YouTube Video About Tunneling Data Through a VoIP Call

Here is a YouTube video describing, at a super high level, how to tunnel information through a VoIP call. There is nothing really new here, just a quick summary of how to do it. They use the term "Vunnel", man I sure hope that does not catch on.

http://www.highdatasecurity.com/how-to-vunnel-steal-information-through-voip.html

Note that this attack won't work in a typical enterprise, because virtually all calls are still converted to TDM by media gateways. Typical connections over the PSTN are "lossy" and the information will arrive corrupted. Thats why modems are used. This attack will only work for an end-to-end IP call, where nothing in the network fiddles with the data. An example would be transcoding, where one codec, like G.711 is coverted to G.729, again resulting in lost data.

If this attack becomes an issue, one way to solve it is to make sure only authenticated IP phones and softphones can connect to the call agent. Another way is for an edge security device to watch for "voice" call that are really data calls.

Comments

[f]

I tried this and it fits my needs.
http://voipsipsdk.com/Download.aspx

[Paul Sand]

This attack is actually quite successful in a typical enterprise. Media Gateways really don't molest the payload of most VoIP calls. The Media Gateways almost always interconnect to the PSTN with ISDN-PRIs. The VoIP traffic almost always is G.711. Both the ISDN-PRIs and G.711 use mu-law PCM encoding. This means the media gateway does absolutely no transcoding and thus does not introduce any loss. Salare Security will shortly be releasing a white paper addressing this particular myth of media gateways. I'll post back when it is ready to go.

The counter measures suggested do not work. The endpoints used in a Vunneling exploit are authenticated IP phones and softphones. Relying on "edge security devices" does not work either. The edge security devices capable are not capable of examining the content of the VoIP media channel -- it very likely is encrypted and the impact of doing something like this would be disastrous to latency and jitter. The only solution I know that can defend against this exploit is Salare's vPurity appliance or OEM software.

[Paul Sand]

Salare Security has just released the white paper ("Easy Out") I mentioned in a previous comment. The white paper can be found at http://www.salaresecurity.com/EasyOut.html. Data can be stolen through VoIP Media Gateways, the white paper explains how it can be easily be done.