Catching Someone Listening to Your Calls

This is early research from my master's studies at ITS. It is about how to detect an eavesdropper on internet phone calls.

The Setup

Before smartphones ate the world, internet calling (VoIP) was the exciting frontier. You could run your own phone server using open-source Asterisk, connecting calls over the internet instead of traditional phone lines. The protocol that linked these servers together was called IAX2.

IAX2 had a clever design feature: it used just a single network port (4569) for everything. That made it easy to configure and good at getting through firewalls. But that same simplicity was also its weakness.

The Vulnerability

Because everything flowed through one known port, an attacker knew exactly where to listen. Point a sniffing tool at port 4569 and you could eavesdrop on the call. Researchers had already demonstrated this with tools like Unsniff. There were other attacks too: flood the server with fake ACK packets (denial of service), or send fake identity requests (VoIP spam).

My research asked a specific question: can we detect when someone is eavesdropping, without ruining the call quality?

The Idea

My approach used the network layer. Every device on a network has a MAC address, and routers track these. So I modified the IAX2 mini frame (the small packets that carry voice data) to carry a small extra piece of data: a key tied to the MAC addresses of the legitimate participants.

The system works in two phases. In the signaling phase, the legitimate parties exchange keys and build a table of who is allowed on the network. In the media phase, when a device tries to join, the server checks its key against the granted list. If a device is listening on port 4569 but does not have a valid granted key, it gets flagged as an eavesdropper.

Did It Hurt the Call?

The obvious risk with adding security overhead is that you slow everything down. A laggy phone call is useless. So I simulated the whole thing in OPNET and measured Quality of Service: jitter, delay, throughput.

The result: packet delay stayed between 0.00001 and 0.00002 seconds. By standard VoIP quality tables, that is still good quality. The eavesdropping detection did not wreck the call. That was the win.

Looking Back

This was early work, presented at a national seminar at ITS in 2012. It became the foundation of my later research at Kumamoto University. VoIP security is less of a hot topic now, but the principle holds: security that destroys usability is not security, it is just friction. The goal is protection that stays invisible.

Read the Full Paper

Read the full paper: Analysis Quality of Service on VoIP Application Based on Modified IAX2 Protocol for Eavesdropping Detection →

Presented at Seminar Nasional Manajemen Teknologi XV, MMT-ITS, Surabaya, February 2012.