r/Tello • u/omawarix • 20h ago
Discussion Potential security concern: My Tello app call audio was recoverable from unencrypted RTP traffic
Hi everyone,
I'm a Tello user living in Japan, and I recently discovered something interesting — and potentially concerning — while investigating how Tello handles VoIP and Wi-Fi Calling traffic.
I was curious about the network infrastructure used by US mobile carriers when accessing their services from overseas, so I decided to capture and analyze the traffic myself using Wireshark.
During a voice call made through the My Tello app on my Google Pixel 11, I noticed something unexpected.
My test setup
- Devices: Google Pixel 11 (Android) and a laptop running Windows 11 Pro
- Network: The Pixel was connected to a Windows Mobile Hotspot hosted by the laptop, which was connected to my home broadband connection in Japan
- Packet capture: Wireshark running on the Windows laptop
- Test call: An outbound call to a Japanese landline number providing a publicly accessible telephone-based radio broadcast service.
What I discovered
1. VoIP server connection
During the call, I observed continuous bidirectional UDP traffic between my device and 63.251.74.24, an IP address that appears to be associated with KeepCalling, the company behind Tello.
2. RTP traffic and audio codec
The UDP packets were approximately 214 bytes each, with packets transmitted at roughly 20 ms intervals.
Wireshark also identified RTCP traffic. After manually configuring the relevant UDP traffic to be decoded as RTP, Wireshark detected RTP streams using G.711 μ-law (PCMU).
The packet sizes and intervals were consistent with standard G.711 audio transmission.
3. Call audio could be played back without decryption
This was the most surprising part.
Using Wireshark's RTP stream analysis and playback features, I was able to reconstruct and listen to the actual received call audio directly from the captured packets, without using any decryption keys.
The recovered audio clearly matched the radio broadcast I was listening to during the call.
In other words, the audio was not merely identifiable as RTP traffic — the actual voice content was recoverable from the packet capture.
Why this concerns me
Based on these observations, it strongly appears that the My Tello app was transmitting received call audio using unencrypted RTP rather than SRTP, at least during my test.
If this is the application's normal behavior, someone with access to the relevant network traffic could potentially intercept and reconstruct call audio.
I understand that this does not automatically mean anyone on the internet can listen to these calls. However, transmitting voice audio without transport encryption would still raise legitimate security and privacy concerns.
Important clarification: My Tello app vs. native Wi-Fi Calling
This finding relates specifically to the VoIP calling feature inside the My Tello app.
It does not refer to Tello's native Wi-Fi Calling functionality through Android's standard phone dialer.
I separately investigated native Tello Wi-Fi Calling and observed IPsec-encrypted communication with T-Mobile infrastructure.
These appear to use different communication mechanisms, so I don't want to confuse the two.
Questions for the community
- Has anyone else captured and analyzed VoIP traffic from the My Tello app?
- Is unencrypted RTP an expected part of its current implementation?
- Does My Tello support SRTP or any other form of media encryption?
- Has anyone observed different behavior on other Android devices or on iOS?
I haven't shared the raw PCAP file because it may contain sensitive information.
This is based on my own observations from a single test environment, and I'm not claiming that every version of the app or every call necessarily behaves the same way.
I'd be interested to hear from other Tello users, network engineers, or anyone familiar with the app's VoIP implementation.
Thanks for reading!