Hackers-cum-researchers performed an interesting security-testing
experiment earlier this year using VoIP phone numbers and Internet
social networks. They presented their findings recently at Defcon.
Their
primary plan was to determine if secret signals could be passed right
out in the open, from enemy agencies to their agents. They theorized
that the use of social networks to transmit carrier messages might
increase the noise ratio so that it would be harder for "unauthorized
parties" to decode the secret but publicly-transmitted messages.
This is in fact a technique already used covertly by intelligence agencies. However, they use shortwave numbers stations, and all governments have denied such operations. The general technique is to broadcast streams of seemingly nonsensical numbers or words, often in a female or child's voice. Of course, the stream represents a code, and only a few parties have the cipher to decode it.
Strom
Carlson, a security researcher, and the hackers collective Project Evil
teamed up to see if someone could do the same thing using the Internet,
particularly using any of the abundant social networks out there. What
they did was set up their own numbers stations. But instead of using
shortwave transmissions, they used VoIP phone numbers and recordings.
If you called such a number, you would hear a stream of code words.
They advertised the existence of the VoIP numbers stations using
Craigslist pages, using fake messages, to see if anyone would
participate.
In short, they were successful getting others with
a cryptographic interest to participate and decode messages using a
one-time key. They figure enemy forces could be too. This is something
proponents of CALEA
may want to take note of: if hostile parties want to use VoIP, they are
not necessarily going to use unencoded messages. (On the other hand,
this experiment by Carlson might just give CALEA proponents more
fodder.)
CALEA stands for Communications Assistance for Law Enforcement Act,
and, in short, gives any Law Enforcement agency the right to wiretap
communications networks, including the Internet and VoIP, in special
circumstances. Although to date, it's not on the agenda to tap soft VoIP calls using clients such as GoogleTalk and Skype.
Of
course, there are those people that believe that email spam is being
used as numbers stations for intelligence communications. Although who
is behind it is hard to say. (I particularly notice some interesting
word patterns in the spam in my university alumni email account.) Public key cryptography
concepts date back centuries, and the Internet is a perfect
distribution vehicle. Just never thought VoIP could be used as a
supplementary broadcasting outlet.
Additional sources: Slashdot, Homeland Stupidity, Defcon.
