Feeds

UCSniff - VoIP eavesdropping made easy

Press 1 for CEO wiretap

Protecting against web application threats using SSL

A security consultant with expertise in protecting phone conversations as they travel over the internet has unveiled a new tool that demonstrates just how vulnerable voice over internet protocol, or VoIP, calls are to interception.

UCSniff bundles a hodgepodge of previously available open-source applications into a single software package that helps penetration testers assess the security of VoIP calls carried over a client's network. It also introduces several new features that make eavesdropping on specific targets a point-and-click undertaking.

UCSniff runs on a laptop that can be plugged in to the ethernet port of the organization being probed. From there, a VLAN hopper automatically traverses the virtual local area network until it accesses the part that carries VoIP calls. Once the tool has gained unauthorized access, UCSniff automatically injects spoofed ARP, or address resolution protocol, packets into the network, allowing all voice traffic to be routed to the laptop.

UCSniff streamlines eavesdropping by allowing an attacker to zero in on the conversations of particular users. Targets can be selected by extension number or dial-by-name features, making it easy to listen to all calls made by a specific individual - such as an organization's CEO. Eavesdropping can be further fine-tuned by listening only to calls the CEO makes to a specific person - such as a chief financial officer.

"It's silently intercepting all the traffic and forwarding it to the phone, so a regular phone user would not be able to tell the difference," UCSniff creator Jason Ostrom told El Reg. "They think they're talking directly to the other phone when in fact the tool is actually intercepting all the traffic."

UCSniff also makes it easy to capture bi-directional conversations in a single audio file. It automatically records calls that use the G.711 and G.722 codecs.

Yes, the tool requires physical access to an organization's network, and that means remote eavesdropping isn't possible with UCSniff. But for anyone with access to an ethernet port of the company they want to intrude upon, it could prove invaluable. Ostrom says it can be plugged into hotel VoIP systems as well. Contrast this with the difficulty of snooping on traditional phone calls, which typically requires physical access to a private branch exchange.

Ostrom, who is director of research for security firm Sipera Systems, demonstrated UCSniff on Saturday at the Toorcon security conference in San Diego. He plans to release it as a free download in the next few weeks.

Given the ease of snooping on VoIP calls, you'd think organizations would be more diligent about using encryption. Alas, they aren't, says Ostrom, who estimates about 90 per cent of the organizations he tests still haven't figured out the importance of encrypting their calls. Therein lies his motivation for releasing UCSniff.

"I'd like to think that I'm creating this tool to create education awareness," he said. "It's a tool that every security and VoIP owner should have in their bag and that's why we're giving it away for free." ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.