VOIP now faces many threats

By Staff Writer for KSS

Johannesburg, 13 Aug 2008

The proliferation of (VOIP) has shrunk the world to a global village, enabling users to reach out to their loved ones, colleagues, business partners and friends in a cost-effective and easy-to-use manner, explains Simjee.

"However," he warns. "This proliferation is accompanied by security threats as cyber criminals continue to develop more sophisticated means of violating our privacy and exploiting our information vulnerabilities."

Different attacks

According to Simjee, the most significant threat to VOIP today is denial of service (DoS) as this can bring an entire network to its knees and shut down all applications running on it, which includes voice.

Furthermore, the increasing adoption of session initiation protocol (SIP) for VOIP is expected to open up a whole new front in the security war, he says. |SIP is a relatively new protocol which offers little inherent security," he says.

Spit, says Simjee, is the voice incarnation of the bane of e-mail - spam - and stands for 'spam over internet telephony'.

"Up to now there have not been many instances of Spit but it has the potential to become a major problem. Spit could be generated in a similar way to e-mail spam with botnets targeting millions of VOIP users from compromised machines," cautions Simjee.

Vishing uses telephony to obtain information such as account detail directly from users, explains Simjee. "|ne of the first reported cases was Vishers' favourite target PayPal. The scam was a true multi-channel attack," he says.

Furthermore, like any IP system, a VOIP network is vulnerable to hackers, says Simjee. "Essentially, VOIP service providers use a prefix on the IP packets to identify their own calls. Therefore, by sending millions fake test calls these hackers could determine which prefixes had access to the network. Once they had determined the prefix they were able to send calls through those service providers' networks and sell these minutes through front companies," he explains.

Finally, by reassembling the packets into speech hackers can eavesdrop on media streams and intercept VOIP packets to obtain sensitive information. "One way for hackers to do this is through a man-in-the-middle attack, where a third party spoofs the MAC addresses of the two speaking parties, to force the IP packets to flow through the hackers' system."