Demos to show spying on mobile IP calls

Using VoIP-based mobile devices over Wi-Fi or IP video phones? Be careful.

Researchers plan to demonstrate this weekend how they can eavesdrop on voice over IP conversations made using an iPhone over a Wi-Fi network and snoop on video and audio communications between IP video phones.

These types of man-in-the-middle eavesdropping attacks aren't new, however these could be the first public demonstrations of them on these particular platforms.

This screen shot shows the user interface of UCSniff. The user can listen in on a conversation and see the video of two people talking on an IP-based video phone. The two video screens show what each of the video phones is displaying.

(Credit: Viper Lab, Sipera Systems)

In the VoIP demo at ToorCon in San Diego on Saturday, Jason Ostrom, director of Viper Lab at Sipera Systems will listen to the conversation of someone talking on an iPhone over an unsecured wireless network. The exploit targets smartphones that are using the SIP (session initiation protocol) for VoIP, he said on Friday.

Ostrom will use an open-source assessment tool called UCSniff to listen to and record the conversation. A new version of the tool will be released publicly on Saturday, he said.

In another demo, Ostrom will show an attack in which he can view and listen in real time to video and audio from a conversation made over an IP video phone.

At Defcon in July, Ostrom demonstrated attacks in which someone could eavesdrop on video conference calls and intercept surveillance camera video.

Sipera Systems will announce new security products next week that can help protect against the VoIP over Wi-Fi smartphone attack, said Adam Boone, vice president of marketing and product management at the company.

[solitare_pax]

I think I saw this on an NCIS episode.

[SteveW928]

While it would be nice to have standard encryption on SIP, this isn't as big of a deal as it sounds. Remember the days when any police scanner could listen to all the cordless phone conversations around. And, it isn't exactly rocket-science to listen to land-line calls either. This isn't that different.

If you really need privacy for some reason, be sure to use an encrypted mode. While most people wouldn't mind having it, most people don't need it.

[DnetMHZ]

Is this really earth shattering? They can intercept traffic on an unsecured wireless network. If my neighbor yells out his window, I can intercept that too!

[almost_rice]

Looks like someone in the phone industry is trying to scare us from using alternatives.