Comments on: Despite Fixes, Google Voice Security Flaws Remain

By: Ward Mundy

Ward Mundy — Thu, 26 Mar 2009 16:55:50 +0000

Tutorial to integrate GV into Asterisk available here: http://nerdvittles.com/?p=593

By: Gusvan

Gusvan — Thu, 26 Mar 2009 14:28:37 +0000

mattjackets: I think you want the address of the Google Voice SIP server, not a SIP URI. If so, it is 216.239.37.15 and it’s entered through port 5061. With this information and some additions to configuration files, you can use Asterisk and make calls directly through GV without touching POTS.

By: mattjackets

mattjackets — Thu, 26 Mar 2009 14:10:35 +0000

Posting the SIP URI used would be very handy for us who have been wanting the ability to call users directly using SIP instead of going through POTS. Since they closed the hole using the SIP approach, this information would still hold legitimate use.

By: sanjuro

sanjuro — Thu, 26 Mar 2009 11:27:36 +0000

I’m afraid I’ll have to stick with my good old Nokia phone in the meanwhile.

By: Lonnie Lazar

Lonnie Lazar — Thu, 26 Mar 2009 07:22:18 +0000

@chris: Access to voice mail is one thing, access to the ability to make calls is quite another, don’t you think?

By: chris

chris — Thu, 26 Mar 2009 05:46:01 +0000

“Though SIP access to a Google Voice account is no longer possible in such a manner, continued existence of some vulnerability was still apparent Tuesday night. Voxilla was able to set the caller ID of a PBX extension to a mobile number attached to Google Voice account and call in, using a business VoIP trunk, to gain access.”

thats not an exploit, thats the way phone systems are designed if you have a PBX.

You have the ability to change your callerID..

And take some AT&T customers for example – who have auto voice mail login.. boom. you are in there.

it works with all companies that have that feature.