With more organisations turning to Voice over Internet Protocol (VoIP) and cloud-based Unified Communications (UC) systems to underpin their commercial services and corporate communications, IT response and security testing teams are struggling to keep pace with the VoIP attack surface and growing number of threats in the wild. So says Fatih Ozavci from Context Information Security, speaking at the recent Black Hat USA conference.
“A lack of understanding of modern VoIP and UC security, means that many service providers and businesses are leaving themselves at risk to threat actors repurposing this exposed infrastructure for attacks such as botnets, malware distribution, vishing, DoS and toll fraud,” said Ozavci.
Fatih Ozavci is a managing consultant with Context Information Security and the author of the Viproy VoIP Pen-Test Kit, Viproxy MITM analyser and the VoIP Wars research series. He has 15 years’ experience in information security as a leading security consultant, researcher and instructor.
Ozavci points to potential vulnerabilities in major UC product suites and IMS platforms, such as bypassing security measures, injecting malicious content to messaging, caller identity spoofing and billing bypass, along with problems caused by insecure configurations.
“By exploiting these vulnerabilities, attackers could gain unauthorised access to client systems or communication services such as conference and collaboration, voicemail, SIP trunks and instant messaging,” Ozavci added.
The BlackHat presentation highlights weaknesses in UC messaging, federated communications and collaboration services that could be used to gain unauthorised access to the UC environment and client systems, as well as attacking client systems using signaling protocols and messaging. “These attacks can be used to compromise the client systems connected using protocol and software vulnerabilities,” said Ozavci, adding, “Dial plans, misconfigured SIP trunks, conference and network infrastructures are also major targets for advanced attacks.”
The Context researcher has also looked at media transport protocols such as (S)RTP for voice calls, file, desktop and presentation sharing. The media transmitted may have confidential or sensitive information, which can be an object of PCI, COBIT or compliance requirements such as credit card information on calls to IVR services or customer privacy information.
“Due to insecure encryption and design issues, sensitive information in the media that’s been transmitted can be exposed and compromised,” Ozavci concluded.
To help raise awareness of these VoIP and UC vulnerabilities, Ozavci has developed open source tools Viproxy and Viproy that can be used for VoIP penetration testing.
Comment on this article below or via Twitter: @ VanillaPlus OR @jcvplus
