Rajeev BevaraCS-555

Security Threats in VoIP

What is VoIP ?➔ VOIP - Voice Over Internet Protocol.➔ Delivery of voice communications and multimedia sessions over

Internet.➔ It is also referred as IP telephony, Internet telephony.➔ The first ever internet VoIP program was released in February

1995 by VocalTec Communications.➔ As the years passed VOIP has gained substantial popularity.

Highlights of VOIP★ Cheaper when compared to that of POTS - Plain Old Telephone

Service.

★ We get a lot of other features with NO EXTRA COST.○ Unlimited long Distances○ Caller ID○ Voicemail○ conferencing

Types of VOIP services

➔ Computer-Based VOIP Service

➔ Residential VOIP Service

➔ Mobile VOIP Service

➔ Business VOIP Service and Solutions

Problems of VOIP

VOIP phone service is less reliable and most importantly less secure when compared with ordinary phone service.

❖ Voice Quality

❖ Bandwidth Dependency

❖ Power Dependency

❖ Emergency Calls

❖ SECURITY

Security threats in VOIP

Voice over IP Security a book published by Cisco Press identifies 4 main categories of security threats.

➢ Threats against availability➢ Threats against confidentiality➢ Threats against integrity➢ Threats against social context

Security threats in VOIP

★ Threats against availability○ These threats aim at VOIP service interruption, typically in

the form of Denial of Service (DOS).■ Call flooding■ Protocol Fuzzing■ Call hijacking■ Spoofed messages■ Server impersonating

Security threats in VOIP★ Threats against confidentiality

○ These threats provide unauthorized means of capturing identities, patterns and credentials■ Eavesdropping■ Call Pattern Tracking■ Data Mining■ Reconstruction

Security threats in VOIP★ Threats against integrity

○ These threats allow alteration of initial message and medias in the middle of the network■ Message Alteration

● Call rerouting● Call Black holing

■ Media Alteration● Media Injection● Media Degrading

Security threats in VOIP★ Threats against social context

○ These threat allow attackers to misrepresent himself as a trusted entity

■ VOIP Phishing aka Vishing

■ Registration hijacking

■ SPIT (Spam over Internet Telephony)

Summary

VoIP is a relatively new technology. It is still considerably insecure

than ordinary phone services.

It has to deal with all the security problems of traditional data

network plus the new security problem caused by new protocols and

components.

Businesses and individuals need to take necessary precautions when

using this technology.

Questions ???

References➔ http://www.cisco.com/cisco/web/solutions/small_business/resourc

e_center/articles/connect_employees_and_offices/what_voip_can_

do_for_you/index.html

➔ http://www.sans.org/reading-room/whitepapers/voip/security-issu

es-countermeasure-voip-1701

➔ http://en.wikipedia.org/wiki/Voice_phishing

➔ http://voip.nyquist.ro/docs/Registration_hijacking_060105.pdf

➔ http://www.techopedia.com/definition/13320/spam-over-internet-t

elephony-spit

➔ Patrick Park, (2008)Voice over IP Security. Security best practices

derived from deep analysis of the latest network threats, Cisco

Press.