  In many VoIP systems, Voice Activity Detection (VAD) is often used on VoIP
traffic to suppress packets of silence in order to reduce the bandwidth
consumption of phone calls. Unfortunately, although VoIP traffic is fully
encrypted and secured, traffic analysis of this suppression can reveal
identifying information about calls made to customer service automated phone
systems. Because different customer service phone systems have distinct, but
fixed (pre-recorded) automated voice messages sent to customers, VAD silence
suppression used in VoIP will enable an eavesdropper to profile and identify
these automated voice messages. In this paper, we will use a popular enterprise
VoIP system (Cisco CallManager), running the default Session Initiation
Protocol (SIP) protocol, to demonstrate that an attacker can reliably use the
silence suppression to profile calls to such VoIP systems. Our real-world
experiments demonstrate that this side-channel profiling attack can be used to
accurately identify not only what customer service phone number a customer
calls, but also what following options are subsequently chosen by the caller in
the phone conversation.
