‘Net pioneers sound security alarm over VoIP wiretaps

Making it possible for law enforcement to tap VoIP calls will open Internet security holes that could endanger corporate voice and data traffic, according to a report by a group of respected Internet figures.

With the federal wiretapping law scheduled to apply to providers of VoIP next May 14, now is the time for businesses to evaluate whether to take steps to counter the risks it represents, the experts say.

The report, “Security Implications of Applying the Communications Assistance to Law Enforcement Act to Voice over IP,” calls CALEA wiretapping “an architected security breach” that could be exploited by unauthorized parties.

Given the difficulty of isolating voice packets among data packets mixed in a stream, even legitimate use of wiretaps will inevitably result in capturing more than just the phone calls authorized by CALEA court orders, says David Endler, a director of the Voice Over IP Security Alliance, an industry association focused on developing VoIP security standards. “How would you limit it to voice? This apparatus would have to capture everything,” he says.

With businesses embracing converged networks that carry voice and data, this puts more than phone calls at risk – instant messaging, e-mail and any corporate transactions made over the Internet could be captured, the report says.

The report was written for the Information Technology Association of America, a trade organization, and its authors include Internet pioneer Vint Cerf, public-key cryptography developer Whitfield Diffie and IETF security leader Steven Bellovin.

A wiretap is a vulnerability that others besides law enforcement could exploit, and the routers that would be tapped are not kept uniformly secure, the panel notes. Typically these devices are less secure than phone switches in the traditional public phone network, the authors say.

In the hands of malicious parties, a tap could grab any type of traffic passing through the router and be an access point for man-in-the-middle attacks, in which data in a stream is altered. “By opening up the communications to an unacknowledged third party, wiretapping is a designed security breach; the combination of wiretapping with remote delivery elevates the risk that communications security can be violated with minimal risk of discovery,” the report says.

If misused, the technology could yield identity information about individuals as well as passwords, according to the report.

The safest way to avoid traffic being compromised is to encrypt it either via VPNs, as the report notes, or from end device to end device, says Phil Zimmermann, the creator of Zfone, software that does just that.

CALEA may represent a potential VoIP vulnerability but it’s not the only one. “You could have one of the computers in your office infected with spyware that monitors traffic going by, including voice packets,” Zimmermann says.

“The spyware could be organized to sort who calls whom, so whoever put the spyware there could pick and choose whom they want to listen to. It would be pick-and-choose wiretapping from the other side of the world,” he continued. So encrypting all VoIP traffic that must be kept secret makes sense.

Tapping specific VoIP calls would be difficult, says Dave Thomas, CEO of hosted service provider Telesphere Networks, in Scottsdale, Ariz. “If you wanted to listen to a specific user, you’d have to know the [media access control (MAC)] addresses associated with the call,” he says. Without those, given that individual devices can call from anywhere they are attached to the Internet, sorting individual calls would be nearly impossible.

Thomas says in special cases like his own business, which hosts call center applications, he knows the MAC address of each machine involved so he could readily track calls to and from them. But generally this cannot be known, he says.

Given the varying models of how service providers provision VoIP, it may take some time before providers figure out effective ways to tap VoIP, buying security-conscious businesses a little more time. “There’s a lot left to be played out in this scenario,” Endler says. “There’s going to be a lot of wrangling over the next year or two.”