Ccip Information Note Current VOIP VULNES

8/8/2019 Ccip Information Note Current VOIP VULNES

1/22

CCIP INFORMATION NOTE | ISSUE 06Matthew Hurley, January 07

V IP VULNERABILITIES


2/22

The ollowing report outlines characteristics o Voice over Internet Protocol (VoIP).It explains the bene ts and history o VoIP. Then it describes current VoIP standardsand the security risks and vulnerabilities that surround the technology. In addition,particular attention is drawn to Skype, currently the most popular VoIP applicationin use today.

VoIP VULNERABILITIES


3/22

VoIP VULNERABILITIES | MATTHEW HURLEY

Table o Contents

Table o contents .................................................................................. 3

Introduction ............................................................................................. 4

VoIP Bene ts ............................................................................................ 5

VoIP History .............................................................................................. 6

VoIP Standards........................................................................................ 7

H.323............................................................................................................. 8

Session Initiation Protocol (SIP) .................................................... 9

VoIP Vulnerabilities ............................................................................10

Risks & Vulnerabilities Inherited rom IP .............................. 11

Risks & Vulnerabilities Associated with VoIP ......................12

Risks & Vulnerabilities Speci c to VoIP ..................................14

Skype..........................................................................................................17

Conclusion .............................................................................................. 19

Re erences...............................................................................................20

Disclaimer In ormation.................................................................... 21

TABLE o coNTENTS


4/22

CCIP INFORMATION NOTE - ISSUE 06

V oIP is de ned as the ability to make telephone calls,send axes and carry out video-con erencing overIP based networks. This is achieved by utilising currentVoIP standards and protocols such as H.323, SessionInitiation Protocol (SIP), and Skype to convert analoguesignals into digital data that can be transmitted overthe Internet. VoIP o ers a number o bene ts includingincreased exibility and reduced overheads to any

organisation that is willing to change its voice networksrom the traditional circuit switched network to that o

the packet switched network utilised by VoIP.

Even though the traditional Public Switched TelephoneNetwork (PSTN) has proven to be highly reliable overthe past 135 years, VoIP is seen as a more promisingalternative. This is because VoIP is more e ective whenutilizing available bandwidth and also allows or more

e cient network deployment models. Taking theabove into account, it is not hard to understand thatthe number o VoIP subscribers has steadily increasedto 18.1 million users worldwide as at the end o 2005 . It has also been projected that the number o VoIP subscribers will more than double to 47 millionsubscribers by the end o 2006 .

Like any new IT service, VoIP has a large number o

inherent and associated security risks and vulnerabilitiesthat can a ect the reliability and availability o anorganisations IT in rastructure. It is also one o themajor issues slowing the uptake o VoIP. There ore it isparamount or any organisation looking to incorporateVoIP to have a total understanding o the threats thatthey will be potentially introducing into their IP networks. This report classi es the risks and vulnerabilities o VoIPinto three categories 1those inherited rom IP,2those

1 http://clickz.com/showPage.html?page=36232532 http://lw.pennnet.com/Articles/Article_Display.c m?ARTICLE_ID=267354&p=13

associated with VoIP, and those speci c to VoIP. Firstly,an overview o the bene ts o VoIP.

INTRodUcTIoN


5/22


T here are two major bene ts to any organisationor business wanting to implement VoIP in theirday-to-day operations. The rst major bene ts is thelower costs associated with VoIP when compared tothat o the traditional PSTN. The main reasons VoIP isconsidered more economical include:

Reduced cost o phone calls: The costs o phonecalls via VoIP are minuscule when compared to

equivalent calls made over the traditional PSTN. This is because VoIP takes advantage o existingWAN connectivity to remote locations over adedicated data network or the Internet, thusavoiding any long-distance toll-call charges.

Reduced maintenance and capital costs: VoIP isbased on so tware rather than purely hardware,there ore it is easier to alter and maintain.

Furthermore deploying a VoIP network can beless expensive when compared with the costso deploying a Private Branch Exchange (PBX).

Simpli ed in rastructure: Because VoIPutilises the same in rastructure as your datanetwork its possible to converge the two, thussimpli ying the operation and management o the network. This is also advantageous rom a

cost perspective as a single network can carryboth voice and data.

The nancial gain provided by VoIP obviously dependson the size o the business and how that particularbusiness operates. One particular business case,provided by Deloittes New Zealand, showed the initialVoIP setup cost or a medium sized business o 350employees would be close to $225,000. This gure

includes an incremental capital investment o $125,000as it would approximately cost $100,000 to replace theexisting analogue system. Once installed the system

would acilitate call savings o at least $5,000 dollarsa year. However consultants in the industry state thatcall savings are only a small part o the overall bene tsgained by a VoIP system. The major bene ts come romthe simpli ed in rastructure and with it the reducedmanagement and maintenance costs.

The second major bene t o VoIP is increased exibilityand location independence. These additional bene ts

emphasize the advantages to be gained by anyorganisation implementing the technology and showthat VoIP is more than simply just a way to reduceexpenditure. They include:

Improved exibility: VoIP allows or new help uleatures like click-to-call that enable a user to

simply click a URL while browsing a web pagethat will initiate a call over a VoIP network to an

attendant.

Improved productivity: A Virtual Private Network (VPN) combined with VoIP can be used to setup a ully unctioning o ce anywhere thereis a broadband connection. Furthermore VoIPtreats voice as i it were any other kind o data, sousers can attach documents to voice messagesor participate in virtual meetings using shared

data and videocon erencing.

Location Independence: This allows anindividual to have incoming phone callsautomatically routed to their o ce or personalVoIP phone number regardless o location. Thisis because when using a VoIP network, the useronly needs to be able to register their locationwith the VoIP server to be able to receive calls.

VoIP BENE ITS


6/22


T he history o VoIP dates back to 1964 when PaulBaran wrote the rst paper on secure packetisedvoice. However, it was not until thirty-one years later in1995 that the rst internet phone so tware Vocaltecwas released. Coincidently it was in May o the sameyear that the International Telecommunications Union(ITU) initiated work on the H.323 standard. The nextmajor development in VoIP occurred in September

o 1999 when work was commenced on the popularSIP by the Internet Engineering Task Force (IETF). SIPwas then accepted as a 3rd Generation PartnershipProject (3GPP) signalling protocol in November 2000. The ollowing year Microso t incorporated VoIP intoWindows XP Messenger using SIP. This was closely

ollowed by the ounding o Vonage, which is a leadingprovider o broadband telephone services with over 2million subscribers in 2006. The last major development

in VoIP came in August o 2003 with the release o Skype.

VoIP HISToRy


7/22


There are two major non proprietary standards used or VoIPcommunications by many VoIP so tware applications. They are H.323and Session Initiation Protocol (SIP).

VoIP STANdARdS


8/22


H.323 is a protocol suite speci ed by the ITUthat lays a oundation or IP based real-timecommunications including audio, video and data.H.323 was designed to handle call setup and tear-down

unctions and can use both TCP and UDP as a transportmechanism. Security within the H.323 protocol isachieved by the H.235 protocol, which incorporates

our security goals including authentication, integrity,

privacy, and non-repudiation. These goals are providedthrough our mechanisms, namely: con guration,authentication, key exchange, and encryption.

Security concerns within H.323 arise as many o theprotocols use random ports causing problems securingthem through rewalls. This may be mitigated by usingdirect routed calls, however since the ports required orH.323 are not de ned, a ltering rewall would require

all possibly-needed ports le t open, thus allowingmultiple entry points to be exploited by malicioususers.

H. 2


9/22


Session Initiation Protocol is a signalling protocolspeci ed by the IETF, used to set up and tear downtwo-way communications sessions. Security in SIP issimilar to H.323 and aims to achieve con dentiality,message integrity, non-repudiation, authenticationand privacy. SIP has a security advantage over H.323as it uses only one port (traditionally TCP and UDPport 5060). However because SIP operates at the

application level, no new security mechanisms werecreated. Instead SIPs security is achieved by utilising thesecurity mechanisms provided by HyperText Trans erProtocol (HTTP), Simple Mail Trans er Protocol (SMTP),and Internet Protocol Security (IPSec).

One o the main security concerns or SIP are thatHTTP Digest does not provide adequate integrity, andspoo ng o the header would be easily accomplished

without employing S/MIME (Secure/MultipurposeInternet Mail Extension). The use o S/MIME orencryption also adds another issue as it uses public keyin rastructure, thus making it di cult or users movingbetween devices as certi cates are associated withusers. Lastly the text encoding o SIP makes it easier toanalyse using standard parsing techniques. The securityissues o SIP are highly apparent as there has been over20,000 uniquely identi able threats launched against

SIP networks in the last two years3.

A common security issue or both VoIP standards comesthrough the use o NAT (Network Address Translation).NAT poses a problem or both H.323 and SIP as it isdesigned to hide the IP address on the internal network

rom the public network. Thus causing a disruptionrstly, in the setup next procedure used by each

protocol within the H.323 suite and secondly, inhibiting

3 G. S Sipera, Comprehensive VoIP Security or the Enterprise: Not JustEncryption & Authentication, Sipera (March 2006)

SESSIoN INITIATIoN PRoTocoL (SIP)

SIPs registrations and communication mechanisms. Itis possible to resolve NAT issues when using VoIP butthis usually requires innovative solutions.


10/22

10 CCIP INFORMATION NOTE - ISSUE 06

As VoIP is an IP based technology that utilises the Internet it also inherits allassociated IP vulnerabilities. The impact o these Internet-borne attacks isthen multiplied by the VoIP architecture as it adds a number o additionalweaknesses, which require uther work to secure and maintain. Furthermore,as with adding any new service to an inadequately secured environment,is like piercing holes in an already-leaky boat. The ollowing paragraphsdescribe the risks and vulnerabilities o VoIP that are rstly, inherited rom

IP, secondly, associated with VoIP, and lastly, speci c to VoIP.

VoIP VULNERABILITIES


11/22

VoIP VULNERABILITIES | MATTHEW HURLEY 11

P r Ar hite tural designPoor or inadequate architecturecan lead to ongoing di culties inthe operation and security o a VoIPsystem. Firewalls are particularlyvulnerable areas in a VoIP network as they require additional ports tobe opened to acilitate VoIP tra c.Non VoIP-aware rewalls may lack dynamic interaction with VoIP sothey simply leave a range o portscontinually open or call activity.

RISkS & VULNERABILITIES INHERITEd Rom IP

PBX H sts & Gate a sMost service interceptions andeavesdropping attacks will usuallyrequire the compromise o a PBXas a means o network access. Acompromised host or gatewaycan acilitate this by capturingvoice packets to reveal in ormationon all calls, call duration, and callparameters. This in ormation willpermit the mapping o VoIP, andpossibly the supporting datanetworks.

Repla Atta sA replay attack can be mountedagainst a VoIP network byretransmitting a legitimate sessionso that the recipient devicereprocesses the data. The basiso a replay attack is to capturea valid packet, which can thenbe replayed into the network. This generally causes the targetnetwork to respond and providemore tra c to capture, eventuallyproviding enough in ormationto move to packet spoo ng andmasquerading, or simply nding anentry point into the target network

or eavesdropping.

For example a replay attack couldbe used to gain access to a network by capturing and replaying a validuser ID and password, even thoughthe captured data is encrypted andthe attacker was unable to decryptit.


12/22


uzzingFuzzing is a legitimate method o testing so tware systems or bugsand is accomplished by providingan application with semi-valid inputto see what its reaction will be. Thistechnique can be employed toexploit vulnerabilities in a targetVoIP system and is achieved bysending messages so that thetarget system will assume thesent content is valid. In reality, themessage is broken or uzzed, thuscausing various ailures to occurwhen the target system attemptsto parse or process it. Resultant

ailures can include application

delays, in ormation leaks, andsystem crashes.

Pa et Sp fng &masquera ing

Packet spoo ng uses IP packetswith a alse source address that maybe used or:

obscuring the origin o the

packet

implicating another site or host

as the attack originator

masquerading as a trusted host

interception or hijacking o

network tra c

directing responses to another

host or system

undertaking man-in-the-middle

spoo ng attacks

A major risk associated with packetspoo ng and masquerading isidentity the t. For example a man-in-the-middle spoo ng attack, asshown in Figure 1, can be launchedwhen a person makes a call, whichincludes sensitive in ormation. As aresult o the attack they may speak to the intended recipient however,their call is being monitored bymalicious users.

RISkS & VULNERABILITIES ASSocIATEd wITH VoIP

Re nnaissan e Atta sReconnaissance Attacks are a ormo intelligence gathering wherenetworks are probed to ascertaintheir vulnerabilities. Methods usedto achieve this include call walkingand port scanning and are the rstaction undertaken by an attackerwhen attempting to penetrate anetwork. A success ul probe woulddetermine the behaviour o thenetworks equipment, users, andservices that might be availableto be exploited or disrupted. Thisin ormation could then be used tolaunch a ocused attack against thenetwork.

Caller B

Malicious User

Caller A

Intended Call Flow

R e s u l t i n g C a l l F l o w R e s u l t

i n g C a

l l F l o w


13/22


RISkS & VULNERABILITIES ASSocIATEd wITH VoIPcontinued

Reliabilit & Availabilitchallenges

To achieve constant real time voicecommunications, VoIP places a highpriority on Quality o Service (QoS).However the reliability o voice anddata networks is closer to 99.9%,which compares poorly againstthe 99.999% reliability that peoplehave come to expect rom thetraditional PSTN. Even though thisdoesnt appear to be a signi cantdi erence it equates to an additionaldowntime o 8.7 hours each year orVoIP. This could ultimately lead tothe loss o human li e i emergencyservices were required during this

outage window.

denial Servi e d SDoS and Distributed Denial o Service (DDoS) attacks occur when amalicious user deliberately sends an exceedingly large amount o randommessages to one or more VoIP end-points rom either a single location(DoS) or rom multiple locations (DDoS), as shown in Figure 2. Multiplelocations are achieved through the use o zombies (compromised machinesthat could be woken upon request and used or malicious purposes). TheDoS attack is success ul when the amount o incoming messages exceedsthe processing capacity o the target system, thereby exhausting systemresources and thus, denying services to the end-users.

VoIP systems are especially vulnerable to DoS and DDoS attacks because o the high undamental requirement that they place on QoS. There ore lesstra c or network disruption is required or a DoS attack to be success ulwhen compared to mounting a DoS attack against a data network. A

urther consideration is needed where VoIP and data share the samenetwork. Here the data network could also be subject to the same DoSattack. Examples o VoIP speci c DoS attacks include identity spoo ng andcancellation o pending call set up signals, also known as the SIP CANCELDoS attack.

Malicious User VoIP Server

Zombies

Malicious User VoIP Phone

DoS Attack on End Point DDos Attack on Call Server


14/22


Ph ne I pers nati nPhone impersonation occursdue to the weak authenticationprocess attributed to VoIP. Thereare two major contributors thatconsolidate this act. Firstly, there isa limited human inter ace available

or VoIP phones, limiting users tothe selection o a numeric PIN ortheir password in lieu o a strongpassword based on the entireASCII character set. Secondly, andthis is related to the SIP standard,the authentication mechanism isbased on the MD5 algorithm. Anattacker who can sni the entireSIP authentication exchange

cannot observe the passwordsent in plain text, but can observeenough in ormation to mount anofine dictionary attack againstthe password. The combination o these weaknesses allows passwordsto be easily obtained by an attackerand then used to impersonate aphone or user.

RISkS & VULNERABILITIES SPEcI Ic To VoIP

cId Sp fngOne type o masquerading is based on the manipulation o Caller ID (CID),which is used to identi y the caller be ore answering, and is known as CIDspoo ng. The CID is based on reported in ormation rom di erent carrierswitches and is speci ed by the switch administrator in a VoIP environment. This allows an attacker to spoo their CID in ormation with a text string orphone number they speci y and could be used to give credibility to variousmalicious users undertaking social engineering attacks.

In addition to this, the option or CID privacy (i.e. the ability to obscureyour phone number rom the CID display) is not possible with VoIP, sincethe phone number is included in the SIP and H.323 header. This allows anyattacker with a IP packet sni er, such as tcpdump, to discover the remotecallers phone number, even i their number has been marked as private bytheir service provider. Further, there are a number o CID spoo ng serviceproviders in the US that, or a small ee, allow users to choose the numberthey are calling rom.

A recent example o CID spoo ng was reported by Spoo Card.com, which isa company that sells enhanced calling cards that provide the CID spoo ngability. Coincidently 50 customers accounts were cancelled, includingParis Hiltons, due to customers abusing the CID spoo ng eature to break into other peoples voice-mail accounts, listen to their messages, and evenchange the targeted users greetings 5.

5 http://voipsa.org/blog/2006/08/28/paris-hilton-hacker-extraordinaire/


15/22


RISkS & VULNERABILITIES SPEcI Ic To VoIPcontinued

call Hija ing & Re ire ti nCall hijacking and redirection occurs when a call intended or one useris redirected to another. To achieve this, an attacker only needs to haveknowledge o the users authentication credentials in order to impersonateand receive all calls intended or that user. Methods including spoo ng o anode, man-in-the-middle attacks, and manipulation o call requests usingsignalling response codes make call hijacking and redirection relativelyeasy to instigate. Further to this, VoIP eatures including call orwarding and ollow-me also help acilitate the ability to route calls to speci c phonenumbers.

Call hijacking and redirection can also be used or nancial gain. For example,call hijacking can be targeted by cyber-criminals who resell the calls. This issometimes used as a money laundering channel rom which organisationswould only see an increase in bandwidth usage together with increasedcosts. Similarly, call redirection may also transit another system to collectdata or later analysis or simply as a revenue gathering mechanism. In thiscase, the consequences may include the loss o sensitive in ormation andservice disruption.

Call hijacking was recently discovered in Miami by the US Federalgovernment. In this particular case Edwin Pena sold discounted Internetphone services by hacking into other Internet phone providers andpiggybacking connections through their networks unbeknown to them.In one three-week period a particular Internet phone provider receivedabout 500,000 calls that were made to look like they had come rom theinvestment company Rye Brook. Because o this, the victimised Internetphone provider was le t having to pay $300,000 in connection ees orrouting the phone tra c to other carriers without receiving any revenue

or the calls6.

6 http://voipsa.org/blog/2006/06/07/hacker-cracks-net-phone-providers- or-gain/

Eaves r ppingEavesdropping is the unauthorisedinterception o voice packets or Real Time Protocol (RTP) media streams,and the decoding o signallingmessages. It is a relatively simpleattack to administer and tools suchas network protocol analysers,sni ers and packet capture toolsare reely available on the Internet.Wireshark is an example o atool that can be used to captureVoIP tra c and reconstruct VoIPconversations.

A real world example o eavesdropping was publicised inJuly o 2005 where aws were oundin Ciscos CallManager VoIP so tware. The aw could be exploited bysending specially cra ted packets tothe Cisco CallManager that allowedan attacker to create a heap over owand ultimately enable him to mountan eavesdropping attack 4.

4 http://www.techweb.com/wire/ security/165702369


16/22


V IP SpaVoIP SPAM or Spam over Internet Telephony (SPIT) is theunsolicited and unwanted bulk messages broadcastover VoIP to particular end users. Not only could thisbe extremely annoying (especially when time zonesare taken into consideration), it also has the potential tobe rather costly where or example, calls are orwardedto mobile phones. Another issue arises with SPIT andthe act that high-volume bulk calls routed over IP arevery di cult to trace and have the inherent capacity

or raud, unauthorised resource use, and privacyviolations.

Voice mail bombing is a orm o SPIT where multiple(this may entail hundreds or even thousands o ) voicemail messages ood voice mail boxes. This attack couldresult in service disruption or a denial o service attack.

The rst real wide spread phishing attack utilisingVoIP was launched in June 2006 against customers o the Santa Barbara Bank & Trust in Southern Cali ornia. Targets o the scam were sent an o cial looking emailwarning them that their bank account had been lockedas a security measure and asked that the recipient callthe supplied number to veri y the account and usersidentity. When customers called the number they weregreeted with an automated voice system requestingthat they enter their account number and otherpersonal in ormation7.

The above paragraphs explain three di erent groupso risks and vulnerabilities that can a ect the securityo a VoIP service or network. They also show that anyorganisation wanting to utilise this technology needsto be strongly aware o the issues surrounding it andhave appropriate security polices in place to mitigate

7 http://www.eweek.com/article2/0,1895,1985966,00.asp

these. The above paragraphs also emphasize the actthat organisations that chose a simpli ed in rastructure

or both voice and data could experience disruptions totheir data networks i an attack was launched againsttheir more vulnerable VoIP network.

VoIP is a relatively new technology and researchregarding its security is very young, in act it is saidto be at the tip o the iceberg. There ore as additional

research is carried out and new vulnerabilities arediscovered, it would be important or an organisationto consider separating the data and VoIP networks inorder to avoid a potential business and or operationalcatastrophe.

The ollowing paragraphs will look at Skype, whichis the most commonly used VoIP application on themarket today.

RISkS & VULNERABILITIES SPEcI Ic To VoIPcontinued


17/22


Skype is a proprietary VoIP system developed bySkype Technologies and released in August 2003.It is the so tware o choice in the UK, being used by48% o VoIP users8. Skype, which recorded a recordhigh o 8 million users online at one time in November2006, utilises a Peer-to-Peer architecture that relies on acentral authentication sever to authenticate users andso tware distributions. In addition to this, both user

identities and so tware distributions are digitally signedby an RSA private key. The resulting RSA public key isembedded into every Skype executable and thus,provides the basis or voice encryption.

Skype does di er considerably rom SIP and H.323 inthe way that it connects clients that are sitting behind

rewalls. In order to initiate a connection, Skype createsa rendezvous point, also known as a super-node, which

ensures NATed users can communicate with eachother. A super-node is a computer operating on a publicIP address that has the ability to proxy connections tothe Skype clients behind the more restrictive rewalls.Further to this, the total amount o load placed on anetwork when a machine becomes a super-node isunknown and it also has the ability to inter ere witha businesss applications and services. One publicisedexample showed that while a users machine was

acting as a super node, Skype was utilising 100kbpso the companys bandwidth or both upload anddownload data ows 9.

Super-nodes are not the only concern o the Skypeprotocol. Security is also a major concern, the keyproperties being; privacy, authenticity, availability,survivability, resilience, and integrity (o conversationand system).

8 http://www.eweek.com/article2/0,1895,1985966,00.asp9 http://www.voipwiki.com/blog/?p=30

SkyPE

However, there are a number o other actors thata ect the security o Skype. Firstly, the security o Skype depends on the security o the computer andnetwork on which Skype is running. Secondly, becauseSkype uses a proprietary protocol, the only sourceso in ormation regarding any security weaknesses arestatements rom the company and publicly disclosedvulnerabilities. Thirdly, because Skype is mostly a peer-to-peer system, the overall security can be a ected bythird parties that are unknown to those in a particularphone conversation. The latter is possible as problemshave been identi ed in Skypes encryption ormat,which rstly, allows the execution o man-in-the-middleattacks and secondly, enables the ability or a worm tobe hidden in the encryption during transmission 10.

These are not the only concerns that a ect the securityo Skype. Another issue arises in Skype because it is port-agile meaning that i a rewall port is blocked, Skype willseek other open ports to establish a connection. This

eature would also allow an attacker, i a vulnerabilitywas exploited, to use the application to gather urtherin ormation about machines on a network. There ore,Skype could provide a back door into otherwise securenetworks or worms, Trojans, and viruses11.

In addition to the above, it was recently shown thatSkype could provide botnet controls that could enablea better way or controlling zombies. What is concerningabout this or an organisation is that any attack ( orexample a DoS attack) resulting rom this technologymay be virtually impossible to identi y the perpetrator. This is because Skype uses proprietary technology andencrypted data tra c that cannot be easily monitored.

10 http://www.skypejournal.com/blog/archives/2005/11/ ve_reasons_not_to_block_skype_1.php11 http://computerworld.co.nz/news.ns /news/ 1C31DD62E610104ACC2570B40016C985


18/22


This potential concern could be mitigated by a smallgroup o Chinese engineers who have proved thatthey have reverse engineered Skype. The redesignedso tware has a di erent GUI than the traditional Skypeapplication and can be used to discover the IP addressand physical location o the Skype user who you arecalling12.

Even though Skype has a number o key eatures,

including privacy, authenticity, availability, survivability,resilience, and integrity, in place to ensure its security,the above paragraphs clearly outline that these are ar

rom oolproo . In addition it has also been identi edthat Skypes own unctionality used to provide its highquality service can also be used or malicious purposes.Also, the concept o hosting a super-node is ar romdesirable or any organisation that values its bandwidth. There ore it is important or an organisation to ullyunderstand the security risks o Skype when choosingto use it as their main VoIP application.

12 http://www.voipwiki.com/blog/?p=26

SkyPE continued


19/22


V oIP o ers a number o bene ts to any organisationconsidering implementing it into its day-to-day operations. At the time o writing, organisationshave the choice o two VoIP standards and oneproprietary protocol (H.323, SIP, and Skype) that canbe utilised or lowering the costs o daily operationsand increasing exibility. However, any organisationthat has implemented or is looking to implement VoIP

needs to be aware o the security issues surroundingthe technology. Phone impersonation, reconnaissanceattacks, eavesdropping, SPIT, call hijacking andredirection, and identity the t are only a ew o thepossible risks and vulnerabilities that a maliciousperson can mount against an organisations VoIPservice. There ore, it is important organisations carryout the appropriate security measures to ensure thecon dentiality, integrity, and availability o their VoIP,

and in some cases, data networks.

coNcLUSIoN


20/22


S. Gar nkel, VoIP and Skype Security, SkypeSecurity Overview Rev 1.6 (May 2005)

J. Waldron , VoIP Security Essentials, Black Hat

Brie ngs

http://www.blackhat.com/presentations/bh-usa-

06/BH-US-06-Waldron.pd

Dr. T. Porter, H.323 Mediated Voice over IP:

Protocols, Vulnerabilities & Remediation

http://www.security ocus.com/print/ in ocus/1782

Cyber Security Industry Alliance, Cyber Security

or IP Telephony, Findings & Recommendations

(May 2005)

C. Roberts, Voice Over IP Security, Centre or

Critical In rastructure Protection (May 2005)

Sipera, Comprehensive VoIP Security or the

Enterprise: Not Just Encryption & Authentication,

Sipera (March 2006)

Whichvoip, The History o VoIP

http://www.whichvoip.com/voip/articles/voip_

history.htm

Dr. R. Kuhn, T. J. Walsh, S. Fries, Security

Considerations or Voice Over IP Systems, NIST SP

800-58VoIP Standards and Protocols

http://www2.rad.com/networks/2001/voip/prtcls.

htm

G. S. Tucker, Voice Over Internet Protocol (VoIP)

and Security, SANS Institute (October 2004)

Systems & Network Attacks Centre (SNAC),

Security Guidance or Deploying IP Telephony

Systems, NSA (February 2006)

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

11.

RE ERENcES


21/22

While this publication is accurate to the best o our knowledge, CCIP does not accept anyresponsibility or errors or omissions. CCIP will not be liable or any loss or damage howsoevercaused, arising rom or in connection with the use o in ormation contained in this publication.

Re erence in this publication in any manner to any commercial product, process or service does notconstitute or imply its endorsement or recommendation by CCIP. Views and opinions expressedherein may not be used or advertising or product endorsement purposes.

DISCLAIMER INFORMATION


22/22

CENTRE for CRITICAL INFRASTRUCTURE PROTECTION

www.ccip.govt.nz | ph: +64 4 498-7654 | ax: +64 4 498-7655PO Box 12-209, Wellington , New Zealand

Documents

Ccip Information Note Current VOIP VULNES