* Readers say it’s easier to tap both PSTN and VoIP calls than stated previously
A few weeks ago we stated that intercepting a call in the PSTN was much simpler than intercepting a VoIP call – and we pointed out you could even buy an analog “butt set” at your friendly local hardware store to help you do it.
This prompted one reader to reply: “$209 for a BUTT SET?!?!?!?!? You have GOT to be KIDDING!!!!! How about dropping by your local Best Buy, picking up a cheap phone for about $12, cutting the plug off one end of the cord and attaching a couple of alligator clips? I bought a Conair phone a couple of years ago for less than $10 that has all the features of your butt phone except the waterproof cast. You overestimate what it takes to tap a phone line.”
And we agree. We just didn’t want to overstate our case.
But another reader took the opposite approach. He stated:
“In reading your article on VoIP security, I was a little dismayed at the angle your article took. I would agree that to the average user, tapping a [VoIP] call is not that easy. But to a network-savvy individual it is not all that difficult. I am speaking in reference to SIP [Session Initiation Protocol] messages specifically here. All I need to do is have a downloaded copy of a protocol analyzer, some packet reconstruction software and the knowledge of SIP and I can accomplish quite a bit.
“If I know your IP address – which is easily determined by a number of methods – I can look for SIP messages from your host ID and then examine the UDP port assignments and capture packets to/from that UDP assignment. Then save the captured file to a .WAV file and replay it.
“Now certainly there are methods to obscure your IP address (e.g., NAT [network address translation]) but SIP may also reveal your real IP address from a header field within the SIP message that does not get NATed. This is why SIP header encryption is important in some settings. These M&Ps are not for the curious service rep who is ticked at their boss and looking for a little dirt, but to someone well versed in SIP it is not really difficult.”
We’ll continue to share your comments as we hear from you.
