said by bigunk :

Since this is what I do for a living, the more I can learn, the better for my clients.

said by pandora :

Ok, try this. I'm a Future-Nine customer, using a PAP2T. How exactly do I get secure VOIP communication on my calls?

Thanks for the information. I have another question about security. My thought was my cable Internet service is shared with about 60-100 of my neighbors. Wouldn't any of my neighbors on our shared Comcast cable node be able to listen into my VOIP calls?

said by anony101 :

It depends whether your VOIP provider uses SRTP to encrypt RTP packets from you to their proxy. Some do and some don't. You should call them and ask.

Keep in mind that encrypted VOIP calls lose the encryption once they reach the PSTN.

said by anony101 :

Keep in mind that encrypted VOIP calls lose the encryption once they reach the PSTN.

Keep in mind however that the only ones who can "listen in" on your calls are your ISP, our ISP, and the phone companies on the way. None of which are going to bother filtering through millions of minutes of call time.

said by anony101 :

That's not accurate. Cable customers can listen in to unencrypted VOIP calls within the same node they're in which means their neighborhood.

said by anony101 :

That's not accurate. Cable customers can listen in to unencrypted VOIP calls within the same node they're in which means their neighborhood.

said by nitzan :

I could be wrong, but AFAIK your neighbors CANNOT sniff your packets. Unless they have access to the switch - which they don't - they cannot listen in on you.

said by nitzan :

Interesting. Didn't know that.

So essentially, cable internet is inherently less secure than, say, DSL? or better yet - FTTH?

said by TKJunkMail :

You couldn't do it on the PC side of the cable modem. But if you hook up a device directly to the cable and bypass the cable modem altogether with a sniffer device, you could see and capture the packets on your local node.

I could be wrong, but AFAIK your neighbors CANNOT sniff your packets. Unless they have access to the switch - which they don't - they cannot listen in on you.

said by anony101 :

That's not accurate. Cable customers can listen in to unencrypted VOIP calls within the same node they're in which means their neighborhood.

False. Look up BPI+.

said by nitzan :

Keep in mind however that the only ones who can "listen in" on your calls are your ISP, our ISP, and the phone companies on the way. None of which are going to bother filtering through millions of minutes of call time.

If a third-party wanted to spy on you specifically, in 99% of cases they can't.

said by quetwo :

My point is that let alone your ISP, but if you are in a business enviroment (the largest deployment of VoIP is in the business world), most workers work on a common switching infastructure as their telecommunications equipment. If I have a SIP/H.323 link between my PBX and your service, it would not be encrypted. Chances are it will also travel over some of this common switching infastructure, where it could be snooped on.

This is how my PBX is setup, except we went the extra mile of forcing our vendor (Qwest) to allow us to interconnect with H.323e + TLS/G.711. That way, the signaling and the voice channels are encrypted the entire stretch (although the encryption is fairly weak, but it still exists).

said by quetwo :

Would you go to a banking website that didn't offer SSL? Would you call them? Sure! But if you/your company didn't secure their VoIP, it is just as secure as plain HTTP.

said by quetwo :

But what about the people that are not supposed to have access to this data/voice? What about the guy who is there fixing your printer, running Wireshark, and is taking dumps of all of your traffic? There are no longer just policy issues, but real security issues.

Would you go to a banking website that didn't offer SSL? Would you call them? Sure! But if you/your company didn't secure their VoIP, it is just as secure as plain HTTP.

said by joako :

Most of these banks also send a good amount of their voice traffic over T1 (voice) lines which would be trivial to tap into, even down the road.

said by quetwo :

It is actually very difficult to tap into a T1 service. T1 lines uses a very sporratic form of CRC checking for SLIP errors. Any loss on the line would disrupt the communicaiton and cause major alarms on the equipment on either side. You usually can't get a tone/test on a pair NEAR a T1 before it causes it to slip. Mind you, if you use an official CSU (or similar device with a monitor bypass port), you can technially sniff the T1, but these should be in fairly secure areas (at the CO and the cust prem).