Las Vegas is a strip mall, a huge, ugly strip mall. It begins with a very glitzy "strip" - land of the high intensity LED giant video screen - and ends with a hundred square miles of gas stations, middling retail, and cheap apartment buildings. And it is hot - it's been on the order of 105 degrees F for the last few days. And I can assure you that not everything is air conditioned - here in the convention hall during setup they don't turn on the cooling until a few hours before the doors are opened to the public.
They gave us a suite in the Mandalay Bay, a nice place, with a much nicer place (the Four Seasons) on the upper floors. It's better than last year in the pyramid where I had a room with a view straight into Sphinx' tucus.
The show, Interop, just opened. For the next three days I'll be showing how easy it is to inject unwanted words into a VOIP call, how easy it is to confuse SIP, and how badly VOIP quality degrades when the net delivers less than the highest grades of packet delivery.
I've got a tool that intercepts the media-carrying RTP packets from a VOIP call and injects new RTP packets that contain the sentence "oops, you broke it" from a .wav file. This is a proof of concept tool - I can easily foresee one that intercepts a voice stream, delays it for a hundred milliseconds or so - long enough to accumulate enough packets to recognize short words like "no" or "not" - and remove or change those words. For example, one can envision a derivative of the tool I'm using that would change the words in a VOIP call from "I will not buy" to "I will buy".
I've also got one of my products, Mini Maxwell - to impose several kinds of traffic impairments. At the moment I've dialed-in a couple of hundred milliseconds of delay into the DNS service, a somewhat lesser delay into SIP (it seems that SIP transactions often simply fail when delay exceeds about half a second), and added a bit of jitter and loss to the one direction of voice media stream. The effect is that the phones are a bit tardy in their response to dialing, pickup, and hangup. The voice quality in the impaired direction is, as would be expected, rather degraded as compared to the other direction.
We've also got a Mu Security box which is causing great consternation as it subjects SIP implementations, often written in the halcyon conditions of a developer lap, to the rigors of what can really happen on the net. The results are amusing - at least if you aren't the person who has to fix the revealed weakness. I've also go a tool (Maxwell) that can turn routine SIP into unusual, but possible, SIP. From what I've seen I wouldn't be racing to base any lifeline grade infrastructures on SIP based VOIP.
We've also got a number of SIP intrusion detection systems and an array of interoperating SRTP (secure RTP) based phones.
I'm sitting hear wearing a tin-foil hat - to keep in the spirit of our home-made Faraday cage. It's made from aluminum tubing and metallic window screens. It's stitched together with copper wire and has a honkin' ground cable. I last heard that it was on the order of 80 to 90 db of isolation. In the cage, and also in some isolation chambers (that look all the world like small microwave ovens) we've got tools to generate a heavy load of wireless VOIP calls and some monitoring software so that we can see when things begin to crumble.
More fun than "internet governance" - you 'betcha!
Posted by karl at May 22, 2007 11:03 AM