Dialing in the Open: A Security Census of Internet-Facing Voice Infrastructure

Abstract

Voice-over-IP (VoIP) powers nearly all modern telephony, yet its Internet-facing infrastructure lacks a systematic security census. We conduct the first Internet-wide measurement study of SIP security, scanning the IPv4 space to identify 631,045 application-layer responsive endpoints. Our analysis reveals a pervasive failure to adopt modern security standards: all but four authentication-requiring endpoints use 25-year-old MD5 defaults, with one SHA-256 and three SHA-512/256 responses, and 87% omit the qop replay defense. Furthermore, at least 76.6% of SIP-over-TLS endpoints also allow plaintext communication, and we estimate 1,808 endpoints with inferred open registration, some with strong PSTN connectivity indicators. We show that the landscape is highly centralized, with 10 providers controlling over 50% of the infrastructure, and demonstrate credential cracking and RTP eavesdropping against a controlled lab deployment.