Researchers at Johns Hopkins have demonstrated an attack against some encrypted Voice-over-IP traffic that uses the size of encrypted packets to make highly accurate guesses at whole words and phrases:
That happens because the sampling rate is kept high for long complex sounds like "ow", but cut down for simple consonants like "c". This variable method saves on bandwidth, while maintaining sound quality.
VoIP streams are encrypted to prevent eavesdropping. However, a team from John Hopkins University in Baltimore, Maryland, US, has shown that simply measuring the size of packets without decoding them can identify whole words and phrases with a high rate of accuracy…
a few services currently employ the vulnerable compression method, but more networks had hoped to include it in future VoIP upgrades, says Charles Wright, a member of the John Hopkins team. "We hope we have caught this threat before it becomes too serious."
Eavesdropping software the team has developed cannot yet decode an entire conversation, but it can search for chosen phrases within the encrypted data. This could still allow a criminal to find important financial information conveyed in the call, says Fabian Monrose, another team member.
(via Schneier)
