Uncovering Spoken Phrases in Encrypted Voice over IP Conversations

Abstract

Although Voice over IP (VoIP) is rapidly being adopted, its security implications are not yet fully understood. Since VoIP calls may traverse untrusted networks, packets should be encrypted to ensure confidentiality. However, we show that it is possible to identify the phrases spoken within encrypted VoIP calls when the audio is encoded using variable bit rate codecs. To do so, we train a hidden Markov model using only knowledge of the phonetic pronunciations of words, such as those provided by a dictionary, and search packet sequences for instances of specified phrases. Our approach does not require examples of the speaker's voice, or even example recordings of the words that make up the target phrase. We evaluate our techniques on a standard speech recognition corpus containing over 2,000 phonetically rich phrases spoken by 630 distinct speakers from across the continental United States. Our results indicate that we can identify phrases within encrypted calls with an average accuracy of 50%, and with accuracy greater than 90% for some phrases. Clearly, such an attack calls into question the efficacy of current VoIP encryption standards. In addition, we examine the impact of various features of the underlying audio on our performance and discuss methods for mitigation.

Rogue femtocell owners: How mallory can monitor my devices

“…For example, in certain circumstances the size of packets from a codec that compresses voice can be used to identify spoken phrases [11]. Such an attack could be applied in a femtocell setup.…”

Can Smartphones and Privacy Coexist? Assessing Technologies and Regulations Protecting Personal Data on Android and iOS Devices

“…This information is particularly sensitive. Other research has shown that the throughput of Voice over Internet Protocol (VoIP) applications can be used to identify the language of speech (Wright, Ballard, Monrose, et al, 2007) and even to detect specific spoken phrases (Wright, Ballard, Coull, et al, 2010), thus allowing a no-permission app to eavesdrop on private phone conversations. This side channel may also allow an app to learn coarse-grain location information by monitoring the throughput of mapping apps as they load map segments as the user moves around.…”

Side-Channel Analysis for Detecting Protocol Tunneling

“…A similar approach has been used to identify specific phrases in encrypted voice over IP (VOIP) traffic [15]. When variable bit rate encoding is used by the VOIP codec, the encodings of different classes of phonemes require predictable ranges of bit sizes; producing a vulnerability similar to the one in [14].…”

“…Instead of using standard HMM approaches that require an a priori known state space for training, we require no prior knowledge. Instead of using maximum likelihood metrics [4,5,[15][16][17], we combine HMMs with statistical hypothesis testing which provides a theoretical basis for determining threshold values [28][29][30]. Hypothesis testing allows us to determine the statistical significance of the inferred model, which in turn indicates whether or not the volume of training data is sufficient [28][29][30].…”