Penetration Testing mailing list archives
RE: VoIP Assessment
From: "Bob Bell (rtbell)" <rtbell () cisco com>
Date: Wed, 20 Jul 2005 08:24:57 -0700
Mark, Intel96 - There are a lot of conflicting opinions floating around as to the security of VoIP systems. One of the things that you need to do is establish whether you are dealing with a bounded system, (i.e. an enterprise PBX replacement) or an unbounded one (i.e. SKYPE) as they have considerable differences in both their vulnerability and the resources available to deal with issues. Secondly, security of VoIP is not a single dimensional problem. Many of the issues of protecting VoIP occur a layers far below the application layer which is where VoIP lives. So, you need to examine the issue from a systems approach not simply a point solution for VoIP. Finally, there is a great deal more to providing SYSTEMIC protection beyond simply protecting the protocol. This includes things like the provisioning of the endpoints, the control of and validation of the images contained in the endpoints, the authentication and authorization schemes for the endpoints and users, etc. If I can be of help, please feel free to contact me. Bob IPCBU Security Architect Cisco Systems, Inc. 576 S. Brentwood Ln. Bountiful, UT 84010 801-294-3034 (v) 801-294-3023 (f) 801-971-4200 (c) rtbell () cisco com
-----Original Message----- From: Mark Teicher [mailto:mht3 () earthlink net] Sent: Tuesday, July 19, 2005 16:40 To: intel96 Cc: pen-test () securityfocus com Subject: Re: VoIP Assessment What specific items have you been tasked to validate? Could be as simple as : Are the components VoIP capable? If so, then what protocols have been implemented (Y/N) If x protocol, if implemented correctly (i.e when enabled, does it process the traffic correctly (Y/N) If x protocol, if implemented correctly (i.e. when x protocol is disabled, does it block VoIP traffic inbound/outbound? (Y/N) and so and so on Lots of those "security" type experts will overstate the obvious and start rattling off big words like MITM attacks, Resource exhaustion, H.323 attacks, SIP Overflow attacks, etc, etc, but IMHO, simplify what the tasks are, and break those tasks into simple steps that any former senior security consultant can do by utilizing a checklist approach, otherwise one gets into the battle with the "puffed out chest security wannabes " /m At 01:40 PM 7/19/2005, intel96 wrote:I have been asked to look at the security of a VoIParchitecture. Hasanyone conducted a security assessment against VoIP or thecomponentsthat make up the architecture? Thanks, Intel96
Current thread:
- VoIP Assessment intel96 (Jul 19)
- Re: VoIP Assessment Mark Teicher (Jul 19)
- <Possible follow-ups>
- RE: VoIP Assessment Bob Bell (rtbell) (Jul 20)
- Message not available
- RE: VoIP Assessment Mark Teicher (Jul 20)
- Message not available
- RE: VoIP Assessment Bob Bell (rtbell) (Jul 21)
- Message not available
- RE: VoIP Assessment Mark Teicher (Jul 21)
- Message not available