VoIP combines the worst security vulnerabilities of IP networks and voice networks. This article discusses vulnerabilities, challenges and countermeasures in securing a VoIP network from the application right down to the hardware. ...
Eavesdropping
Eavesdropping is the intercepting of conversations by unintended recipients. Eavesdropping in VoIP requires intercepting the signal and associated media streams of a conversation. No one argues that an attacker cannot access and install a tap on a telephone pair outside your house. That action, however, requires more visibility and explicit laws prohibit eavesdropping. IP eavesdropping can be accomplished from the comfort of a laptop as long as the tools and expertise exist to carry out the attack successfully.
Ethereal, Ettercap, Vomit represent just some of the software available that is used for media capture. Using the software is as simple as capturing and decoding RTP packets, analyzing sessions and then saving the the captured voice as an audio file (.au). This is based on the fundamental that every header of an RTP packet contains information about the codec used to encode voice samples. The codec used is generally a standard one, which allows the software to decode the RTP packet, and thus the audio data. Thus, an entire conversation can be tapped. (more)
