6 ms·

I'm curious about this encrypted VoIP network. I've never heard of an off-the-shelf product like that, so was it custom-written? What was the interface like? T

by morley 8y ago

I'm curious about this encrypted VoIP network. I've never heard of an off-the-shelf product like that, so was it custom-written? What was the interface like? The source NYT article has some more details, but not enough to answer these questions: One of Mr. Guzmán’s Colombian suppliers, Jorge Cifuentes, who introduced the kingpin to the I.T. expert, testified last month that Mr. Rodriguez had promised to arrange secure communications for what amounted to the entire cartel’s leadership. His system operated on VoiP, or voice over internet protocol, Mr. Marston said on Tuesday, and was accessible only to those within the network. According to Mr. Cifuentes, Mr. Guzmán was able to sign in through Wi-Fi even from his hide-outs in the Sierra Madre mountains. https://www.nytimes.com/2019/01/08/nyregion/el-chapo-trial.html https://www.nytimes.com/2019/01/08/nyregion/el-chapo-trial.h...

segfaultbuserr 8y ago
Why can't it be a common off-the-shelf VoIP server with a custom deployment? e.g. a Mumble server behind TLS with client authorization?
dylz 8y ago
I would imagine this is just a standard open source SIP server or something plus VPN, with encryption turned on.
newman314 8y ago
IMO, the article was a little breathless in its reporting. I wonder if the encryption here is just SRTP/ZRTP.
nimbius 8y ago
Asterisk has had SIP/TLS for a 5 years now. Ive tried it a few times, and its not too bad with ECDSA or smaller RSA keys. https://wiki.asterisk.org/wiki/display/AST/SIP+TLS+Transport https://wiki.asterisk.org/wiki/display/AST/SIP+TLS+Transport
Kenji 8y ago
Easy. Just make a mumble server. The server is authenticated with a public key and the communication is encrypted. The only way to listen to the communication is if you pwn one of the clients or the server. Btw I can really recommend mumble. At this stage it is plug & play and the quality is really good. I set it up for my parents (on my own mumble server running on my linux server) and we only mumble call these days.
jasonjayr 8y ago
I have a tinc + asterisk setup to my cell phone (for my personal/home line) and openvpn + asterisk to desk Yealink phones (They have built-in openvpn clients) (for business) Fairly easy to maintain + grow once you get some basics out of the way. The net result is that all the signaling + transport is encrypted as far as non-VPN nodes are concerned.
- addajones 8y ago
  I’d love to know about this setup! What hardware you run it on and where you get the #’s from for the home line. Trying to set up something like this for myself at home and business. Thank you!!
  - jasonjayr 8y ago
    The business line has a T1, and a Sangoma Vega 100 T1/SIP gateway, with SIP trunking service from https://voip.ms https://voip.ms as a backup if there's trouble w/ the T1. (My personal phone service is just voip.ms at this point) Yealink T23P Phones have a OpenVPN client built in (some newer Grandstream phones do too), these are relatively inexpensive VoIP desk phones. Once you configure them, and an OpenVPN server you can plug them anywhere you have internet (NAT'ed or otherwise), and not have to worry about NAT Traversal, or other issues. Asterisk is just running on a stock PC. I'm running on a Supermicro Board with an Atom processor, and for our call volume (50 extension phones, 23 inbound lines, 30 on an inbound call queue, 3 simultaneous calls average, 15 @ our known peak, no transcoding (all uLaw)). The OpenVPN server is a a separate machine, for lighter usage the VPN + Asterisk could probably be the same machine. For the cell phone, I have CSipSimple running there, with a OpenVPN client to connect to the network. In my configuration, the phones + Asterisk are not using SSL/TLS directly, but the VPN secures the traffic over untrusted LANs. Calls within the system are on the protected LAN, but once they reach out to the PSTN, all bets are off. I've setup a smaller office with a Raspberry Pi 3, and a Grandstream SIP/Analog Gateway, ( 7 Grandstream phones, 3 lines, no transcoding, not very heavy use), and they haven't had any complaints. (see http://www.raspberry-asterisk.org/ http://www.raspberry-asterisk.org/) If they used SIP trunking over their internet connection, they woulden't need the SIP/Analog gateway, which was the single most expensive piece of equipment in this setup (@ US$399-ish)
Liblor 8y ago
According to this [1] dutch article, they used a private Blackberry server. [1] https://www.volkskrant.nl/nieuws-achtergrond/nederlandse-politie-tapte-anderhalf-jaar-lang-alle-communicatie-van-mexicaanse-drugsbaron-el-chapo-~bab33a30/ https://www.volkskrant.nl/nieuws-achtergrond/nederlandse-pol...

by morley 8y ago

segfaultbuserr 8y ago

Why can't it be a common off-the-shelf VoIP server with a custom deployment? e.g. a Mumble server behind TLS with client authorization?

dylz 8y ago

I would imagine this is just a standard open source SIP server or something plus VPN, with encryption turned on.

newman314 8y ago

IMO, the article was a little breathless in its reporting. I wonder if the encryption here is just SRTP/ZRTP.

nimbius 8y ago

Asterisk has had SIP/TLS for a 5 years now. Ive tried it a few times, and its not too bad with ECDSA or smaller RSA keys. https://wiki.asterisk.org/wiki/display/AST/SIP+TLS+Transport https://wiki.asterisk.org/wiki/display/AST/SIP+TLS+Transport

Kenji 8y ago

Easy. Just make a mumble server. The server is authenticated with a public key and the communication is encrypted. The only way to listen to the communication is if you pwn one of the clients or the server. Btw I can really recommend mumble. At this stage it is plug & play and the quality is really good. I set it up for my parents (on my own mumble server running on my linux server) and we only mumble call these days.

jasonjayr 8y ago

I have a tinc + asterisk setup to my cell phone (for my personal/home line) and openvpn + asterisk to desk Yealink phones (They have built-in openvpn clients) (for business) Fairly easy to maintain + grow once you get some basics out of the way. The net result is that all the signaling + transport is encrypted as far as non-VPN nodes are concerned.

addajones 8y ago
I’d love to know about this setup! What hardware you run it on and where you get the #’s from for the home line. Trying to set up something like this for myself at home and business. Thank you!!
- jasonjayr 8y ago
  The business line has a T1, and a Sangoma Vega 100 T1/SIP gateway, with SIP trunking service from https://voip.ms https://voip.ms as a backup if there's trouble w/ the T1. (My personal phone service is just voip.ms at this point) Yealink T23P Phones have a OpenVPN client built in (some newer Grandstream phones do too), these are relatively inexpensive VoIP desk phones. Once you configure them, and an OpenVPN server you can plug them anywhere you have internet (NAT'ed or otherwise), and not have to worry about NAT Traversal, or other issues. Asterisk is just running on a stock PC. I'm running on a Supermicro Board with an Atom processor, and for our call volume (50 extension phones, 23 inbound lines, 30 on an inbound call queue, 3 simultaneous calls average, 15 @ our known peak, no transcoding (all uLaw)). The OpenVPN server is a a separate machine, for lighter usage the VPN + Asterisk could probably be the same machine. For the cell phone, I have CSipSimple running there, with a OpenVPN client to connect to the network. In my configuration, the phones + Asterisk are not using SSL/TLS directly, but the VPN secures the traffic over untrusted LANs. Calls within the system are on the protected LAN, but once they reach out to the PSTN, all bets are off. I've setup a smaller office with a Raspberry Pi 3, and a Grandstream SIP/Analog Gateway, ( 7 Grandstream phones, 3 lines, no transcoding, not very heavy use), and they haven't had any complaints. (see http://www.raspberry-asterisk.org/ http://www.raspberry-asterisk.org/) If they used SIP trunking over their internet connection, they woulden't need the SIP/Analog gateway, which was the single most expensive piece of equipment in this setup (@ US$399-ish)

Liblor 8y ago

According to this [1] dutch article, they used a private Blackberry server. [1] https://www.volkskrant.nl/nieuws-achtergrond/nederlandse-politie-tapte-anderhalf-jaar-lang-alle-communicatie-van-mexicaanse-drugsbaron-el-chapo-~bab33a30/ https://www.volkskrant.nl/nieuws-achtergrond/nederlandse-pol...