigations. “Speed is essential,” he said. “If Congress slows down the process, this would have real-life consequences, particularly where human life is involved.”

More...

Police Charge Man With 'Wiretapping' Because He Made A Phone Call During Traffic Stop

From the you-can't-be-serious dept..techdirt.com
We've covered the disturbing trend of police, prosecutors and the courts to abuse wiretapping laws to charge people with "wiretapping" for recording police in public. The latest such case is even more ridiculous than most. Found via Slashdot, it involves a guy charged with wiretapping the police during a routine traffic stop, because he made a phone call, to which a voicemail system recorded the call at the other end. The guy who was arrested, William Alleman, had just left a gathering of libertarians, meeting in support of an arrest of a local restaurant owner. The police were apparently waiting outside, and Alleman claims he was followed. As he got pulled over, he called the phone number of an answering service for Libertarian activists who are "in trouble with the police" and then used that to record the call. The police claim this was illegal wiretapping.

This is, of course, patently ridiculous. Recording a police officer as he has stopped you is not and should never be considered a crime.

More...

Watch Where You Put That Thing: Wiretapped Teddy Brings $120K Fine

discovermagazine.com
Tap that teddy bear and pay the price: $120,000. Or at least, that’s what Dianna Divingnzzo and her father, Sam Divingnzzo, are due to pay out after being slapped with federal wiretapping charges.

The fines arose from a custody case over Divingnzzo’s daughter with ex-husband William “Duke” Lewton. After Lewton was awarded unsupervised visitation, Divingnzzo put a recorder inside her daughter’s teddy bear (cutely, if not creatively, named “Little Bear”) to document suspected physical and verbal abuse by Lewton. The recorder taped continuously, while Divingnzzo occasionally copied the files and sent them to her father for transcription.

The Little Bear plan got hairy when Divingnzzo tried to use the material to win back sole custody..

More...

House Fails to Extend Patriot Act Spy Powers

wired.com

The House failed to extend three key expiring provisions of the Patriot Act on Tuesday, elements granting the government broad and nearly unchecked surveillance power on its own public.

The act was hastily adopted six weeks after the 2001 terror attacks. Three measures of the act are set to expire at month’s end, and the House’s lack of a two-thirds vote on Tuesday failed to move the sunsetting deadline to Dec. 8, as proposed. The vote was 277-148.

The failure of the bill, sponsored by Rep. James F. Sensenbrenner Jr. (R-Wisconsin), for the time being is likely to give airtime to competing measures in the Senate that would place limited checks on the act’s broad surveillance powers. The White House, meanwhile, said it wanted the expiring measures extended through 2013.

The three expiring Patriot Act provisions are: More...

Former Cabinet Minister claims his phone was bugged as phone hacking probe widens

dailymail.co.uk

A former Cabinet Minister today poured fuel on the phone hacking scandal by claiming his phone was bugged a decade ago.

Nick Brown says he thinks his calls were intercepted around the time the News of the World outed him as gay.

The politician, who was Chief Whip for Tony Blair when he first came to power, said five years later police also warned him calls from his mobile might have been intercepted.

He said: 'I picked up a landline telephone very quickly ... to make another call straight away.

'And the line clicked and then I heard my last conversation played back to me, which was quite eerie. I got on to British Telecom straight away,' he told the Newcastle Journal.

'They said the line showed every signs of having been intercepted manually, not through scanners. It was an amateurish attempt involving the physical intervention of the line with a recording device.'

Mr Brown added that he 'assumed' the hacking was carried out by someone working for a newspaper.

More...

Former cop in court on corruption charge

abc.net.au

A former WA police officer has appeared in the Perth Magistrates Court accused off tipping off a police suspect that his phone was being bugged.

42-year-old Robert Critchley was working in the State Intelligence Division January last year when he is alleged to have told the person who was under investigation that his phone calls were being intercepted.

It is also alleged that between May 2009 and January 2010, Mr Critchley accessed the details of people on the police data base when he was not authorised to do so.

Police say the two incidents are not linked.

They say Mr Critchley, who had been with the force for six years, resigned in September last year after his alleged misconduct came to the attention of the Police Commissioner.

More...

Former asst. county attorney arrested, charged with eavesdropping..

staugustine.com

Former Assistant County Attorney Paras Desai was arrested by St. Johns County Sheriff's Office detectives Monday afternoon and charged with eavesdropping and eight counts of illegal interception of communication, all third-degree felonies.

Desai, 35, of St. Augustine, posted $8,000 bond about 4 p.m. today and was released.

A warrant was issued for his arrest last week, but Desai turned himself in to Sheriff's Detective George H. Harrigan Jr. on Monday, according to booking and offense reports.

The narrative in the warrant said, "The defendant intentionally intercepted oral communications without the consent of the victim. (He) secretly recorded a phone conversation with (county Environmental Division Director) Jan Brewer. The victim had no knowledge of the recording and did not give her consent."

All the intercepted communications -- essentially, recorded phone conversations -- that Desai is charged with allegedly occurred within the County Administration Building at 500 Sebastian View Way, the warrant said.

More...

NY judge questions husband-wife calls on wiretaps

kgw.com

NEW YORK (AP) — A federal judge demanded the government explain itself Wednesday for eavesdropping on phone calls between an insider trading defendant and his wife in a case that was celebrated for its use of wiretaps.

U.S. District Judge Richard Sullivan in Manhattan ruled in favor of the government's right to wiretap insider trading suspects, but drew the line at the private chats between a husband and wife, saying it was the only area where he believed some suppression of the evidence might be warranted. He was the second judge to rule in favor of wiretap evidence in insider trading cases.

Sullivan ordered the government to respond in writing to claims by a lawyer for defendant Craig Drimal that 13 percent of his time on phones involved chats with his wife, including "deeply personal conversations about private marital matters." Drimal has pleaded not guilty.

More...