| 
APEC LogoAPEC TEL WG LogoVoIP Security

A case study in VoIP integrity

Scenario

Jason owns and runs a small convenience store which frequently requires inventory cleansing and reordering. Jason places his orders with stockists via telephone, and currently uses a softphone both at home and at the shop to place the shop orders and uses an ADSL2 connection for both. The stockists utilise a PSTN.

Jason has been noticing that there have been discrepancies in some of the orders made, where a number of orders he had stated were never invoiced nor delivered. Unsure of what was going on, Jason asked stockists why certain orders were missing. The stockists claimed that the orders had never been placed during the phone calls, but that there had been a number of silent gaps in the calls. 

VoIP compromise

Jason contacted the support team for the softphones that he uses for investigation of likely problems. Support stated that either Jason’s connection was dropping out (but this was unlikely as the call did not end until Jason hung up the phone), or that Jason was experiencing a man-in-the-middle attack on some of his phone calls – someone was tapping into his conversations and introducing silence into the conversation before it reached the stockists.

Solution

Disturbed by the thought of someone having such access to his calls, Jason looked around the Internet for ways to secure his softphone from man-in-the-middle attacks. He found that the easiest solution for his purposes and limited technical background was to install a 3rd party VoIP security solution which would maintain the integrity (and confidentiality) of his calls.

The solution utilised protocols which offered end-to-end security, and would protect Jason’s calls during transmission while travelling over Internet infrastructure.