8 ms·

If only we had these kinds of strong warnings in the VOIP industry. Nearly every provider barebacks the internet, throwing unencrypted signaling data (phone num

If only we had these kinds of strong warnings in the VOIP industry. Nearly every provider barebacks the internet, throwing unencrypted signaling data (phone number dialed, keys pressed during the call, codec to use) and call media over the internet raw, just hoping that no one eavesdrops or alters their data. HIPPA compliance? Nah bruh, unencrypted UDP is just fine! PCI-DSS says we can't take credit cards over this wholly insecure connection? Who cares! Just don't let the auditor near our PBX. Sadly, the HTTPS and IPv6 anti-vaxxer crowd is strong in the VOIP community, if it isn't severely painful to the VOIP company themselves, they aren't going to secure it. Not that they'd secure it properly anyway, even if their livelihoods depended on it...

distances 9y ago
What are VOIP systems used for these days? Private enthusiasts or some company call centers? I've no idea, as I haven't seen one for at least half a decade now -- even all conference calls are always over Skype or Hangouts.
- StudentStuff 9y ago
  The largest VOIP companies in America today are the cable companies, ACN (pyramid scheme with a few million VOIP customers), Vonage (a first mover) then a few dozen minor players that are near the half million customer mark. IMO its a big (but unsurprising) marketing failure. VOIP as a product never really made it into the home, despite all its features and enhancements. Instead, it is limited to the realm of businesses, where it is in most hospitals, medical facilities, chain stores, call centers, and so on.
  - Xylakant 9y ago
    All landline phone connections sold by Telekom in germany are VOIP, it's just mostly hidden from the subscriber. The technology is doing perfectly fine.
    - metilda 9y ago
      VOIP and specifically SIP in its least secure form became the replacement for old tandem circuits. Sadly, rather than pushing SIP hardware out to the endpoints, most lamdline carriers chose to just provide twisted pair service. VoLTE is as close as most consumers will get to proper VOIP service.
      - Tijdreiziger 9y ago
        Giving everyone SIP phones is expensive, and forcing your subscribers to purchase SIP phones will ensure a number of them flee to the competition. Putting the VOIP hardware in the modem makes much more sense, because you have to provide that to your subscribers anyway.
        Xylakant 9y ago
        I actually have my own Cisco Phone adapter to connect my old analog phone/answering machine. I'd assume that a true SIP phone would work as well. What's questionable is whether I could authenticate from a different network than my home network. I know, however, that both Vodafone and Telekom in Germany offer products that allow connecting VOIP phones from anywhere to a virtual phone appliance.
        Tijdreiziger 9y ago
        That's interesting. In the Netherlands, all the telcos (with the notable exception of XS4ALL) lock down the modems and don't give you the settings and logins to use your own equipment (although the Consumer and Market Authority is still researching whether this is actually legal).
        Xylakant 9y ago
        Locking the connection to a provided modem is not legal in Germany since 2016-08-01 by law (FTEG, replaced by FuAG in 2017) The provider is obliged to hand you the required credentials to connect your own hardware, though getting the actual required configuration may require some puzzle work, but most providers give config examples for at least the most common hardware. My setup for example consists of a draytek modem with unifi network hardware and above mentioned Cisco phone adapter. I don’t even have a piece of Telekom-provided hardware here. Took a bit of googling to get IPTv working, but other than that it’s a perfectly stable and capable setup. Many people use Fritz boxes which are a bit less capable but easier to set up.
- askvictor 9y ago
  I'm assuming you're talking about consumer VoIP; in the corporate world, Cisco (and presumably others) do a crapload of VoIP office phones.
  - distances 9y ago
    I also haven't seen an office phone in ages, it's just all mobiles around here.
    - sametmax 9y ago
      It's because you don't do bulk calls. Sells, support, orders, etc. They all need office phones at a certain scale. Not that they couldn't do it with mobiles. But infrastructures for those kind of systems all assume a land line.
      - metilda 9y ago
        Decent deskphones are significantly more comfortable than cellphones, nevermind the better audio hardware.
        sametmax 9y ago
        You could make special apps with a UI made to help with the specific tasks, and with a good bluetooth headset make a nice mobile experience IMO. But yeah currently solid IRL keypads + phone handles are better than mobiles'.
    - pc86 9y ago
      I've worked for pretty much every type of company except VC-funded Silicon Valley style start-ups since about 2008. Every desk I've ever sat at, including the one I'm at now, has had a VoIP phone sitting on it.
      - osteele 9y ago
        In the early days at Nest, one of my co-workers had trouble with his loan application because Nest, his employer, didn’t have a phone number. He showed the bank the company’s web site, and they were satisfied. Only a real company would have an actual web site. For added fun, the site looked like this at the time https://web.archive.org/web/20110207225932/http://nestlabs.com/ https://web.archive.org/web/20110207225932/http://nestlabs.c...
- jldork 9y ago
  I've seen a lot of tech companies use appear.in or talky.io for their VoIP conferencing as well
katastic 9y ago
In my experience, the entire world runs on insecure systems (and will continue to do so until companies start getting sued into oblivion for leaking data). Secure systems are the exception--not the norm. It's just not a priority because companies only prioritize things that "add value". So until we attach a real cost to lack-of-security, it won't be valued. I've literally seen a college have admin credentials hosted on a publicly addressable plaintext document just so that their new machines can netboot. And that's just one, quick, story out of dozens upon dozens I have.
- metilda 9y ago
  Admins are lazy and busy, hence why UW for example runs a totally insecure PBX, which is surprising considering Avaya is usually one of the better vendors.
  - dredmorbius 9y ago
    Admins lack management support for security issues.
seasonalgrit 9y ago
"the HTTPS and IPv6 anti-vaxxer crowd " What does this mean?
- metilda 9y ago
  Pretty sure that means people who refuse to deploy TLS & IPv6, even when their hardware & software stack fully supports it.
  - snowpanda 9y ago
    That makes more sense than trying to force a completely unrelated opinion into a conversation. Also, the notion that broad use of IPv6 = security in VOIP, IoT or any area is a postulation at best. I've personally always found this to be a good overview of security issues involved in both protocols in VOIP: http://ieeexplore.ieee.org/abstract/document/6714161/ http://ieeexplore.ieee.org/abstract/document/6714161/ (Sci-Hub approved) There are certain parts of the industry hesitant to transition for the possibility of security mis-configurations and human errors, the picture that the VOIP industry as a whole holds no interest in security is false. It could definitely improve, but that doesn't just apply to VOIP.
    - acdha 9y ago
      It's not an opinion or unrelated but an analogy to another case where there's very strong evidence of a massive benefit with very little downside which is being objected to based on conspiracy theories and lack of concern for the damage to anyone foolish enough to believe them.
      - Xeoncross 9y ago
        As a side note, the debate is not that simple. Vaccines work, but many vaccines are manufactured without what many would consider proper testing, and using toxic substances banned in different countries. The debate is more about sloppy implementations than about the idea of vaccines as a whole. It's like someone is forcing the issue down to choosing poorly-regulated vaccines - or no vaccines at all. A false dichotomy.
kgbme 9y ago
^^ Keys pressed... Jesus Christ, that alone has fueled entire generations of criminals. :))
- sctb 9y ago
  Could we ask you to please comment more substantively, like the guidelines ask? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
deleted 9y ago
[deleted]
BuuQu9hu 9y ago
HIPAA, not HIPPA. https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act https://en.wikipedia.org/wiki/Health_Insurance_Portability_a...
MichaelGG 9y ago
I've seen PBX people find religion once they wake up Monday morning to a weekend of hacked calls to Africa. Though sometimes that religion is in the form of yelling at upstream providers to please give them refunds. And because of these insecure systems, the more serious issues (all this SIP software is tons of C, and I've found exploits in just 1000 line utilities, let alone protocol level hackery and other fun) get ignored. I found a simple redirect bug in a VoIP platform. Ignored. Later some guy used it to the tune of $90K. I don't want to become a criminal outright but I've gone from a "friendly disclosure offline and let you lie about fixing issues" to "Sit on 'em and sell 'em one day" model because everyone's so obtuse.
- megaman22 9y ago
  SIP... doesn't seem like the greatest protocol. Maybe I'm tainted because I've only really dealt with it in the context of the Microsoft IM/telephony platforms (renamed constantly, but always essentially the same), but it appears to be incredibly brittle complicated. On anything less than a local LAN, messages get dropped or mangled or timed out all the time, and that trashes connections, or puts sessions into unrecoverable states.
  - zAy0LfpBZLC8mAC 9y ago
    I guess you can argue about whether it's the greatest protocol, but the problems you describe most certainly are not procotol problems, but rather broken implementations.
    - MichaelGG 9y ago
      The protocol problems are due to the text-based format and a bizarre desire to make said text format "human friendly". It inherits the stupidity from HTTP (line folding, comments in headers) and adds its own fun. The authors actually suggest that the "intent" of the message be followed in case of errors. It's terrible. The packet issues are due to the strange use of UDP with mandatory TCP switching. Needless complexity. Oh and these aren't theoretical. Two big, widely deployed implementations cannot even agree on how headers end, and will read the same message differently. This can be exploited when a network does header processing. Imagine adding a "x-accountid" header, and removing any existing ones - if interpretation differ on what constitutes a header, an attacker can slip fake headers in. Not entirely dissimilar to browser exploits that let script include a header with a newline in the value, letting scripts maliciously set headers they shouldn't be allowed to.

distances 9y ago

What are VOIP systems used for these days? Private enthusiasts or some company call centers? I've no idea, as I haven't seen one for at least half a decade now -- even all conference calls are always over Skype or Hangouts.

StudentStuff 9y ago
The largest VOIP companies in America today are the cable companies, ACN (pyramid scheme with a few million VOIP customers), Vonage (a first mover) then a few dozen minor players that are near the half million customer mark. IMO its a big (but unsurprising) marketing failure. VOIP as a product never really made it into the home, despite all its features and enhancements. Instead, it is limited to the realm of businesses, where it is in most hospitals, medical facilities, chain stores, call centers, and so on.
- Xylakant 9y ago
  All landline phone connections sold by Telekom in germany are VOIP, it's just mostly hidden from the subscriber. The technology is doing perfectly fine.
  - metilda 9y ago
    VOIP and specifically SIP in its least secure form became the replacement for old tandem circuits. Sadly, rather than pushing SIP hardware out to the endpoints, most lamdline carriers chose to just provide twisted pair service. VoLTE is as close as most consumers will get to proper VOIP service.
    - Tijdreiziger 9y ago
      Giving everyone SIP phones is expensive, and forcing your subscribers to purchase SIP phones will ensure a number of them flee to the competition. Putting the VOIP hardware in the modem makes much more sense, because you have to provide that to your subscribers anyway.
      - Xylakant 9y ago
        I actually have my own Cisco Phone adapter to connect my old analog phone/answering machine. I'd assume that a true SIP phone would work as well. What's questionable is whether I could authenticate from a different network than my home network. I know, however, that both Vodafone and Telekom in Germany offer products that allow connecting VOIP phones from anywhere to a virtual phone appliance.
        Tijdreiziger 9y ago
        That's interesting. In the Netherlands, all the telcos (with the notable exception of XS4ALL) lock down the modems and don't give you the settings and logins to use your own equipment (although the Consumer and Market Authority is still researching whether this is actually legal).
        Xylakant 9y ago
        Locking the connection to a provided modem is not legal in Germany since 2016-08-01 by law (FTEG, replaced by FuAG in 2017) The provider is obliged to hand you the required credentials to connect your own hardware, though getting the actual required configuration may require some puzzle work, but most providers give config examples for at least the most common hardware. My setup for example consists of a draytek modem with unifi network hardware and above mentioned Cisco phone adapter. I don’t even have a piece of Telekom-provided hardware here. Took a bit of googling to get IPTv working, but other than that it’s a perfectly stable and capable setup. Many people use Fritz boxes which are a bit less capable but easier to set up.
askvictor 9y ago
I'm assuming you're talking about consumer VoIP; in the corporate world, Cisco (and presumably others) do a crapload of VoIP office phones.
- distances 9y ago
  I also haven't seen an office phone in ages, it's just all mobiles around here.
  - sametmax 9y ago
    It's because you don't do bulk calls. Sells, support, orders, etc. They all need office phones at a certain scale. Not that they couldn't do it with mobiles. But infrastructures for those kind of systems all assume a land line.
    - metilda 9y ago
      Decent deskphones are significantly more comfortable than cellphones, nevermind the better audio hardware.
      - sametmax 9y ago
        You could make special apps with a UI made to help with the specific tasks, and with a good bluetooth headset make a nice mobile experience IMO. But yeah currently solid IRL keypads + phone handles are better than mobiles'.
  - pc86 9y ago
    I've worked for pretty much every type of company except VC-funded Silicon Valley style start-ups since about 2008. Every desk I've ever sat at, including the one I'm at now, has had a VoIP phone sitting on it.
    - osteele 9y ago
      In the early days at Nest, one of my co-workers had trouble with his loan application because Nest, his employer, didn’t have a phone number. He showed the bank the company’s web site, and they were satisfied. Only a real company would have an actual web site. For added fun, the site looked like this at the time https://web.archive.org/web/20110207225932/http://nestlabs.com/ https://web.archive.org/web/20110207225932/http://nestlabs.c...
jldork 9y ago
I've seen a lot of tech companies use appear.in or talky.io for their VoIP conferencing as well

katastic 9y ago

In my experience, the entire world runs on insecure systems (and will continue to do so until companies start getting sued into oblivion for leaking data). Secure systems are the exception--not the norm. It's just not a priority because companies only prioritize things that "add value". So until we attach a real cost to lack-of-security, it won't be valued. I've literally seen a college have admin credentials hosted on a publicly addressable plaintext document just so that their new machines can netboot. And that's just one, quick, story out of dozens upon dozens I have.

metilda 9y ago
Admins are lazy and busy, hence why UW for example runs a totally insecure PBX, which is surprising considering Avaya is usually one of the better vendors.
- dredmorbius 9y ago
  Admins lack management support for security issues.

seasonalgrit 9y ago

"the HTTPS and IPv6 anti-vaxxer crowd " What does this mean?

metilda 9y ago
Pretty sure that means people who refuse to deploy TLS & IPv6, even when their hardware & software stack fully supports it.
- snowpanda 9y ago
  That makes more sense than trying to force a completely unrelated opinion into a conversation. Also, the notion that broad use of IPv6 = security in VOIP, IoT or any area is a postulation at best. I've personally always found this to be a good overview of security issues involved in both protocols in VOIP: http://ieeexplore.ieee.org/abstract/document/6714161/ http://ieeexplore.ieee.org/abstract/document/6714161/ (Sci-Hub approved) There are certain parts of the industry hesitant to transition for the possibility of security mis-configurations and human errors, the picture that the VOIP industry as a whole holds no interest in security is false. It could definitely improve, but that doesn't just apply to VOIP.
  - acdha 9y ago
    It's not an opinion or unrelated but an analogy to another case where there's very strong evidence of a massive benefit with very little downside which is being objected to based on conspiracy theories and lack of concern for the damage to anyone foolish enough to believe them.
    - Xeoncross 9y ago
      As a side note, the debate is not that simple. Vaccines work, but many vaccines are manufactured without what many would consider proper testing, and using toxic substances banned in different countries. The debate is more about sloppy implementations than about the idea of vaccines as a whole. It's like someone is forcing the issue down to choosing poorly-regulated vaccines - or no vaccines at all. A false dichotomy.

kgbme 9y ago

^^ Keys pressed... Jesus Christ, that alone has fueled entire generations of criminals. :))

sctb 9y ago
Could we ask you to please comment more substantively, like the guidelines ask? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

deleted 9y ago

[deleted]

BuuQu9hu 9y ago

HIPAA, not HIPPA. https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act https://en.wikipedia.org/wiki/Health_Insurance_Portability_a...

MichaelGG 9y ago

I've seen PBX people find religion once they wake up Monday morning to a weekend of hacked calls to Africa. Though sometimes that religion is in the form of yelling at upstream providers to please give them refunds. And because of these insecure systems, the more serious issues (all this SIP software is tons of C, and I've found exploits in just 1000 line utilities, let alone protocol level hackery and other fun) get ignored. I found a simple redirect bug in a VoIP platform. Ignored. Later some guy used it to the tune of $90K. I don't want to become a criminal outright but I've gone from a "friendly disclosure offline and let you lie about fixing issues" to "Sit on 'em and sell 'em one day" model because everyone's so obtuse.

megaman22 9y ago
SIP... doesn't seem like the greatest protocol. Maybe I'm tainted because I've only really dealt with it in the context of the Microsoft IM/telephony platforms (renamed constantly, but always essentially the same), but it appears to be incredibly brittle complicated. On anything less than a local LAN, messages get dropped or mangled or timed out all the time, and that trashes connections, or puts sessions into unrecoverable states.
- zAy0LfpBZLC8mAC 9y ago
  I guess you can argue about whether it's the greatest protocol, but the problems you describe most certainly are not procotol problems, but rather broken implementations.
  - MichaelGG 9y ago
    The protocol problems are due to the text-based format and a bizarre desire to make said text format "human friendly". It inherits the stupidity from HTTP (line folding, comments in headers) and adds its own fun. The authors actually suggest that the "intent" of the message be followed in case of errors. It's terrible. The packet issues are due to the strange use of UDP with mandatory TCP switching. Needless complexity. Oh and these aren't theoretical. Two big, widely deployed implementations cannot even agree on how headers end, and will read the same message differently. This can be exploited when a network does header processing. Imagine adding a "x-accountid" header, and removing any existing ones - if interpretation differ on what constitutes a header, an attacker can slip fake headers in. Not entirely dissimilar to browser exploits that let script include a header with a newline in the value, letting scripts maliciously set headers they shouldn't be allowed to.