VoIP Hopper, A VoIP Security Testing Tool

VoIP Hopper http://snapvoip.blogspot.com/

VoIP Hopper is intended for network engineers, VoIP administrators, and professional security testers to assess the security of networks they have permission to test / assess. Even though VoIP Hopper is a VoIP infrastructure security testing tool, it could effectively be used to test the security status of VLANs as well.

The tool is GPLv3 licensed  and is written in C. One needs a Linux based system, a C compiler and good old libpcap to make and run. The tool is designed to run a VLAN Hop into the Voice VLAN on targeted Ethernet switches. VoIP Hopper mimics an IP Phone, in Cisco, Avaya, Nortel, and Alcatel-Lucent environments.  IP Phone emulation requires discovery of the correct 12 bit Voice VLAN ID (VVID) used by the IP Phones and is accomplished via multiple protocol discovery methods (CDP, DHCP, LLDP-MED, 802.1q ARP). Once the initial stem is accomplished, VoIP Hopper creates a virtual VoIP Ethernet interface on the OS.  It then inserts a spoofed 4-byte 802.1q vlan header containing the 12 bit VVID into a spoofed DHCP request.  Once it receives an IP address in the VoIP VLAN subnet, all subsequent Ethernet frames are "tagged" with the spoofed 802.1q header.

There are many uses of the tool for a VoIP engineer or professional and needs to invest some time learning the tool. VoIP Hopper site provides a swath of information, including code download, instructions and video tutorials (Of on which is embedded below). Happy ethical hacking.


 

Sipera Systems and Future Com Joins Hands To Provide Unified Communications Security To Enterprise.

Press Release http://snapvoip.blogspot.com/
Richardson and Bedford, TX, April 7, 2011— Sipera Systems, the leader in real-time Unified Communications(UC) enablement and security, and Future Com,a leading provider of security and network management solutions, today announced a partnership to better secure enterprise UC.  Future Com has joined Sipera’s Reseller Program as a Gold Tier Reseller, and is working with a major aviation industry customer, updating its security infrastructure to include UC, using best practice recommendations from Sipera and Future Com.

“Future Com Professional Services include the McAfee ePolicy Orchestrator Audit Service, which analyzes existing ePolicy environments to determine proper operations and identify any mis-configurations or inoperative features.  This complements Sipera’s participation in McAfee’s Security Innovation Alliance(SIA),” said Andy Asava, Vice President of Business Development for Sipera.  “Working together, Future Com and Sipera enable enterprises to satisfy industry security and privacy mandates, benefit from real-time UC collaboration, and secure business critical communications.”

“By partnering with Sipera, we can better ensure our enterprise customers’ communications are compliant with HIPAA, PCI DSS and SOX mandates,” said Douglas Hollenshead, CEO & President for Future Com. “And, given our joint McAfee expertise, we can comprehensively conduct Vulnerability Assessment and Penetration Testing, and deploy integrated UC security and network management systems, in those environments.”

Sipera’s UC-Sec appliances proactively address security risks associated with UC applications such as VoIP, instant messaging, IP video and collaboration tools, enabling government agencies and enterprise customers to adopt UC applications and apply comprehensive security.  Sipera’s groundbreaking “Borderless UC”architecture enables all communications to be encrypted and compliant on any UC device, at any internal and external location.
VoIP Security with Sipera
Sipera

VoIP Security, Asterisk, SIP, Brute Force Attacks, Explained By John Todd Of Digium.

VoIP Security snapvoip.blogspot.com
My thoughts when I read the article saying  “Asterisk attacks are endemic” were ????*&^ and I also knew that John Todd knew what he is doing. So I let the article pass as I was certain it was not the case.
Today Todd has posted an article explaining the misinterpretation of his thoughts and the verbalization of the same.

My comment in the article was not that “Asterisk attacks are endemic”, but that SIP-based brute force attacks are endemic.  Every SIP system that is open to the “public” Internet is seeing large numbers of brute-force attacks.  Sites that have weak username and weak password control will be compromised – this is little different than email accounts being taken over by password-guessing systems and used for sending floods of email.  The significant difference is that when someone takes over a SIP platform to make outbound calls, there is usually a direct monetary cost, which gets people’s attention very quickly.

We all know that Asterisk is used world over and is the favorite SIP based telephony platform is likely to attract people who are interested in hacking or attacking the system. But we also have seen security measures taken by Asterisk as well. Just like the one released day before yesterday, AST-2009-07, where the advisory and the fix was released simultaneously.
But what Todd wrote makes sense and as Asterisk, Broadsoft, Cisco, Kamailio, OpenSER, FreeSwitch, Avaya are all vulnerable to brute force attacks and every bit of  information will help. Whether it is news worthy or not.
Asterisk and SIP Security Redux

Live Web Cast, Learn "How Google Tackles IT Security"

Tackling IT Security
We all know that we do not have a IT shop the size and magnitude of Google but we all have our own IT shops that we love and adore and look after, just like a new born baby. We also know time to time we run into security issues, from script kiddies to full blown frontal attacks.
Since we are dealing with VoIP IP Telephony, and VoIP security a vital part of any organization, from mom and pop shop to enterprises, these machinery need to keep running 24/7 to ensure proper service.
So when I saw the post by Google about a webinar regarding IT Security or at least how they handle it, I thought it might be interest to most of you.
This live webcast, “How Google Tackles IT Security – and What You Can Learn From It,” to learn about security in the cloud and get your questions answered by members of Google's Security team. Participants include:

Eran Feigenbaum – As the Director of Security for Google Apps, Eran Feigenbaum defines and implements security strategy for Google's suite of solutions for enterprises. Prior to joining Google in 2007, Eran was the US Chief Information Security Officer for PricewaterhouseCoopers.

John Flynn – John “Four” Flynn has an extensive background in network monitoring, intrusion detection, and incident response. John currently leads Google's Security Monitoring program and is a founder of Google's Security Metrics group.

Bradley Taylor – Gmail's “Spam Czar,” Brad Taylor leads Gmail's technical anti-spam, anti-abuse, and email delivery engineering efforts. Brad has played a key role in the development of Gmail's spam filter since Gmail launched in April, 2004.

Eric Sachs – Eric Sachs has over 15 years of experience with user identity and security for hosted web applications. During his years at Google, he has worked as a Product Manager for many services including Google Accounts, Google Apps, orkut, Google Health, Google Security, and Internal Systems.

You will learn:

• What are the latest security threats against web-based apps?
• What best practices does Google employ to protect Google Apps?
• How does Google monitor, detect and respond to threats?
• Plus live Q & A!

Join Google for the live webcast to learn about the people, best practices, and technologies that we have in place to minimize security threats.

How Google Tackles IT Security – and What You Can Learn From It
Thursday, October 1, 2009
11:00 a.m. PDT / 2:00 p.m. EDT / 6:00 p.m. GMT 

I will be there!

Fraud calls to Cuba And VoIP Attacks.

http://snapvoip.blogspot.com/
I was browsing through Gossamer-threads mailing list on Cisco when I came across a post regarding "Fraud calls to Cuba - Please read" by a member. The thread went on to explain how the attackers were using port scans to find open H323 TCP/1720 and SIP UDP/5060 ports and to make calls out from pots lines. The thread showed that this is not a random happening but prevalent in the Cisco MCE router world as these ports are open by default. All the cases did not have ACLs in place and once implemented they were able to prevent these costly attacks. So people with routers attached to PSTN via PRI or even a FXO line, check your routers.
So if you have an Internet facing router, why not just check for open ports. On Cisco routers you can use show ip sockets on older IOS and on newer IOS show control-plane host open-ports
On other routers use appropriate commands to check for open ports and close them. If you need to keep them open, use ACLs.
How about your Asterisk server? It is also essentially a router with usually a PSTN or SIP or trunk service gateway. The attackers could easily get in an out through the server if necessary precautions were not taken.
Think of an Asterisk server with “outbound” context to the SIP provider accessible by the inbound context.
It is possible for incoming calls that do not find matching numbers internally, to get routed out to the SIP provider via Outbound context. Here is an open gateway for hackers.. And there goes your money that you are trying to save with VoIP.

Basic Steps to Protect your VoIP routers or Servers.

• Firewall or session border controller, Always between you and the internet.
  
• Use ACLs to limit your access to your VoIP servers.
• Block inbound contexts in Asterisk accessing the outbound.
• Update the IOS and Server software regularly.
• Keep an eye open for security vulnerabilities from your vendor.
  
• Utilize VPN tunnels when ever is possible to protect the VoIP traffic going over the Internet
• SIP TLS and SRTP will save your day.
  
• Shutdown all services on not in use on your servers and routers.

Tags: VoIP Security, Asterisk, pstn, SIP, FXO, VoIP Attacks, VoIP server, VoIP routers, CISCO, Cisco ACL

VoiP Systems As Easy As 1.2.3 To Hack ?

"Back in February, when little-known VoIPshield Systems sent a report to Cisco (NSDQ:CSCO), Avaya (NYSE:AV) and Nortel (NYSE:NT) detailing vulnerabilities in their VoIP technologies, the three largest IP-PBX vendors on the market shrugged off the report and never responded. The vendors began cooperating and acknowledging on their Websites of the risks to their VoIP systems, only after VoIPshield continued reporting the vulnerabilities publicly. Nortel attributed a vulnerability to VoIPshield on April 10, for example"

Above is a part of what an article on ChannelWeb of CRN. It was a very interesting aricle and I suggest that you visit the site and read it. But what I found to be more interesting is the comment left by VoIPshield's CEO, Rick Dalmazzi.

"but because most of the companies we talk to have Cisco VoIP installed. - Cisco has been extremely responsive to us from the beginning, and has reacted quickly to make patches available to their customers. ---------------doing a Google search and finding an exposed VoIP system has nothing to do with the vendor. It was shown to demonstrate how cyber criminals ply their trade and how some companies, through carelessness or ignorance, make it easy for them."

So next time, take analysts ideas with a grain of salt. But I did see a Cisco Call Manager System open to the web!

Analysis: Hacking VoIP, As Easy As 1-2-3 by ChannelWeb, and don't forget to read the comment mentioned above.

VoIPshield Systems

http://snapvoip.blogspot.com/

Tags: VoIPshield, IP-PBX, Nortel, Cisco, VoIP Analysis, VoIP Security, Cisco Call Manager

Over 100 Vulnerabilities in Leading Enterprise VoIP Systems Uncovered By VoIPshield

It was unbelievably shocking to see the vulnerability database and so many of them. Ignorance is a bliss until something bad happens to someone. Follow the link below to see the database of vulnerabilities and related equipment. Yours might be there. At VoIPshield, you can also download a copy of VoIPauditLite. VoIPauditLite^TM is a basic version of the award winning VoIPaudit^TM Enterprise. It provides the same vulnerability assessment and penetration testing functions, and is intended to give the prospective VoIPaudit Enterprise purchaser a no cost introduction to the product. VoIPauditLite is a single-user license, includes vulnerabilities for a single vendor, and scans up to 128 targets on a single network.

Ottawa, Ontario (April 2, 2008) – VoIPshield Laboratories, the research division of VoIPshield Systems Inc., today announced it has discovered over 100 security vulnerabilities in Voice over IP systems marketed by Avaya, Cisco and Nortel. A vulnerability is a design or implementation flaw in a VoIP system that can be exploited by a hacker with malicious intentions, including extortion through service outage threats, industrial espionage through call recording, or identity theft through the stealing of sensitive customer information.

VoIPshield notified the vendors of its findings earlier this year. Under the terms of its Responsible Disclosure Policy, VoIPshield works with the vendors to help them recreate the vulnerabilities in their own test labs, and offers its services to assist the vendors in determining the best remediation approach.

“It is important that companies understand the security risks associated with their VoIP systems”, said Rick Dalmazzi, president and CEO of VoIPshield. “Now is the time to start planning a protection strategy, while the hacking community is still learning about VoIP, not after the attacks begin.”

The vulnerabilities are cataloged and presented on the company’s website at www.voipshield.com/research . Each vulnerability is categorized based on an exploit’s most likely malicious intent: unauthorized access, code execution, denial of service or information harvesting. Each is also given a severity rating based on a modified industry standard index. Vendor responses are also included, indicating what action if any the vendor has indicated they will take to remediate the vulnerability, and when.

“The limited number of high-profile attacks against IP telephony has lulled most chief information security officers and voice/data managers into a false sense of security, with the result that most do not have adequate protection for their converged networks,” said Lawrence Orans, research director for networking and communications equipment at Gartner Research. “As IP telephony continues to gain momentum, targeted attacks — and possibly broad-based attacks — will surface and gain greater visibility, highlighting vulnerabilities and the overall lack of focus on IP telephony security.”

The database marks the first of ongoing announcements that VoIPshield Labs will make as it continues its research into these and other vendors’ products. Avaya, Cisco and Nortel were chosen for the initial round of research because of their popularity in the North American market. Microsoft has recently announced its entry into the enterprise VoIP market.

Just this month, communications research firm In-Stat revealed that while 80% of companies said they’d deployed some type of VoIP solution, more than 40% do not have specific plans for securing them. This finding, based on a survey of U.S. companies conducted in September 2007, was published in a report titled U.S. Businesses Lag in Securing VoIP. “Regardless of the VoIP solution that is in place or planned, security should be an integral part of an implementation from the beginning,” the report summarized.

The vulnerabilities discovered are used by VoIPshield to create signatures for its enterprise VoIP security solutions: VoIPaudit^TM, a VoIP Vulnerability Assessment system, and VoIPguard^TM, a VoIP Intrusion Prevention System (VIPS). Users are protected against attacks attempting to exploit the known vulnerabilities. VoIPshield products are regularly updated with new signatures through the VoIPshield Update^TM subscription service.

"Digital video and voice enabled by Voice over IP technologies are vital to commerce and are substantially at risk", said Jonathan Zar, chairman of the threat taxonomy committee of the Voice over IP Security Alliance (VoIPSA). It is important that products be developed that are specifically designed to protect VoIP systems. VoIPSA encourages all research leading to such products."

For more information about the vulnerabilities database and VoIPshield’s products visit www.voipshield.com/research.

tag: VoIP Security, VoIPshield, VoIPaudit, VoIPguard, VoIP Intrusion Prevention System, VIPS, VoIPSA, IP telephony security, Avaya, Cisco, Nortel

Secure Skype IM With FaceTime Communications' Greynet Enterprise Manager

BELMONT, CALIFORNIA - FaceTime Communications, the leading provider of solutions that control Internet and unified communications (UC) in the enterprise, today announced enhancements to its Greynet Enterprise Manager (GEM) including detection of malicious URLs entering the enterprise network via Skype instant messaging conversations.

Skype is encrypted using a proprietary method, making it impossible for traditional security products to view the content of a Skype text conversation. Working in partnership with Skype over the last year, FaceTime is the only security vendor with the ability to examine the content of a Skype instant message as it enters the network. Using its leading malware signature database maintained by FaceTime Security Labs, FaceTime's products verify that content is safe and free of malicious URL links before entering the network.

With 276 million registered business users worldwide, Skype's growing popularity and inherent cost savings have made it very attractive to businesses looking to provide the advantages of presence and real-time Internet communications to their employees. Being able to protect against the threat of malware that can enter the network via something as simple as a URL in a chat screen is crucial to IT's realization of the real-time presence benefits of Skype.

An add-on to FaceTime's popular Unified Security Gateway and IMAuditor products, GEM enables organizations to manage security policies and aggregate reporting for IM, P2P and malware traffic across distributed enterprise environments. By integrating with USG, GEM delivers the industry's most robust network-based anti-malware solution, allowing targeted remediation and repair of infected endpoints dynamically based on gateway malware detections from USG.

"Simple block or allow policies are no longer sufficient in most organizations," said Frank Cabri, vice president of marketing and product management for FaceTime. "IT managers are realizing they need to embrace the real-time communications that employees have introduced to the business environment with policies and tools to secure, control, manage, log and archive their use - as well as their content."

Malware entering enterprise networks via real-time communications such as instant messaging and Skype costs businesses nearly $289,000 annually on average, according to the 2007 survey "Greynets in the Enterprise: Third Annual Survey of Trends, Attitudes and Impact," conducted by NewDiligence Research and commissioned by FaceTime. The survey revealed that IT managers experience nearly 39 incidents per month, on average, that require some kind of repair or remediation to end user PCs, and each repair requires, on average, about nine hours of work.

tag: VoIP Security, skype Vulnerability, FaceTime Communications, Greynet Enterprise Manager, unified communications, malware signature, IMAuditor,

FBI VoIP Surveillance Docs

Slashdot has discussion on VoIP Surveillance focusing on FBI Electronic Surveillance Needs for Carrier-Grade Voice over Packet (CGVoP) Service. The 88 paged document, which is part of the CALEA Implementation Plan.
tag: VoIP Security, CGVoP, VoIP Surveillance, CALEA

Who Is Listening To Your VoIP Calls? (Unknown To You!)

"Who Might Be Spying on Your Communications? (Hint — It's Not Just the NSA)", when I saw the title, I imagined a list of other government institutions and some phone companies. But when I scroll down the article by VoIP-News, it was surprising. Mafia, governments, monopolies and spouses might be listening to your calls.
I was happy to read the last paragraph because I do not want my Grand Ma (She is the one who keeps tabs on me nowadays) to hear what I am talking over the phone, VoIP Phone.
"Thankfully, there are a number of tools and strategies out there for protecting yourself and your business from online fraud and eavesdropping. If you're afraid of discussing delicate matters over IM services or Skype, consider choosing a service or system that specializes in security."
tag: VoIP Security, VoIP News, VoIP Phone, Spying on VoIP

VoIP News Tells You How To Secure Your VoIP Call

VoIP News has a "feature article" on VoIP Security. There are many VoIP Solutions for making VoIP calls but security that people used to get with (did we really?) is certainly diminished. So go read the article to be savvy about VoIP Security Solutions.
tag: voip news, VoIP Security, VoIP Solutions

UM Labs Offering VoIP Security Launched By Peter Cox.

The creator of Proof of concept tool for VoIP Security that I wrote about a while ago, Peter Cox, together with Stuart Morrice has launched a new company UM Labs, to provide effective security that he has been preaching for a while now. From the press release below it is evident that we will be seeing more of UM Labs and the products for long time to come. I for one, will seek a gateway that the company is bringing to the market.

London February, 11th 2008, a new company, UM Labs Ltd, has been created to address the growing need for effective security for Voice over IP (VoIP) and Unified Messaging (UM) Security. The founders of UM Labs are experienced Internet Security professionals, Peter Cox and Stuart Morrice. The adoption rate of VoIP and UM is growing; fueled by the promise of greater flexibility, integration with other applications and more cost effective service delivery. However, concerns over of the security of these applications are preventing many organizations from fully adopting the service and failing to realize the potential benefits. These concerns are founded partly on confusion over the scope and types of security threat that face the applications and partly over a lack of easy to use security products.
UM Labs was founded to address this problem by providing a range of easy to use, cost effective products that deliver effective security for VoIP and UM to users ranging from small business and branch offices through large enterprises to service providers and telco operators. Peter Cox CEO of UM Labs commented, “The security model applied to many VoIP networks is one of isolation, physically separating Voice and Data or using VLANS to keep them apart and preventing any external IP connections. Unfortunately separation sacrifices many of the benefits of VoIP and makes Unified Messaging and the integration of all communication applications impossible.” “Until this problem is addressed, VoIP networks will not deliver their full set of potential benefits. The first step to solving this problem is to recognize that VoIP is a specialist application requiring a specialist approach to security. Standard Firewall products do not do a good job at securing VoIP. At best they complicate the deployment of VoIP at worst they present so many barriers that it is virtually impossible to deliver a VoIP service without compromising the security of other applications.” “It should come as no surprise that the best way to secure applications such as VoIP and UM is to deploy a specialist security gateway. Both web and email have spawned their own security markets, in each market there are a number of products delivering security controls that standard Firewalls cannot deliver.”
The goal of UM Labs is to enable each VoIP network to delivery its full potential set of benefits by providing products that implement a more realistic security model. This security model recognises that VoIP networks need external connections to enable SIP trunk connections and to safely extend the service to home workers, roaming uses and branch offices.
To reach this goal, UM Labs will launch a range of security gateways through 2008. Each product will secure VoIP applications based on the Session Initiation Protocol (SIP) and other UM applications. The first release is designed to secure remote VoIP connections to home users and roaming workers and to provide security for SIP trunk services. Security controls include firewall grade IP level security coupled with application specific security controls designed to combat threats such as VoIP call hijacking, call flooding and unauthorized call monitoring. The latter is provided by VoIP encryption services using the industry standards TLS and SRTP with a choice of key management algorithms to support the widest possible range of hardware and software phones. Supported key management algorithms include Phil Zimmermann’s ZRTP and SDES as used by Snom and other phone manufacturers.
UM Labs Website
tag: VoIP Security, VoIP, Unified Messaging Security, Peter Cox, VoIP networks, VLANS, SRTP, SIP trunk, ZRTP, SDES, Snom, VoIP encryption, VoIP call hijacking,

Vishing Attacks Are On The Rise, FBI Warns

The U.S. Federal Bureau of Investigation (FBI)'s Internet Crime Complaint Center (IC3) has issued a warning yesterday that so-called "vishing" attacks are on the rise. Vishing Attacks are scams where criminals send an e-mail, text message or a phone call to a victim, saying there has been a security problem and the victim needs to call his or her bank to reactivate a credit or debit card. Following is the warning from IC3.

VISHING ATTACKS INCREASE (This is the actual iC3 site link. If you hover over the link you can see it is actually "http://www.ic3.gov/media/2008/080117.htm" on your browsers status bar, at the bottom, it is one way to verify the actual link)

Are you one of many who have received an e-mail, text message, or telephone call, purportedly from your credit card/debit card company directing you to contact a telephone number to re-activate your card due to a security issue? The IC3 has received multiple reports on different variations of this scheme known as "vishing". These attacks against US financial institutions and consumers continue to rise at an alarming rate.

Vishing operates like phishing by persuading consumers to divulge their Personally Identifiable Information (PII), claiming their account was suspended, deactivated, or terminated. Recipients are directed to contact their bank via telephone number provided in the e-mail or by an automated recording. Upon calling the telephone number, the recipient is greeted with "Welcome to the bank of ..." and then requested to enter their card number in order to resolve a pending security issue.

For authenticity, some fraudulent e-mails claim the bank would never contact customers to obtain the PII by any means, including e-mail, mail, and instant messenger. These e-mails further warn recipients not to provide sensitive information when requested in an e-mail and not to click on embedded links, claiming they could contain "malicious software aimed at capturing login credentials."

Please beware; spam e-mails may actually contain malicious code (malware) which can harm your computer. Do not open any unsolicited e-mail and do not click on any links provided.

A new version recently reported involved the sending of text messages to cell phones claiming the recipient's on-line bank account has expired. The message instructs the recipient to renew their on-line bank account by using the link provided.

Due to rapidly evolving criminal methodologies, it is impossible to include every scenario. Therefore, be cognizant and protect your PII. Beware of e-mails, telephone calls, or text messages requesting your PII.

If you have a question concerning your account or credit/debit card, you should contact your bank using a telephone number obtained independently such as; from your statement, a telephone book, or another independent means.

If you have received this, or a similar hoax, please file a complaint at www.ic3.gov.

tag: VoIP Security, Vishing, IC3, FBI, Internet Crime Complaint Center, Personally Identifiable Information, PII, malware,

Top Five VoIP IP Telephony Vulnerabilities According To Sipera Viper Lab

Sipera VIPER Lab determined the Top 5 VoIP Vulnerabilities for 2007 were:

1) Remote eavesdropping of VoIP phone calls, a practice that is exponentially easier in VoIP than with traditional PSTN telephone networks, and which represents a major breach of enterprise communications and security.
2) VoIP Hopping, one of the enablers of remote eavesdropping, but more critically compromises VLANs, that were previously trusted as providing VoIP security, by enabling a PC to mimic an IP phone so hackers can access VoIP systems.
3) Vishing, the practice of VoIP phishing, which enables hackers to spoof caller ID and present a fraudulent phone identity, causing some consumers to share sensitive, personal information, such as credit card numbers, with hackers masquerading as banking representatives.
4) Toll fraud, which allows unauthorized users to access enterprise VoIP networks and make calls, increasing VoIP costs and traffic. While there was a much publicized case in 2006, when the FBI charged two men with accessing VoIP networks and reselling minutes to unsuspecting "customers," toll fraud continues unabated, especially on VoIP networks with little authentication or call analysis.
5) The Skype worm, originally known as the w32/Ramex.A virus, spread via IM, which automatically stops access to security tools while it downloads to infected PCs, and changes the Skype user's status to "Do not disturb" so that other users cannot contact the infected user.

Sipera VIPER Lab is comprised of experienced VoIP security researchers operating globally 24/7/365. Since its inception in 2003, Sipera VIPER Lab has identified thousands of vulnerabilities and security threats which include fuzzing, floods and distributed floods, spoofing, stealth attacks and spam. VIPER Lab research is used to continuously improve the Sipera IPCS products that protect, control and enable real-time unified communications for enterprises and service providers. For Sipera VIPER Lab blog, Threat Advisories and RSS feeds, please visit http://www.sipera.com/viper.

Tags: Sipera VIPER Lab, VoIP IP Telephony Vulnerabilities, VoIP Vulnerabilities, IP Telephony Vulnerabilities, Voip IP Telephony, VoIP

Secure Computing's Sidewinder to Protect VoIP Communications At TeleCents Communications

Secure Computing Corporation (NASDAQ: SCUR), a leading enterprise gateway security company, today announced that TeleCents Communications has deployed Secure Computing Sidewinder® to provide security for their traditional telecom as well as Voice over Internet Protocol (VoIP) services. TeleCents required one device to protect their entire enterprise gateway, and Sidewinder's powerful, scaleable solution included all the components necessary for the secure exchange of both traditional data and VoIP calls across open networks.

TeleCents Communications is a wholly-owned subsidiary of iTeknik Holdings, specializing in international and long distance cellular services and virtual calling cards. The company recently chose to implement the Session Initiation Protocol (SIP) application to strengthen their VoIP offering. But with that implementation, potential security vulnerabilities increased dramatically, making an increased level of gateway security essential.

"In a very competitive telecom environment, we needed to make an impressive statement with regard to our VoIP and data security, so we selected the best product available. Sidewinder met or exceeded all of our security expectations," said Scott Pitcher, director of technical operations for TeleCents Communications. "Sidewinder's industry-wide reputation brought us to Secure Computing, and the product's proven VoIP and data security capabilities are helping us to meet our security goals."

VoIP risks are perhaps the best-kept secret on the Internet. Blinded by the promise of reduced costs and flashy features, VoIP deployments forge ahead despite millions in losses due to VoIP fraud and the growing trend of hackers using VoIP as a back door into enterprise networks. It is for these reasons that VoIP security is essential.

With the help of numerous sniffing, fuzzing and manipulation tools available on the Internet, VoIP and SIP technologies have inadvertently challenged traditional firewalls. TeleCents found that Sidewinder's SIP application defense was the answer, combining intelligent filtering with VoIP signatures to protect SIP communications from attack, while allowing SIP traffic to pass through the firewall without requiring action by the user. The Sidewinder VoIP/SIP protection feature is standard with all Sidewinder appliances so only one device is needed to protect both data and VoIP calls for the entire gateway.

"As an Internet-facing application, VoIP is vulnerable to many of the same attack vectors that we see on the public Internet. Therefore VoIP is not immune to the new generation of security threats posed by Web 2.0 use," said Scott Montgomery, vice president of product management for Secure Computing. "VoIP inherits security concerns from IP networks, traditional phone networks and messaging applications. In addition, VoIP has its own vulnerabilities including call interception and modification, and call pattern tracking -- all of which pose serious threats to a user. Sidewinder protects against each one of these vulnerabilities with reputation-based defenses."

Secure Computing ensures proactive security by applying the same research and technology for VoIP that's used for blocking source IP addresses in Web and email transactions. Sidewinder blocks and allows gateway access based on the reputation of both IP addresses and domains from which each individual SIP communication originates. This reputation analysis is achieved via Secure Computing's TrustedSource(TM) reputation technology.

TeleCents Communications relies upon Sidewinder's capabilities completely and is highly satisfied with its superior level of security. "Our customers expect the best in voice communications and we believe that we're ahead of the security curve by protecting not only our traditional data, but our SIP applications as well -- as VoIP is often overlooked as a vulnerable platform. Since deploying the Sidewinder product, all of our security needs are met and we can sleep much better at night."

For assistance in deploying Sidewinder, TeleCents turned to one of Secure Computing's reseller partners, TeleCents. Mark McClain, president of AmeriNet, oversaw the deployment of Sidewinder and will continue to manage the entire project personally. "We frequently recommend Sidewinder and other Secure Computing products to our clients," said McClain. "They really are in a class by themselves."
For more information, see http://www.securecomputing.com.

Tags: TeleCents, TeleCents, Sidewinder, voip, sip, TrustedSource, Secure Computing Corporation, VoIP Security

Eavesdropping Is Possible On Cisco IP Phones

Cisco confirms that an attacker with valid Extension Mobility authentication credentials could cause a Cisco Unified IP Phone configured to use the Extension Mobility feature to transmit or receive a Real-Time Transport Protocol (RTP) audio stream. This ability can be exploited to perform a remote eavesdropping attack. All Cisco IP Phones that support the Extension Mobility feature are vulnerable.

For this attack to be possible, several conditions need to be satisfied:

• The internal web server of the IP phone must be enabled. The web server is enabled by default.
  
• The IP phone must be configured to use the Extension Mobility feature, which is not enabled by default.
  
• The attacker must possess or obtain valid Extension Mobility authentication credentials.
  

Extension Mobility authentication credentials are not tied to individual IP phones. Any Extension Mobility account configured on an IP phone's Cisco Unified Communications Manager/CallManager (CUCM) server can be used to perform an eavesdropping attack.

To obtain Extension Mobility authentication credentials, an attacker needs physical access to the network to sniff credentials. This can be accomplished by inserting a sniffing device between an IP phone and switch port.

Before eavesdropping can occur, the user who is logged into the IP phone via Extension Mobility must first be logged off of the IP phone. This can be accomplished by sending an Extension Mobility logout message to the IP phone's Cisco Unified Communications Manager/CallManager (CUCM) server.

If exploitation is successful, any IP phone that is undergoing an eavesdropping attack will have its speaker phone status light enabled, and the phone will display an off-hook icon that indicates an active call is in progress. Internal testing by Cisco also revealed that the described attack produced static noise on the IP phone while it was under attack.

Workarounds

There are workarounds to combat this attack:

• Disable the internal web server on IP phones.
  
• Disable the Extension Mobility feature on IP phones.
  
• Disable the speaker phone / headset functionality on IP phones.
  

This attack can also be mitigated by restricting access to the internal web server of IP phones (TCP port 80) using an access control list (ACL).

For more information about Cisco-recommended best practices for securely deploying Cisco Unified IP Phones, reference this link:

http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_implementation_design_guide_chapter09186a008085f858.html#wp1045452

Cisco Response

This is the Cisco PSIRT response to a presentation given at the Hack.Lu 2007 security conference by Joffrey Czarny of Telindus regarding a technique to remotely eavesdrop using Cisco Unified IP Phones.

The original report is available at the following link:

http://www.hack.lu/pres/hacklu07_Remote_wiretapping.pdf

We greatly appreciate the opportunity to work with researchers on security vulnerabilities and welcome the opportunity to review and assist in product reports.

This Cisco Security Response is posted at the following link:

http://www.cisco.com/warp/public/707/cisco-sr-20071128-phone.shtml

Tags: VoIP Security, Cisco, CallManager, Cisco Unified Communications

VoIP Security Education at ITEXPO East 2008

I have written about 100 posts related to VoIP Security. The latest (last week) being SIPtap (A Proof of Concept Tool), Taps into SIP Based VoIP Calls Records Them.
A lot of sites have written about this same issue that SIPtap has brought about. Of all the articles, the theme is that we need VoIP Security.
The good old PSTN days, we did not know about security, or did not care as Ma Bells, Pa Bells and all other bells took care of securing, wiretapping our phone calls.
But the VoIP is mich more than a phone call. Our VoIP accounts will be tied to most of our information. Leaving VoIP unsecured will be like leaving your house door open, in a bad neighborhood.
In a corporate environments, there will be much more information that need to be secured. It is not much different from the needs of securing your Data Networks. But just because the data networks are secured, your VoIP or UC, Unified Communications will not be secured. One need to take care of addressing the special needs that comes with taking all the communications to a IP platform. Be it self hosted or out sourced.
By reading Rich Tehrani's blog reminded me today that Internet Telephony Expo, ITEXPO East 2008 is coming soon. It will be held on January 23-25, 2008 at the Miami Beach Convention Center in Miami, Florida.
So what has this got to do with Security. A Lot!. The education is the key to success in any field and that is what you will be able to get at the ITEXPO East 2008.
Security Challenges in the Enterprise is a good starting point and will be presented by industry experts. There will be other interesting sessions that are typical at ITEXPO.
So register now and secure a seat so that you can learn how to secure your Unified or standalone communication networks.

Tags: VoIP Security, ITEXPO East 2008, ITEXPO, PSTN, VoIP, VoIP IP Telephony

SIPtap (A Proof of Concept Tool), Taps into SIP Based VoIP Calls Records Them.

I have mentioned security issues involving VoIP IP Telephony as close as few weeks ago as well as two years ago!
Today I hear and see another side of it. Proof of concept of wire tapping and recording of VoIP conversations. The Proof of concept tool called SIPtap is able to monitor multiple Voice-over-IP calls in SIP, listen and record them. for remote inspection as .wav files. The tool could be deployed on client side or in the middle man domain, ISP.
The creator of Proof of concept tool is Peter Cox, who co-founded firewall vendor BorderWare. He since left BoderWare to start his own VoIP company, so far only known as VoIPCode.org. (The last time I checked, the domain is still registered under Borderware.
The site offers a few stepping stones into the security world of VoIP,
VoIP Security Threats (Video Podcast) which is playable below.
A VoIP Threat Taxonomy (White Papaer) (Which is different from what I reported here from VOIPSA, two years ago.)
Asterisk SIP Registration Vulnetabilities and Limitations(White Papaer)
But I am most interest in " Asterisk SIP Registration Vulnetabilities and Limitations" which I am yet to digest.
All could be accessed from the link below.


Peter also has a seminar analyses the threats facing VoIP networks and includes practical demonstartions of many of the threats described in the above white paper collection. It is a 3 day course.
Get more information at VoIPCode.ORG.

Tags: VoIP Security, SIP Security, asterisk, SIPtap, VoIPCode, voip, VoIP Threat Taxonomy, VoIPSA

VoIP Security Vulnerabilities to rise in 2008: McAfee

In McAfee's predictions for 2008, McAfee Avert Labs Top 10 Threat Predictions for 2008
has valuable information regarding over all security. Two of them relate to our industry and I have listed them here. We have written about security many a times, like things discovered at Blackhat 2007 and have published information about security webinars. Keeping up with the tradition here are the information provided by McAfee, something to call yourselves about.
9. VoIP Attacks Speak Up
VoIP attacks should increase by 50 percent in 2008. More than twice the number of VoIP-related vulnerabilities were reported in 2007 versus the previous year—several high-profile “vishing” attacks, and a criminal phreaking (or fraud) conviction—so it’s clear that VoIP threats have arrived and there’s no sign of a slowdown. Although ABI Research estimates 1.2 billion VoIP users by 2012 (with $150 billion annual service revenues), the technology is still new to many and implementing defense strategies is lagging.
4.Instant Malware: A Different Kind of IM For several years, researchers have warned of the risk of a self-executing instant-messaging (IM) worm. This threat could spawn millions of users and circle the globe in a matter of seconds. Although IM malware has existed for years, we have yet to see such a self-executing threat. While it’s anyone’s guess exactly when this threat will emerge, the stars may be starting to align. The National Vulnerability Database reports more than twice the number of AIM, YIM, and MSN Messenger vulnerabilities for 2007 over the prior year. More important, there were 10 high-severity risks in 2007, compared with zero in 2006. Additionally, the top IM virus families of 2005 and 2006 were replaced with new active threats, signifying an “out with the old and in with the new” milestone. With nearly a quarter-billion users, Skype suffered its first batch of worms in 2007. Many more are expected to follow.

McAfee

Tags: VoIP Security, Blackhat 2007, McAfee, VoIP attacks, vishing, phreaking, IM worm, AIM, YIM, MSN, Skype

Securing VoIP One More Way

From the article "Are VoIP systems prepared for attacks?" on SC magazine, I snipped the last of it, the advise. Although seems to be repeating the process of securing a any data network, VoIP IP Telephony services needed to be secured in addition to the security in place for the VoIP. In addition meaning, VoIP Phones are more like a computers and acts and behaves like computers. So once you have provided the regular data security, following may provide a peace of mind to IP Professionals that are in charge.
The top five ways for Securing VoIP
1. End-users must demand that VoIP protocols are both inherently secure and open.
2. Companies must pledge support for moving to open, royalty-free and documented security standards, and away from proprietary VoIP protocols.
3. Corporations should audit their products, and replace insecure or proprietary usage.
4. A secure VoIP protocol should be released under an open source or general public license agreement.
5. A secure protocol should contain end-to-end encryption, control and configuration of end-devices and mutual authentication.

The article "Are VoIP systems prepared for attacks?" (although focusing on general security and Skype, it never hurts, if you have little time to read)

Tags: VoIP Security, VoIP protocols, Skype, VoIP IP Telephony