quetwo
That VoIP Guy
Premium
join:2004-09-04
East Lansing, MI
| reply to anony101
Re: Excellent!!
said by anony101 :
Keep in mind that encrypted VOIP calls lose the encryption once they reach the PSTN.
True, but again, the PSTN is regulated, and in the pre-Bush world, it was very hard to get access to the data going across it. Sadly this is not the case as much anymore. |
|
quetwo
That VoIP Guy
Premium
join:2004-09-04
East Lansing, MI
| reply to nitzan
said by nitzan  :Keep in mind however that the only ones who can "listen in" on your calls are your ISP, our ISP, and the phone companies on the way. None of which are going to bother filtering through millions of minutes of call time. If a third-party wanted to spy on you specifically, in 99% of cases they can't. My point is that let alone your ISP, but if you are in a business enviroment (the largest deployment of VoIP is in the business world), most workers work on a common switching infastructure as their telecommunications equipment. If I have a SIP/H.323 link between my PBX and your service, it would not be encrypted. Chances are it will also travel over some of this common switching infastructure, where it could be snooped on.
This is how my PBX is setup, except we went the extra mile of forcing our vendor (Qwest) to allow us to interconnect with H.323e + TLS/G.711. That way, the signaling and the voice channels are encrypted the entire stretch (although the encryption is fairly weak, but it still exists). |
|
joako
Premium
join:2000-09-07
/dev/null
 ·AT&T U-Verse
1 edit | reply to quetwo
said by quetwo :said by joako :Most of these banks also send a good amount of their voice traffic over T1 (voice) lines which would be trivial to tap into, even down the road. It is actually very difficult to tap into a T1 service. T1 lines uses a very sporratic form of CRC checking for SLIP errors. Any loss on the line would disrupt the communicaiton and cause major alarms on the equipment on either side. You usually can't get a tone/test on a pair NEAR a T1 before it causes it to slip. Mind you, if you use an official CSU (or similar device with a monitor bypass port), you can technially sniff the T1, but these should be in fairly secure areas (at the CO and the cust prem). "major alarms" sorry no. Yes the T1 interface might go into red alarm for a second... the end on the CO is certainly not monitored. The "alarm" is more of a name than anything. If you call in a trouble ticket yes they will look at it but otherwise no.
Same at the other end... noones going to be monitoring the routers to see if there is a problem. Normally there are no IT persons at the banks. Even if the equipment were reporting the line status to a remote point, they aren't going to go on a witch hunt for the remote chance that someone somewhere might be tapping the line. If they are gathering that info they are trying to determine a long term pattern of problems so the telco can fix it.
OTOH I'm not saying it's as easy or trivial to tap into a T1 line as say an analog phone line with a buttset.
--
09:F9:11:02:9D:74:E3:5B:D8:41:56:C5:63:56:88:C0 |
|
Kearnstd
Elf Wizard
Premium
join:2002-01-22
Mullica Hill, NJ | reply to bigunk
i take it you cant just remove the rubber and allagator clip onto each T1 wire inside the twisted pair like they do in the movies.
--
[65 Arcanist]Filan(High Elf) Zone: Broadband Reports |
|
Cthen
join:2004-08-01
Ypsilanti, MI
 ·Comcast
| reply to nitzan
said by nitzan :Interesting. Didn't know that. So essentially, cable internet is inherently less secure than, say, DSL? or better yet - FTTH? Since when has the internet ever been secure on any ISP? Just because some connections go through the CO first doesn't mean some one can't tap into it along the way.  |
|
nitzan
Premium,VIP
join:2008-02-27
 ·ViaTalk
·Comcast
| reply to quetwo
said by quetwo :said by nitzan :Keep in mind however that the only ones who can "listen in" on your calls are your ISP, our ISP, and the phone companies on the way. None of which are going to bother filtering through millions of minutes of call time. If a third-party wanted to spy on you specifically, in 99% of cases they can't. My point is that let alone your ISP, but if you are in a business enviroment (the largest deployment of VoIP is in the business world), most workers work on a common switching infastructure as their telecommunications equipment. If I have a SIP/H.323 link between my PBX and your service, it would not be encrypted. Chances are it will also travel over some of this common switching infastructure, where it could be snooped on. This is how my PBX is setup, except we went the extra mile of forcing our vendor (Qwest) to allow us to interconnect with H.323e + TLS/G.711. That way, the signaling and the voice channels are encrypted the entire stretch (although the encryption is fairly weak, but it still exists). I think in this scenario you'd want to isolate the PBX from the rest of the network, and perhaps implement security between the phones and the PBX. I think it's more likely for a phone to be tapped on the switch it's connected to than between the PBX and VSP. (easier to access the phone's switch)
Either way though- no matter what you do, at this point in time inherently VoIP is not secure. But neither is PSTN for that matter.  There are very few real options for end-to-end secure conversations, and they cost thousands of dollars.
Security will come once there's enough demand in the market of course, but unfortunately we have to wait until that happens.
Another thing to keep in mind is that it is potentially illegal for VoIP providers to provide end-to-end security. i.e. they have a legal obligation to be able to tap your phone should law officials require it (CALEA). They could probably get around it by doing some sort of "translation" where they'd open one secure session with you, and one with the terminating carrier - but again this means technologies that aren't really mature yet. (not to mention extra horsepower for all the encrypted sessions) |
|
anony101
@comcast.net
| reply to nitzan
I could be wrong, but AFAIK your neighbors CANNOT sniff your packets. Unless they have access to the switch - which they don't - they cannot listen in on you.
You ARE wrong.
Why don't you do some READING on the subject. That will save you from posting misinformation which some here will assume is correct. |
|
anony101
@comcast.net
 from:
TKJunkMail
| reply to Cabal
False. Look up BPI+.
I've seen it done. All it takes is a trip to RadioShack. |
|
JackOFFJill
@bellsouth.net
| reply to Kearnstd
No you can't it would take down the ds1.You would have to be on the end of the ds1(customer side after the hand off to the router),telco side IS -189V DC (if using HDSL method of transport for ds1),(and -130v if using repeated route t1 to transport ds1).Telco ds1 is very secure,even better if it goes from electrical (copper wire) to a optical carrier(fiber). |
|
quetwo
That VoIP Guy
Premium
join:2004-09-04
East Lansing, MI
| reply to nitzan
My point is, however, security and encryption exists for many PBXes, but many of the smaller vendors (mostly the softswitch vendors), choose not to use the TIA protocols. H.323, for example, has a very well defined annex spec that specificies DSA based encryption between two end points. Many of the SIP vendors (Polycom, etc), choose not to invest in these technologies. It's just typical of the free/OSS world.
I tell my customers that it is to be assumed that the PSTN is secure from most sources, government aside. It is considered much more secure than any TCP/IP transport, and more secure than any mobile connection (Cell/portable). Inter-tamdem communications are considered very private, as many of the tap-points that are commonly used for wide-range snoops are at Class I and Class II offices. (T), our ILEC will always tap upon a government request, but for the most part, those do require a signed suponea.
CALEA pretty much dictiates that you be able to provide a tap at the point of PSTN interconnection. So, yes, you cannot facilitate end-to-end encryption over the PSTN without a HLS waiver. However, CALEA does not apply for interswitch communications, and switch-to-endpoint communications. It only applies if you act as a "gateway to other services". Our lawyers have interperated this as the communication from one of our customers to the outside only. Encrption between the customer and you should not be an issue in this case. If you act as an ISP, you are only to be concerned that you are able to tap the data from the customer to the next POP; you sholdn't care of the payload. |
|
quetwo
That VoIP Guy
Premium
join:2004-09-04
East Lansing, MI
| reply to joako
I wouldn't say that to be true. At my last job, I worked for a contactor that was responsible for responding to these alarms. Most banks have lightspans to their HQ where a tap on the T1 would show large amounts of attenatituion/loss. Our equipment would alarm out to us on a red or yellow, and we would be be in the equipment to check it out. Any additional slips, or additional signal loss would be an immediate call to the LEC's major account center. If it looked fishy, we would also call the bank's security group.
Almost every time when we caught something, it ended up being a wet transport cable or a janitor leaning a broom against the 66 block. I would get my inital notification within 30-60 seconds, with the rest of the processes kicking off within minutes. That is almost as much time as it would take an attacker to sync up with the D-channel, to even be able to dump the ISDN frames.
Most banks cherish their T1's. Remember that most of their ATM's will run off ISDN-BRI/PRI, so even something as small as a slip could be financially impacting to an end user. Banks don't want to risk loosing customers based on a technology issue (they want to save up their grace for bad customer service ;P ) |
|
ThePhoneGuy
@cisco.com
| reply to quetwo
IT is very easy to tap into an ISDN PRI T-1 voice circuit. Get yourself a TBERD (T-1 Bit Error Rate Detector), and hook up to the two pair of twisted copper wires, anywhere on the pathway. IT happens a thousand time a day, by technicians troubleshooting issues with voice quality. They listen in on calls to start the process. This is much easier to do than sniff IP traffic. |
|
peter_m
Premium
join:2005-07-13
Canada, QC
| reply to nitzan
said by nitzan :said by pandora :Keep in mind however that the only ones who can "listen in" on your calls are your ISP, our ISP, and the phone companies on the way. None of which are going to bother filtering through millions of minutes of call time. Have you heard of the Echelon project?
Peter
EDIT: I don't sleep at night with a tin foil hat on my head... I only wear it when I am near technology. |
|
