"Obviously, releasing any security tools is a double-edged sword in that you can't restrict who has access," Dave Endler, director of security research at TippingPoint, said. Tools to test the security of Voice over Internet Protocol (VoIP) telephony systems have been released by the researchers at the Black Hat security conference.
"If you want all the CEO's calls to show up at your desk, that's what you would use," he said. Companies are taking VoIPlook systems into consideration due to their varied features, lower costs, and use of the same infrastructure as computer networks. The tools were designed to help administrators determine the vulnerability of their telephony systems, Endler said.
Each of the tools can be used to launch VoIP system attacks, such as overloading phones or VoIP exchanges with ambiguous traffic, flooding phones with calls, forcing hang-ups, rebooting phones, and reassigning the devices to other users or nobody at all, Endler, said in an interview.
Products from Cisco Systems, Avaya and Nortel Networks all are still using proprietary protocols and have not adopted the newly released tools, which target systems that use the Session Initiation Protocol (SIP) as SIP is used in VoIP systems. "The majority of VoIP systems out there are not Session Initiation Protocol (SIP) enabled," Endler said. "Most of them are pushing forward with SIP adoption." Endler and co-presenter Mark Collier of SecureLogix hope their work will help VoIP systems be more secure when SIP makes it into the major leagues, Endler said.
"VoIP security is still in its infancy," he said. The release of the tools will have little effect on VoIP users today, agreed Dan York, director of IP technology at VoIP vendor Mitel. "But we're all moving to SIP," he said. York said the tools serve a purpose. "SIP is coming into play and they give us the tools to test the systems and make them more secure," he said.
|
