2KKUU7ita

Figure 13-16:
Using Cain
& Abel to
capture,
record, and
playback
VoIP conversations.
Chapter 13: Communication and Messaging Systems
Here’s the interesting part — the conversations are saved in .wav audio
file format, so you simply right-click the recorded conversation you want
to test and choose Play, as shown in Figure 13-16. Note that conversations
being recorded show Recording . . . in the Status column.
The voice quality with Cain and other tools depends on the codec your VoIP
devices use. With my equipment, I find the quality is marginal at best. That’s
not really a big deal, though, because your goal is to prove there’s a vulnerability
— not to listen in on other people’s conversations.
There’s also a Linux-based tool called vomit (http://vomit.xtdnet.nl) —
short for voice over misconfigured Internet telephones — that you can use
to convert VoIP conversations into .wav files. You first need to capture the
actual conversation by using tcpdump, but if Linux is your preference, this
solution offers basically the same results as Cain, outlined in the preceding
steps.
If you’re going to work a lot with VoIP, I highly recommend you invest in a
good VoIP network analyzer. Check out WildPackets’ OmniPeek — a great allin-one
wired and wireless analyzer (www.wildpackets.com/products/
omnipeek_network_analyzer/) — and TamoSoft’s CommView (www.
tamos.com/products/commview/), which is a great low-priced alternative.
These VoIP vulnerabilities are only the tip of the iceberg. New systems, software,
and related protocols continue to emerge, so it pays to remain vigilant,
helping to ensure your conversations are locked down from those with malicious
intent.
275