Mark Collier's VoIP Security Blog

Vulnerability in Some SIP Phones Allowing Remote Eavesdropping

Here is a post by Dan York on the VOIPSA blog, describing an attack where by using a statefull fuzzer, you can cause some SIP phones to allow eavesdropping on conversations in the room.

http://voipsa.org/blog/2007/08/28/remote-eavesdropping-vulnerability-with-grandstream-sip-phone-now-slashdotted/

A Brief Interview in VoIP-News

John Edwards from VoIP News conducted a brief email-interview with me about VoIP security. He posted my (brief) answers to questions in the following article:

http://www.voip-news.com/feature/hacking-voip-exposed-082707/

VoiceCon 2007

I attended and spoke at the the summer VoiceCon. Voice/VoIP security was a big topic at the show and there were 2 tutorials, 1 panel, and 1 general session. David Endler of TippingPoint and I presented a general VoIP security tutorial on Monday the 20th. We had a decent turnout. I took the following picture of the room:

I also moderated a panel with David Endler and Krishna Kurapati of Sipera on Tuesday the 21st. Again, this session was well attended. The format involved me asking questions and then one or more of us providing answers (as opposed to using presentations). We left about 20 minutes for questions and got some good questions from the audience.

I also participated in the VoiceCon "Morning Call", where Eric Krapf spent 15 minutes discussing issues, including VoIP Security. This was a good opportunity to address the entire audience (although the session was at 8:00, so a lot of people were still in bed). Here are a couple of pictures from this sessions:

VoIP Security Course

Here is a VoIP security course. I looked at the outline and it looks like they use a number of the tools we released with our book. I am sure there are other VoIP security courses out there. If anyone knows of any others, please send them to me and I will add a list to this blog.

http://www.globalknowledge.com/training/course.asp?PageID=9&courseid=10096&country=United+States

Animation Describing SRTP

Here is a flash animation describing Secure RTP (SRTP):

http://blog.tmcnet.com/cross-talk/srtpsecure-rtp-for-voipsip.asp

VoIP Attack Tool Summary from Blackhat 2007

Dustin Trammell posted the following summary of the VoIP testing/attack tools released this year at Blackhat:

http://voipsa.org/blog/2007/08/15/blackhatdefcon-tools-update/

Another Positive Review of Hacking Exposed:VoIP

bThanks to Martyn Davies for posting a 5-star review of our Hacking Exposed: VoIP book on Amazon.

http://www.amazon.com/Hacking-Exposed-VoIP-Security-Solutions/dp/0072263644/ref=pd_bbs_sr_1/102-0518973-0910504?ie=UTF8&s=books&qid=1187213484&sr=8-1

Be sure to check out Martyn's blog. Martyn is also a frequent poster on the VoIPSA blog. Martyn also recently participated in a VoIP security panel, which you can listen to on the Bluebox Podcast.

List of VoIP Security Vulnerabilities

Here is a list of VoIP vulnerabilities:

https://www.securinfos.info/english/security-advisories-alerts/security-advisories-voip.php

Taxonomy Article

Here is an article with an excerpt from a new VoIP security book. The article covers a summary taxonomy provided in the book, which the authors offer as superior to the VoIPSA Threat Taxonomy, because of its simplicity.

http://ipcommunications.tmcnet.com/news/2007/08/15/314541.htm?p=gateway

I haven't read the book yet.

Interview with a VoIP Hacker

Here is an interview by Dan York and Jason Huffman, of Robert Moore, who was the "hacker" used by Edwin Pena to steal and resell over $1,000,000 of minutes from VoIP service providers.

http://www.thevoicereport.com/TelecomJunkiesArchive-VoIPHacker.html

A key point here is the how simple the attacks were. This wasn't a sophisticated VoIP attack, rather exploitation of VoIP systems, through some basic security issues, like bad passwords, unpatched systems, etc.