Embed Notice

@SteveBellovin @chris_bloke @glent @mattblaze I have long considered SIP based VoIP to be vulnerable to the same kind of "route it through my country rather than yours" attack.

SIP is built to use proxies and it tends to use SRV records to find those proxies. If one gets hold of DNS in a way to forge those SRV responses, one can send the SIP data stream (typically RTP) via a spying proxy. Usually any encryption to the actual media stream is piecemeal source=>proxy=>proxy=>destination.

And watching the SIP headers, which also tend to be visible at proxies, opens the door to traffic analysis.

I wrote about this long ago...

What Could You Do With Your Own Root Server?

https://www.cavebear.com/old_cbblog/000232.html