Wiretapping Just The Start of VoIP's Security Woes

Security experts are once more urging businesses and consumers be wary of wiretapped Voice over IP (VoIP) calls -- as well as the vast number of potentially worse IP telephony vulnerabilities to which they may be exposed.

Last week, U.K. security researcher Peter Cox introduced a proof-of-concept that showed how easily Voice over IP phone calls could be intercepted. Cox, the former chief technology officer and co-founder of security vendor Borderware, successfully captured phone calls over a period of several months with a prototype Session Initiation Protocol (SIP) call monitoring tool.

The demonstration came as only the latest reminder that VoIP is vulnerable to monitoring. But experts warn that wiretapping is only the tip of the iceberg.

"In the grand scheme of things, it's rather small," said Forrester Research Analyst Paul Stamp. "This is something people implementing VoIP systems have known for a long time. But it's certainly not the biggest vulnerability in the system."

With VoIP on the rise, there's plenty of reason to be concerned about all of those vulnerabilities. According to a survey of telephony carriers conducted by IBM's Internet Security Systems (ISS), almost 85 percent of phone service providers will roll out an IP-based architecture for their services within the next five years.

And while 87 percent of the participants in ISS's survey believed that these "next-generation networks" would fail without strong security measures, only 46 percent said their companies had a plan in place for dealing with the security issues involved with the shift.

That might come as something of a surprise, since it's not as if the threat of call interception is anything new.