New compression technique makes VoIP vulnerable to eavesdropping

As Rosanna Rosannadanna used to say, “It’s always something; if it’s not thing, it’s another.” Voice over IP (VoIP) telephony offers consumers and businesses considerable savings over traditional telephony, but it has a soft underbelly. As we have written (HS Daily Wire, 5 June 2008), VoIP is especially suitable for sending hidden messages which are difficult to detect, making it the preferred communication tool for terrorists and criminals. The technology now faces the opposite threat: Plans to compress internet (VoIP) phone calls so they use less bandwidth could make them vulnerable to eavesdropping. Most networks are currently safe, but many service providers are due to implement the flawed compression technology. The new compression technique, called variable bit rate compression, produces different size packets of data for different sounds. That happens because the sampling rate is kept high for long complex sounds like “ow,” but cut down for simple consonants like “c.” This variable method saves on bandwidth, while maintaining sound quality. New Scientist’s David Robson writes that VoIP streams are encrypted to prevent eavesdropping, but a team from John Hopkins University in Baltimore, Maryland has shown that simply measuring the size of packets without decoding them can identify whole words and phrases with a high rate of accuracy. VoIP systems accessed via a computer like Skype have become popular in recent years, and Internet-based phone systems are increasingly appearing in homes and offices too to connect conventional telephones.

Only a few services currently employ the vulnerable compression method, but more networks had hoped to include it in future VoIP upgrades, says Charles Wright, a member of the John Hopkins team. “We hope we have caught this threat before it becomes too serious.” Eavesdropping software the team has developed cannot yet decode an entire conversation, but it can search for chosen phrases within the encrypted data. This could still allow a criminal to find important financial information conveyed in the call, says Fabian Monrose, another team member. The software breaks down a typed phrase to be listened for into its constituent sounds using a phonetic dictionary. A version of the phrase is then pasted together from audio clips of phonemes taken from a library of example conversations, before finally being made into a stream of VoIP-style packets. That gives an idea of what the phrase would look like in a real VoIP stream. When a close match is found in a real call, the software alerts the eavesdropper. In tests on example conversations, the software correctly identified phrases with an average accuracy of about 50 percent, but that jumped to 90 percent for longer, more complicated words. Wright thinks these phrases may be the most important. “I think the attack is much more of a threat to calls with some sort of professional jargon where you have lots of big words that string together to make long, relatively predictable phrases,” he says. “Informal conversational speech would be tougher because it’s so much more random.”

Philip Zimmermann, the founder of the Zfone VoIP security project, says the compression schemes lesson longer seem like a good idea. “I’d suggest looking for other alternatives,” he says. Networks could solve the problem by padding out the data packets to an equal length, he adds, although this would reduce the extent of the compression. A paper on the Johns Hopkins team’s work was presented last month at the 2008 IEEE Symposium on Security and Privacy, in Oakland, California.