Realtime communication security - SIP, XMPP and others

•

6 likes•2,032 views

A short presentation on issues we face with realtime security - too many solutions and too few customer requirements and a lack of demand on the market.

Technology News & Politics

REALTIME
COMMUNICATION
SECURITY

Olle E. Johansson * oej@edvina.net * Twitter oej
Copyright Edvina AB, Sollentuna, Sweden 2011. All rights reserved.

Talk
Video
Chat
Application sharing
3D holographic 7.1 conferences

COMMUNICATION BETWEEN
TWO OR MORE PEOPLE

OUT OF SCOPE TODAY.

Tommy the system intruder

Christina the network sniffer

Adrian the BOT network manager

WHAT IS THE PROBLEM?
The usual security issues...

WHO IS LISTENING?

You Me

3rd party
Conﬁdentiality

DID YOU REALLY WRITE THAT?

You Me

Integrity

YOU CAN’T DO THAT.

You Me

Authorization

WHO AM I?

IP Phone Pad

Softphone Set-top-box

Chat client Laptop
Me

Car Cell phone

TELECOM SECURITY MODEL

You Me

In the telco we trust.

END2END OR THROUGH
PROXY SERVER?
Do you want
someone else to handle your keys?

You Me

Do you want to set up
a secure session between you
and me? If so, how?

THIS APPLIES TO MANY
PROTOCOLS

SIP
RTCWEB

XMPP
?

SIP SECURITY
TLS DTLS/SRTP
SIGNALLING MEDIA

S/MIME
SIP IDENTITY
INTEGRITY

HTTP DIGEST MSRP/TLS
AUTH CHAT

ASTERISK 1.8

TLS ACLs

SRTP SDES TLS very, very
experimental

KAMAILIO SIP SERVER 3.1

TLS ACLs

DOS
prevention TLS very, very
good!

WHAT’S THE ISSUE
WITH REAL TIME SECURITY?
No one asks for it.

Therefore no one
implements it.

Which means lack of
experience.

WHAT I DO NOT
UNDERSTAND.

Why does nobody
care, really?

FINAL QUESTION:

What’s a secure
session for you?

Similar to Realtime communication security - SIP, XMPP and others

Identity On The Internet

Jon Spriggs

How to get back your privacy?

Jérôme aka "Genma" Kun

The ultimate privacy guide

JD Liners

#Morecrypto (with tis) - version 2.2

Olle E Johansson

Morecrypto in the world of SIP - the Session Initiation Protocol

Olle E Johansson

Since the beginning of publications by Edward Snowden last year many of the presumedly exaggerated threat models in cryptography have become reality. When operating sensitive services it's more likely than not that communcation data will be tapped at large carriers as well as internet exchanges and stored indefinitily - this calls for strong and forward-secure encryption. On the other hand we're faced with the problem that much of the software we're using in the datacenter today is not very secure when it comes to default encryption settings. On top of that, most developers and system administrators are not very fluent in the basic workings of encryption systems. The talk will give an introduction to SSL/TLS and explain how to check for weaknesses in existing services with tools like nmap, sslscan and sslyze. For common daemons like apache, nginx, exim, postfix and dovecot best practice on improving cryptographic strength will be discussed.

Secure encryption in a wiretapped future

Michael Renner

Mac security - a pragmatic guide

Jason Norwood-Young

Network Security R U Secure???

trendy updates

As the air gap between our daily lives and the Internet continues to shrink the security of our personal data and devices grows in importance. We are facing the daily threat of putting 2000s era computers bolted to toasters online while expecting them to defend against 2017 capable attackers. This talk will explore the continuing trend of IoT, discuss how we’ve been here before, and layout strategies for keeping pace with attackers in the future. This talk will focus on enumerating this risk, discuss the challenges involved, and explore solutions. First, we will examine this history of how we got here, and what it means to say “security is a snapshot in time.” We then introduce the idea of shared ken – the range of one’s knowledge or sight – and how it impacts security. Third, we discuss the influence of data as code, the meta game, and secrecy as a way of mastering impact and ken. This talk will allow attendees to walk away with A holistic view of the history of computer security and how it impacts them today The importance of extending the range of collective vision to reduce blind spots Practical advice for BSiders to grow their mindset and improve their impact Adam is a founding partner and Chief Executive Officer at Deja vu Security. He is dedicated to the leadership and relentless innovation in Deja’s products and services. Previously he has lead teams conducting application and hardware penetration tests for the Fortune 500 technology firms. Adam is a contributing author to multiple security books, benchmarks, tools, and DARPA research projects. Adam holds a degree in Computer Science and a Masters from Carnegie Mellon University in Information Networking.

Deja vu security Adam Cecchetti - Security is a Snapshot in Time BSidesPDX ...

adamdeja

Carpe Diem Strategic Services (CDSS), a veteran owned service-disabled business that offers education and training which addresses threats to digital communications and online privacy. Their mission is to assist individuals, families, and small businesses to understand, identify, and reduce threats and vulnerabilities that expose their business, financial, intellectual property, and sensitive personal data to potential exploitation and risk. (Presentation, slides, and content created by AEGILITY)

Protecting Your Privacy: Cyberspace Security, Real World Safety

AEGILITY

OSDC 2014: Michael Renner - Secure encryption in a wiretapped future

NETWAYS

OSDC 2014: Michael Renner - Secure encryption in a wiretapped future

NETWAYS

#MoreCrypto

Olle E Johansson

Black Ops of Fundamental Defense:

Recursion Ventures

Information Security

Technocratz

network security, cryptography,steganography

Nikhil l

Passwords in the Internet Age - Jim Salter

IT-oLogy

3D - password

BhavikParmar24

How To Secure Online Activities

- Mark - Fullbright

Opsec for security researchers

vicenteDiaz_KL

Similar to Realtime communication security - SIP, XMPP and others (20)

Identity On The Internet

How to get back your privacy?

The ultimate privacy guide

#Morecrypto (with tis) - version 2.2

Morecrypto in the world of SIP - the Session Initiation Protocol

Secure encryption in a wiretapped future

Mac security - a pragmatic guide

Network Security R U Secure???

Deja vu security Adam Cecchetti - Security is a Snapshot in Time BSidesPDX ...

Protecting Your Privacy: Cyberspace Security, Real World Safety

OSDC 2014: Michael Renner - Secure encryption in a wiretapped future

#MoreCrypto

Black Ops of Fundamental Defense:

Information Security

network security, cryptography,steganography

Passwords in the Internet Age - Jim Salter

3D - password

How To Secure Online Activities

Opsec for security researchers

Recently uploaded

The 7 Things I Know About Cyber Security After 25 Years | April 2024

Rafal Los

Three things you will take away from the session: • How to run an effective tenant-to-tenant migration • Best practices for before, during, and after migration • Tips for using migration as a springboard to prepare for Copilot in Microsoft 365 Main ideas: Migration Overview: The presentation covers the current reality of cross-tenant migrations, the triggers, phases, best practices, and benefits of a successful tenant migration Considerations: When considering a migration, it is important to consider the migration scope, performance, customization, flexibility, user-friendly interface, automation, monitoring, support, training, scalability, data integrity, data security, cost, and licensing structure Next Wave: The next wave of change includes the launch of Copilot, which requires businesses to be prepared for upcoming changes related to Copilot and the cloud, and to consolidate data and tighten governance ShareGate: ShareGate can help with pre-migration analysis, configurable migration tool, and automated, end-user driven collaborative governance

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

sammart93

Boost Fertility New Invention Ups Success Rates.pdf

sudhanshuwaghmare1

Data Cloud, More than a CDP by Matt Robison

Anna Loughnan Colquhoun

AWS Community Day CPH - Three problems of Terraform

Andrey Devyatkin

In this session, we will delve into strategic approaches for optimizing knowledge management within Microsoft 365, amidst the evolving landscape of Copilot. From leveraging automatic metadata classification and permission governance with SharePoint Premium, to unlocking Viva Engage for the cultivation of knowledge and communities, you will gain actionable insights to bolster your organization's knowledge-sharing initiatives. In this session, we will also explore how to facilitate solutions to enable your employees to find answers and expertise within Microsoft 365. You will leave equipped with practical techniques and a deeper understanding of how there is more to effective knowledge management than just enabling Copilot, but building actual solutions to prepare the knowledge that Copilot and your employees can use.

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Drew Madelung

Discord is a free app offering voice, video, and text chat functionalities, primarily catering to the gaming community. It serves as a hub for users to create and join servers tailored to their interests. Discord’s ecosystem comprises servers, each functioning as a distinct online community with its own channels dedicated to specific topics or activities. Users can engage in text-based discussions, voice calls, or video chats within these channels. Understanding Discord Servers Discord servers are virtual spaces where users congregate to interact, share content, and build communities. Servers may revolve around gaming, hobbies, interests, or fandoms, providing a platform for like-minded individuals to connect. Communication Features Discord offers a range of communication tools, including text channels for messaging, voice channels for real-time audio conversations, and video channels for face-to-face interactions. These features facilitate seamless communication and collaboration. What Does NSFW Mean? The acronym NSFW stands for “Not Safe For Work,” indicating content that may be inappropriate for professional or public settings. NSFW Content NSFW content encompasses material that is sexually explicit, violent, or otherwise graphic in nature. It often includes nudity, profanity, or depictions of sensitive topics.

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

UK Journal

Tata AIG General Insurance Company - Insurer Innovation Award 2024

The Digital Insurer

Histor y of HAM Radio presentation slide

vu2urc

The value of a flexible API Management solution for Open Banking Steve Melan, Manager for IT Innovation and Architecture - State's and Saving's Bank of Luxembourg Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The value of a flexible API Management solution for O...

apidays

What is a good lead in your organisation? Which leads are priority? What happens to leads? When sales and marketing give different answers to these questions, or perhaps aren't sure of the answers at all, frustrations build and opportunities are left on the table. Join us for an illuminating session with Cian McLoughlin, HubSpot Principal Customer Success Manager, as we look at that crucial piece of the customer journey in which leads are transferred from marketing to sales.

04-2024-HHUG-Sales-and-Marketing-Alignment.pptx

HampshireHUG

With more memory available, system performance of three Dell devices increased, which can translate to a better user experience Conclusion When your system has plenty of RAM to meet your needs, you can efficiently access the applications and data you need to finish projects and to-do lists without sacrificing time and focus. Our test results show that with more memory available, three Dell PCs delivered better performance and took less time to complete the Procyon Office Productivity benchmark. These advantages translate to users being able to complete workflows more quickly and multitask more easily. Whether you need the mobility of the Latitude 5440, the creative capabilities of the Precision 3470, or the high performance of the OptiPlex Tower Plus 7010, configuring your system with more RAM can help keep processes running smoothly, enabling you to do more without compromising performance.

Boost PC performance: How more available memory can improve productivity

Principled Technologies

Partners Life - Insurer Innovation Award 2024

The Digital Insurer

How to Troubleshoot Apps for the Modern Connected Worker

ThousandEyes

MySQL Webinar, presented on the 25th of April, 2024. Summary: MySQL solutions enable the deployment of diverse Database Architectures tailored to specific needs, including High Availability, Disaster Recovery, and Read Scale-Out. With MySQL Shell's AdminAPI, administrators can seamlessly set up, manage, and monitor these solutions, ensuring efficiency and ease of use in their administration. MySQL Router, on the other hand, provides transparent routing from the application traffic to the backend servers in the architectures, requiring minimal configuration. Completely built in-house and supported by Oracle, these solutions have been adopted by enterprises of all sizes for their business-critical applications. In this presentation, we'll delve into various database architecture solutions to help you choose the right one based on your business requirements. Focusing on technical details and the latest features to maximize the potential of these solutions.

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Miguel Araújo

Advantages of Hiring UIUX Design Service Providers for Your Business

Pixlogix Infotech

As privacy and data protection regulations evolve rapidly, organizations operating in multiple jurisdictions face mounting challenges to ensure compliance and safeguard customer data. With state-specific privacy laws coming up in multiple states this year, it is essential to understand what their unique data protection regulations will require clearly. How will data privacy evolve in the US in 2024? How to stay compliant? Our panellists will guide you through the intricacies of these states' specific data privacy laws, clarifying complex legal frameworks and compliance requirements. This webinar will review: - The essential aspects of each state's privacy landscape and the latest updates - Common compliance challenges faced by organizations operating in multiple states and best practices to achieve regulatory adherence - Valuable insights into potential changes to existing regulations and prepare your organization for the evolving landscape

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

TrustArc

Building Digital Trust in a Digital Economy Veronica Tan, Director - Cyber Security Agency of Singapore Apidays Singapore 2024: Connecting Customers, Business and Technology (April 17 & 18, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

apidays

Automating Google Workspace (GWS) & more with Apps Script

wesley chun

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke

Product Anonymous

Recently uploaded (20)

The 7 Things I Know About Cyber Security After 25 Years | April 2024

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

Boost Fertility New Invention Ups Success Rates.pdf

Data Cloud, More than a CDP by Matt Robison

AWS Community Day CPH - Three problems of Terraform

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

Tata AIG General Insurance Company - Insurer Innovation Award 2024

Histor y of HAM Radio presentation slide

Apidays New York 2024 - The value of a flexible API Management solution for O...

04-2024-HHUG-Sales-and-Marketing-Alignment.pptx

Boost PC performance: How more available memory can improve productivity

Partners Life - Insurer Innovation Award 2024

How to Troubleshoot Apps for the Modern Connected Worker

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Advantages of Hiring UIUX Design Service Providers for Your Business

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

Automating Google Workspace (GWS) & more with Apps Script

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke

Realtime communication security - SIP, XMPP and others

2. From this...

3. to this

4. Talk Video Chat Application sharing 3D holographic 7.1 conferences

5. COMMUNICATION BETWEEN TWO OR MORE PEOPLE

6. OUT OF SCOPE TODAY. Tommy the system intruder Christina the network sniffer Adrian the BOT network manager

7. IN SCOPE You Me

8. WHAT IS THE PROBLEM? The usual security issues...

9. WHO’S TALKING? You Me Identity

10. WHO IS LISTENING? You Me 3rd party Conﬁdentiality

11. DID YOU REALLY WRITE THAT? You Me Integrity

12. YOU CAN’T DO THAT. You Me Authorization

13. WHO AM I? IP Phone Pad Softphone Set-top-box Chat client Laptop Me Car Cell phone

14. THE SIP WORLD DATACOM TELECOM

15. NETWORK SECURITY You Me Our problem

16. TELECOM SECURITY MODEL You Me In the telco we trust.

17. END2END OR THROUGH PROXY SERVER? Do you want someone else to handle your keys? You Me Do you want to set up a secure session between you and me? If so, how?

18. THIS APPLIES TO MANY PROTOCOLS SIP RTCWEB XMPP ?

19. SIP SECURITY TLS DTLS/SRTP SIGNALLING MEDIA S/MIME SIP IDENTITY INTEGRITY HTTP DIGEST MSRP/TLS AUTH CHAT

20. ASTERISK 1.8 TLS ACLs SRTP SDES TLS very, very experimental

21. KAMAILIO SIP SERVER 3.1 TLS ACLs DOS prevention TLS very, very good!

22. WHAT’S THE ISSUE WITH REAL TIME SECURITY? No one asks for it. Therefore no one implements it. Which means lack of experience.

23. WHAT I DO NOT UNDERSTAND. Why does nobody care, really?

24. FINAL QUESTION: What’s a secure session for you?

25. H E L P. THANK YOU.

Realtime communication security - SIP, XMPP and others

Recommended

Recommended

More Related Content

Similar to Realtime communication security - SIP, XMPP and others

Similar to Realtime communication security - SIP, XMPP and others (20)

More from Olle E Johansson

More from Olle E Johansson (20)

Recently uploaded

Recently uploaded (20)

Realtime communication security - SIP, XMPP and others

Editor's Notes