Emerging Technology from the arXiv

A View from Emerging Technology from the arXiv

How to Spot Suspicious VoIP signals

One way to steal data is to embed it in a voice call over the internet. Now network engineers are learning how to spot such attacks.

  • February 25, 2010

ISo-called Voice of Internet Protocol or VoIP makes for cheaper and more convenient calling but it also opens an important issue of security. Various people have described how it might be possible to to hi-jack VoIP signals to send confidential information.

These services break down voice signals into digital packets and send it over the internet, in exactly the same way as email or web traffic. Such a malicious attack might involve scanning your computer for interesting tidbits and sending them to a third party each time you make a VoIP call by modifying these packets in some way.

But how easy is it to embed data in a VoIP stream without being noticed? In theory, that ought to be easy to answer. After all, the protocols used to send information are well known. Surely it should be easy to see whether extra data has been added.

Actually no. One way to embed data is to change the order in which packets are sent according to a code. A malicious receiver can retrieve the embedded data by monitoring and re-ordering the packets without the listener being any the wiser. A simple measure of data rate would not spot such a scheme.

Then there is the technique of deliberately delaying certain packets filled with secret information, a technique called Lost Audio Packet Steganography or LACK. Delays are common on the internet and receivers deal with them by simply ignoring late arrivals. However, a suitably equipped receiver could extract any confidential information hidden in these delayed packets.

The only way to spot such attacks is to compare the traffic to ordinary signals and to see how it differs. But what does ordinary traffic look like?

Today, Wojciech Mazurczyk and buddies at the Warsaw University of Technology in Poland publish their study of the characteristics 100 ordinary VoIP calls made between Warsaw and Cambridge in the UK, a distance of some 1800 km . Their idea is characterise ordinary call data so that steganographic attacks can be easily spotted.

Their study throws up some surprises. It turns out that packets are never normally re-ordered in a way that could be used to hide data. So this kind of attack would be easy to spot.

However, data packets routinely get lost so distinguishing these from those that are deliberately delayed by a malicious attacker is hard.

So while VoIP might be cheaper and easier than other forms of voice calling, it may also be less secure. Mazurczyk and co say that more data is needed to study the natural charactersitics of VoIp over a wider range of conditions. But for the moment, it looks as if LACK is a real threat.

Ref: arxiv.org/abs/1002.4303: What are suspicious VoIP delays?

Tech Obsessive?
Become an Insider to get the story behind the story — and before anyone else.

Subscribe today

Uh oh–you've read all of your free articles for this month.

Insider Premium
$179.95/yr US PRICE

Want more award-winning journalism? Subscribe to Insider Plus.
  • Insider Plus {! insider.prices.plus !}*

    {! insider.display.menuOptionsLabel !}

    Everything included in Insider Basic, plus ad-free web experience, select discounts to partner offerings and MIT Technology Review events

    See details+

    What's Included

    Bimonthly home delivery and unlimited 24/7 access to MIT Technology Review’s website.

    The Download. Our daily newsletter of what's important in technology and innovation.

    Access to the Magazine archive. Over 24,000 articles going back to 1899 at your fingertips.

    Special Discounts to select partner offerings

    Discount to MIT Technology Review events

    Ad-free web experience

/
You've read all of your free articles this month. This is your last free article this month. You've read of free articles this month. or  for unlimited online access.