 Re: How secure is SIP ?
Ivor Jones wrote:
> "Doz" <ssskkk@zmail.ru> wrote in message
> news:10yntt60h5fx3$.8jptkbef4lkw$.dlg@40tude.net
>> How secure is sip ?
>>
>> I hear people banging Skype on security... just wondered
>> if SIP was secure ?
>
> Nothing is *totally* secure, it depends on how much time, money and
> expertise you have available to crack it..!
>
> Although I'd hazard a guess that unless you're GCHQ or the CIA, it would
> be proably be easier to bug the room in which the person is making the
> call..!
*If* (and it's a big if) you're in a position to watch the packets go
past on the internet (or on your local Ethernet on route to the
Internet) then you can use open-source software to record a nice .WAV
file! I think Ethereal does that now. That is, standard SIP just sends
all voice traffic in the clear.
If you watch the packets go past in Ethereal, you can see that there's
some attempt to protect the signalling traffic to try to guard against
call fraud, but it isn't immediately obvious how secure that is. That
is, I'm not sure whether I should be worried about the possibility of
call fraud.
In the absence of a robust security analysis, my gut feeling is that SIP
is probably good enough to use on ADSL, but should be avoided on
unencrypted wi-fi, cable internet (if the downlink is shared) and on any
other untrusted networks where packet interception is likely to occur.
- Martin.
 | 
Linear Mode
