VoIP SPIT: Even Plain Old Telephone Users Need to Worry About It   5/14/2005 - 940 views, 1 Comment

Security guru Bruce Schneier writes on SPIT today in his security blog. A mighty neat trick to write on a liquid you say? Well, different semantics for “on” and “SPIT” than you might expect, unless you’re a regular reader of AS.

SPIT of course is Spam over IP Telephony, that is Spam which uses VoIP as a propagation mechanism. Schneier, who is normally very tight in his analysis, misses the point slightly through a common error though. He says

“Spit has the potential to completely ruin VoIP. No one is going to install the system if they’re going to get dozens of calls a day from audio spammers.”

…which completely misses the fact that SPIT leverages VoIP on the sending side, not the receiving side (because the SPIT senders can use all the nifty VoIP features to power-spam any telephone number), and that features you get with VoIP on the receiving side (like more sophisticated caller ID, and the ability to process the incoming connection request and data stream however you want) actually would be very useful to be able to *combat* SPIT. In fact, it’s probably fair to say that if SPIT takes off in any substantial way, it will actually drive adoption of VoIP since POTS (the Plain Old Telephone Service) is going to be defenseless against the new attacker.

So, advice of the day: switch to VoIP now, before the spam:real ratio in your voicemailbox is the same as the ratio of spam:real in your email inbox (if you had no spam filtering enabled).

[*Craig Hughes is a recovering anti-spam addict, one of the original architects of Spam Assassin Open Source, and the founder of Gumstix. And a damned fine friend.]