Bruce Schneier discusses how to wiretap VoIP telephony

[ИнфоПоиск]

Bruce Schneier discusses how to wiretap VoIP telephony webplanet.ru Author of Applied Cryptography, a well-known specialist Bruce Schneier discusses methods of wiretapping landline and mobile phones, as well as VoIP telephony, which is much more vulnerable. There are four main ways to intercept someone else's phone call, writes Bruce Schneier in Wired magazine. The first and easiest way is to pick up a parallel pipe in another room. This is a favorite pastime of many brothers and sisters. Although this method does not work for mobile phones, radiotelephones are also vulnerable to this type of attack, because you can tune the receiver to the same frequency and it will work as a parallel device. The second way is to introduce a bug in the telephone line (you can even outside the apartment). This is also a very easy way. They used to be used by the police, but now they use various criminal elements. This method is also not suitable for mobile phones. The third option is to introduce a bug in the telephone switchboard. Modern equipment allows you to do this. Nowadays, the police prefer precisely this technology of “wiretapping”, so as not to go home to every “client”. In addition, this method works for both landline phones and mobile phones. The fourth and most laborious way is wiretapping on satellite communication lines, international cables, etc. It is difficult for one person to organize such a system, but special services with millions of budgets specialize in this. In this way, they can record and listen to millions of communication lines simultaneously. When people talk about intercepting VoIP calls, they often think about one of the above methods. But here they are wrong. In fact, VoIP telephony is fundamentally different from traditional telephony. This is more about computer security than about protecting telephone lines. Here you need to take care of the protection of information packets that are transmitted over the Internet. These packets can be intercepted at the local network, provider, or at the backbone network level. Access to these packages can be obtained by anyone who has legal access to one of the many computers through which traffic passes, or anyone who successfully hacks these computers. Anyone can gain such access: a hacker, a criminal, a competitor, or a government service. In fact, intercepting VoIP traffic is much easier than eavesdropping on a mobile phone. At least for criminals or competitors, this is much easier than accessing the telephone switch. Bruce Schneier lists many cases where criminal elements can use wiretapping of VoIP phone calls to blackmail, extort, steal trade secrets or private information. With the help of VoIP telephony, according to Schneier, they can do much of what they could not afford before on ordinary telephone lines. VoIP telephony is more vulnerable to wiretapping than landline and mobile phone lines. This is why strong cryptography is so important. Cryptography is one of the key technologies for securing computer information, and it must be used to protect VoIP. Bruce Schneier ironically says that the government also supports the idea of cryptographic protection for all citizens, but only on the condition that the security services will have keys to each cipher. We add from ourselves that not only the American, but also the Russian special services take exactly the same position. This is an extremely bad idea for many reasons, says Schneier. A recent case in Greece clearly confirms the vulnerability of such a system. There, criminal elements gained access to a listening system designed exclusively for the police. They recorded cell phone conversations with about a hundred of the largest Greek politicians and businessmen. Fortunately, there are many cryptographic protection programs for VoIP telephony. Skype has this protection built in initially. PGP author Phil Zimmerman recently released a simple Zfone module under a free license to protect VoIP calls. There is even a special VoIP Security Alliance. However, you need to understand that the cryptographic protection of VoIP traffic is not a panacea. Of the four threats listed above, it protects only from three - from the second to the fourth, but not from the first. Thus, the most important threat is traffic interception at the endpoint, on the user's computer. In reality, not a single cryptographic program will protect you from penetrating the system of a trojan or a worm, or a hacker who will get full control over your computer. That is, according to Jurius Schneier, it all comes down to the previous problem: we need more secure computers and operating systems even more than protecting communications.

 

[Матушкин Андрей Николаевич]

Thank!