With VoIP, Old Attacks Find New Targets

Page 2 of 2

Getting a jump on the bad guys

Analyst Michael Dortch agreed the threat to VoIP services should be a key IT concern.
"Users and network operators need to begin taking steps to protect their VoIP deployments and resources, such as directory databases, now, so they can try to get a jump on the bad guys when they start trying to figure out how to steal and automatically process actual VoIP conversation streams," said Dortch, principal analyst at DortchOnIT, said in an e-mail to InternetNews.com.
"As voice and data streams increasingly converge, and businesses increasingly rely on IT to do business, the business criticality of digital voice and data grows significantly," continued Dortch. "When building and implementing their data security architectures, users and network operators alike must ensure that no data is left behind to minimize operational and reputational risks."
Another threat on WatchGuard's list relates to Dortch's conversation stealing comments. Like data packets, voice packets are subject to man-in-the-middle attacks where a hacker spoofs the MAC address of two parties, and forces VoIP packets to flow through the hacker's system.
By doing so, the hacker can then reassemble voice packets and literally listen in to real-time conversations. From this type of attack, which WatchGuard calls eavesdropping, hackers can also grab all sorts of sensitive data and information, such as user names, passwords, and VoIP system information.
Rounding out WatchGuard's threat list are Voice Service Theft and Registration Hijacking.
VoIP service theft can happen when an unauthorized user gains access to a VoIP network, usually by way of a valid user name and password, or gains physical access to a VoIP device, and initiates outbound calls. Often, these are international phone calls to take advantage of VoIP's toll by-pass capabilities.
A SIP registration hijack works by a hacker disabling a valid user's SIP registration, and replacing it with the hacker's IP address instead. This allows the hacker to then intercept incoming calls and reroute, replay or terminate calls as they wish.

Article courtesy of InternetNews.com