Here is an interesting article on SPAM over Internet Telephony (SPIT) that speaks to some of the methodologies for producing SPIT and proposed countermeasures and the weaknesses of each. The paper discusses a benchmarking tool called the SIP XML Scenario Maker or SXSM which uses SIPp as the traffic generator. The tool looks like it could be fun and I will be interested in trying it out when and if it is available. The paper can be found here. Enjoy
Recent Posts
- Reports that Toll Fraud Are On the Rise
- Some More Information on Toll Fraud
- Another Article on Toll Fraud
- A Script For Toll Fraud Detection
- SIP Security Discussion/Comments on NoJitter
- Coverage of the WarVOX Wardialing Tool on the Nortel VoIP Security Blog
- Toll Fraud Ring Busted
- Presentation At Interop
- VoIP on Cell Phones – the next frontier for VoIPhreakers?
- Headed out to Voicecon
Search Blog
- Search Blog
July 2009
Books
- Hacking Exposed VoIP: Voice Over IP Security Secrets & Solutions: David Endler, Mark Collier: Books
- Hacking VoIP: Protocols, Attacks, and Countermeasures: Himanshu Dwivedi: Books
- Securing VoIP Networks
- Voice over Internet Protocol (VoIP) Security
- Practical VoIP Security
- Understanding Voice over Ip Security
Conferences
Advisory Sites
Advisories
- AST-2009-001, 1/2009
- AST-2008-012, 12/2008
- AST-2008-011, 7/2008
- AST-2008-010, 7/2008
- [VOIPSEC] Fwd: [Full-disclosure] Trixbox 2.6.1 and below, remote root shell through local file inclusion, 7/2009
- [VOIPSEC] Fwd: [Full-disclosure] [MU-200807-01] Remote DoS in reSIProcate, 7/2008
- Nortel UNIStim IP Phone Remote Ping Denial of Service Vulnerability, 2/2008
- Cisco confirms vulnerability in 7921 Wi-Fi IP phone | Zero Day | ZDNet.com, 2/2008
- Design flaw in wireless VoIP handsets endanger the enterprise | Zero Day | ZDNet.com, 2/2008
- Voice of VOIPSA » Blog Archive » Trixbox contains “phone home” code to retrieve arbitrary commands to execute?, 12/2007
- [VOIPSEC] Nokia N95 cellphone remote DoS using the SIP Stack, 12/2007
- [VOIPSEC] Cisco Phone 7940 remote DOS, 12/2007
General Articles
- IT News Online > - - Sipera Systems Reports VoIP Toll Fraud Continues to Escalate, 6/2009
- Fixing a SIP Security Hole, 6/2009
- Cutting Telecom Fraud May Impede Terrorists, 5/2009
- BT Wholesale The Loop, 4/2009
- Alleged Hacking-Terror Effort Thwarted - WSJ.com, 6/2009
- VoIP Services are Vulnerable to Botnets, Security Researchers Say by PC World: Yahoo! Tech, 4/2009
- VoIP Data Tunnelling, 3/2009
- VoIP Security, 3/2009
- VoIP security firms stand to gain from SIP deployments - FierceVoIP, 2/2009
- Light Reading - VOIP - SIP Trunking: VoIP's Threatening Opportunity - Telecom News Analysis, 2/2009
- TheSpec.com - Business - Voice mail scammers ring up huge bills, 2/2009
- Business And Leadership: Increase in telecoms fraud says Minute Buyer - Leadership, 1/2009
- SiliconRepublic.com: Telecoms fraudsters threaten cash-strapped firms - CIO, 1/2009
- Bell Canada customer billed $207,000 after hacker breach, 1/2009
- Hacker victim angered by $7,000 phone bill, 1/2009
- VoIP hackers run up $120,000 phone bill at Perth business > VoIP Security > Messaging > News > SC Magazine Australia/NZ, 1/2009
- Police investigate phone hacker spree : thewest.com.au, 1/2009
- Phreakers seize government phone system • The Register, 8/2008
- Businesses ignore telecoms fraud - Network World, 7/2008
- New VOIP 'Call-Jacking' Hack Unleashed - Security/Perimeter - DarkReading, 1/2008
- Fraudsters return to dial through fraud/PBX hacking: 15 top tips to help beat off attacks, 12/2008
- Hacker makes costly calls, 12/2008
- Analysis of a VoIP Attack, 10/2008
- FBI warns of vishing threat due to software bug - SC Magazine US, 12/2008
- Light Reading - Security - VoIP Security Vendors Watch & Wait for the Worst - Telecom, 1/2009
- FBI issues VoIP security warning on Asterisk -- but which version? - FierceVoIP, 12/2008
- usken.no - VoIP news! » Blog Archive » VoIP attacks are escalating, 10/2008
- More Weapons Emerge in the VoIP Security Battle - Network Sentry, 9/2008
- VoIP system users can be targeted in attacks | News - Security - CNET News, 9/2008
- A simple call? Think again, you might be at risk, 9/2008
- Sipera Develops VoIP Spy Programto Prove a Point, 10/2008
- VOIP Services Insider, 7/2008
- Analysis: Hacking VoIP, As Easy As 1-2-3 - Security - IT Channel News by CRN and VARBusiness, 7/2008
- Georgia student arrested for hacking grades, VoIP - Network World, 7/2008
- Cellphone Botnets, Blackmailing VOIP & a Healthy Cybercrime Economy - Desktop Security News Analysis - Dark Reading, 11/2008
- UCSniff - VoIP eavesdropping made easy • The Register, 9/2008
- Beware of UC security threats - Network World, 9/2008
- The threats to telcos and how they can repel them :: SearchSecurity.com.au, 6/2008
- VoIP Security and the Circle of Trust - FierceVoIP, 6/2008
- Hidden messages buried in VoIP chatter • The Register, 6/2008
- sipflanker - Google Code, 6/2008
- VoIP Security through Responsible Software Development, 4/2008
- The Essential Guide to VoIP Privacy - VoIP News, 4/2008
- PC World - Business Center: Guide to VoIP Security, 5/2008
- Pay Attention to VoIP Security Before the Storm - Caller IP, 5/2008
- VoIP Security: SIP�Versatile but Vulnerable, 5/2008
- The Essential Guide to VoIP Security - VoIP News, 3/2008
- Last Hope Launches Security Season - FierceVoIP, 7/2008
- Greatest Challenge in VoIP Security | ITworld, 7/2008
- FEMA phones hacked; calls made to Mideast, Asia - Yahoo! News, 8/2008
- Library phone system hacked - The Boston Globe, 7/2008
- Avaya, Cisco and Nortel Patching VoIP ASAP - FierceVoIP, 6/2008
- WSTA Ticker - May/June 2008
- Exploiting VoIP vulnerabilities to steal confidential data - SC Magazine US, 6/2008
- Listen Up: 17 Signs That You Are Being Wiretapped - VoP News, 3/2008
- VoIP: Who Might Be Spying on Your Communications? (Hint — It's Not Just the NSA) - VoIP News, 3/2008
- How To Make Your Phone Untappable - Forbes.com, 5/2008
- VoIP Security: SIP�Versatile but Vulnerable, 5/2008
- OCS Exposed - Practicing Safe OCS, 2/2007
- Is Someone Listening to Your VoIP Calls? - VoIP News, 2/2008
« FEMA/Library VoIP Systems Hacked - Toll Fraud | Main | IPTComm Conference Presentations Online »
Verify your Comment
Previewing your Comment
This is only a preview. Your comment has not yet been posted.
Your comment could not be posted. Error type:
Your comment has been posted. Post another comment
As a final step before posting your comment, enter the letters and numbers you see in the image below. This prevents automated programs from posting comments.
Having trouble reading this image? View an alternate.
My Articles/Quotes
- Mark Collier Looks into his Crystal Ball, VoIP Security Trends and Predictions for 2009 - VoIP Monitor, 1/2009
- SecureLogix CTO Mark Collier to Lead VoIP Security Panel Discussion at Fall VoiceCon | Business Wire | Find Articles at BNET
- Notice That I am Speaking at the Fall Voicecon, 11/2008
- Free VoIP Security Tools from SecureLogix - Unified Communications: Click to talk, 9/2008
- Testing SIP Security on a Budget, Part 1, 9/2008
- Scrambling in the Desert: Nevada Encryption Mandate Begins Oct. 1 - Network Sentry, 9/2008
- VoIP Security: A Bit of Protection Is Worth a Byte of Cure - Network Sentry, 9/2008
- No Jitter | Interop: How Boring is VOIP Security?, 9/2008
- VOIP-Specific Attacks Not an Issue Yet, 3/2008
- Hacking VoIP Exposed - VoIP News, 8/2007
- Seven Tips For VoIP Security Success - BSM, 2/2007
- VoIP Security on Parade: Collier Predictions; ITEXPO Education, 2/2007
- VoIP Security: Cisco Unified CallManager Quiz & Chapter, 2/2007
- RSA '07: VoIP security threatened by default settings, warn experts - Network World, 2/2007
- Residential VoIP Security Tips from voip.com, 2/2007
- SAP INFO, 2/2007
- The Forum for Business IP Telephony - VoiceCon Enews -, 1/2007
- VoIP, IP Telephony - VoIP Risks Take Center Stage in 2007 - CRN, 1/2007
- McGraw-Hill Publishes `Hacking Exposed: VoIP' Book Co-Authored by TippingPoint and SecureLogix Experts, 1/2007
- Dark Reading - Desktop Security - VOIP More Vulnerable - Security News Analysis, 12/2006
- VoIP Loop Book Review, 1/2007
- VoIP Soon to Be a Target for ..., 1/2007
- Book Review: Hacking Exposed VoIP - VARBusiness, 1/2007
VoIP Security Blogs/Links
- Nortel: Community - Blogs - Nortel Voice Security
- Voice over IP Security Alliance (VOIPSA)
- Blue Box: The VoIP Security Podcast
- VoIP Security - VoIP News
- Ari Takanen's blog | ITworld
- Bogdan's Blog
- No Jitter | 42948
- Voice Over Packet Security Forum :: Your single (open) source for NGN/VoIP security issues and solutions (News)
- MADYNES research team Portal
- VoIP security - Network World
- Sipera - VoIP Vulnerabilities: Resources
- VoIP security Special Report at silicon.com
- Skype Security Blog
Tools
Interesting Documents
- PBX Hacking and Telephony Fraud Notice by Ireland’s Commission for Communications Regulations, 5/2009
- Fraud Overview, 1/2008
- Cisco White Paper on VoIP Security
- ipcom: Publications, 10/2008
- Denial Of Service Attacks and SIP Infrastructure
- Emerging Cyber Threats for 2009, 10/2008
- Paper on General VoIP Security, x/2007
- SANS Institute - VoIP Security Vulnerabilities, 12/2007
- eBook from ShoreTel With Chapter on VoIP Security
- NIST VoIP Security Guidelines
- Enterprise VoIP Security
- VoIP Security Learning Guide
- VoIP Security: A Layered Approach
- VoIP Security Threat Taxonomy
Interesting RFCs
Interesting Presentations
- Voice of VOIPSA » Blog Archive » Slides: SIP Trunking and Security in an Enterprise Network, 9/2008
- ICE Tutorial
- Another Presentation on Nortel Unistim Vulnerabilities, xx/2007
- Presentation on Nortel Unistim Vulnerabilities, xx/2007
- Peer-to-peer SIP Security Presentation, 2/2008
- Voice of VOIPSA » Blog Archive » “Hacking and Attacking VoIP Systems” - Slides from my Astricon 2007 presentation about Asterisk and VoIP security, 1/2008
- Hannes Tschofenig � My Slides from the 3rd ETSI Security Workshop, 1/2008
- Independent Research | iSEC Partners
- RTP Stenography
- Dustin Trammells Presentation on VoIP Security
Voice SPAM/Voice Phishing
- 'Untraceable' phone fraudsters eye your credit card • The Register, 6/2008
- Its only a matter of time until IP telephony is hit by spam and malware experts say, 6/2008
- [0806.1610] SPAM over Internet Telephony and how to deal with it
- The Anatomy of a Vishing Scam - Security Fix, Security Fix, 3/2008
- Rucus Info Page
- Vishing: The Latest, and Greatest, Security Concern | Security | bMighty.com, 2/2008
- SIP Usage Scenarios Similar to SPIT, 1/2008
- Does UC present new opportunities for spammers? | IT Security | TechRepublic.com, 1/2008
- SPAM and SPIT: what are the dangers? | IT Security | TechRepublic.com, 1/2008
- Why VoIP is the next target for spammers | Technology | The Guardian, 11/2007
Phishing
- Your phone may be under attack - MSN Money, 4/2007
- Voice of VOIPSA � Blog Archive � New VoIP Phishing Scheme, 3/2007
- Phishers' Latest Platforms: VoIP, SMS - Technology News by TechWeb, 1/2007
- Phishing attacks now using phone calls - USATODAY.com, 12/2006
- New Bait for Phishing Scams, 11/2006
- Phishing attacks now using phone calls - USATODAY.com, 11/2006
- Phishing Scams – Don't Get Hooked!, 7/2006
- Phishers Hit The Phone Bank With Asterisk, 8/2006
- Something's phishy - Security - Technology - smh.com.au, 10/2006
Comments