VoIP Security Sanjay Kalra Juniper Networks

September 10-12, 2007 Los Angeles Convention Center Los Angeles, California 3 VoIP Issues Enterprise VoIP Service Provider IP PBX Services Other Carrier SOHO/Residential Softswitch Media Gateway Application Server Media Server OSS Softswitch Media Gateway SIP/H.323 Phones H.323/SIP Endpoints IP PBX Router SIP/H.323 Phones Data FW/NAT Cable/DSL Modem MGCP IAD POTS Phone Wireless IP Phone Mobile Phone Wireless/ Mobile Base Station Wireless/Mobile Internet or IP NW Hosted IP CentrexVoice Over Broadband (Cable, DSL) IP Network SME Router Class 5 Switch POTS Wholesale VoIP Carrier to EnterpriseCarrier to SOHO/Residential Carrier to Carrier Peering SS7 IN Network Security  DoS attacks  Service theft  Fraud  SPIT & Vishing  Protocol Vulnerabilities Address Translation  Conversion of private/public IP addresses  Firewalls challenged by small signaling/media packets  VoIP protocols not understood by all firewall’s Service Assurance  Quality of service  Admission enforcement  Lack of reporting Regulatory Compliance  E-911  Lawful intercept  CALEA support

September 10-12, 2007 Los Angeles Convention Center Los Angeles, California 4 VoIP Attack Examples Vishing – Spam from Paypal asking users to leave credit card number. Toll Fraud – 2 people convicted to toll fraud using brute force. Resold minutes stolen from VOIP carriers. DOS – Buffer Overflow in Asterisk. DOS – Session Border Controller of a carrier compromised as could not provide security

September 10-12, 2007 Los Angeles Convention Center Los Angeles, California 5 VoIP security risks en detail Enterprise VoIP Service Provider IP PBX Services Other Carrier SOHO/Residential Softswitch Media Gateway Application Server Media Server OSS Softswitch Media Gateway SIP/H.323 Phones H.323/SIP Endpoints IP PBX Router SIP/H.323 Phones Data FW/NAT Cable/DSL Modem MGCP IAD POTS Phone Wireless IP Phone Mobile Phone Wireless/ Mobile Base Station Wireless/Mobile Internet or IP NW Hosted IP CentrexVoice Over Broadband (Cable, DSL) IP Network SME Router Class 5 Switch POTS Wholesale VoIP Carrier to EnterpriseCarrier to SOHO/Residential Carrier to Carrier Peering SS7 IN Network Infrastructure (D)DoS attacks Route poisoning Traffic padding IP and ARP spoofing Session hijacking/replay VoIP protocol vulnerabilities VoIP infrastructure Server OS vulnerabilities Registration DoS attacks Invite overflows Excessive call setup rate Billing fraud Malformed protocol messages Man-in-the middle attacks DHCP/ARP spoofing VoIP content Call intercept Confidentiality issues Vishing Unwanted content Spambots collecting VoIP addresses Route server hacks can redirect calls Illegal call intercept Recording of conversations through accessing infrastructure (Ethereal records VoIP traffic as audio file)

September 10-12, 2007 Los Angeles Convention Center Los Angeles, California 6 VoIP Security Mitigation IP PBX DoS or Hacking Attacks H.323 and SIP ALGs dynamically open and close FW ports to keep network secure Back door to corporate network Combination of ALGs, firewall and zone capabilities keep data network secure Voice call intercept Encrypt VoIP connections with site- to-site VPN (DES, 3DES, AES) to prevent eavesdropping All LAN segments have voice access Zones enable separation of VoIP network elements to ensure appropriate policies are applied

September 10-12, 2007 Los Angeles Convention Center Los Angeles, California 7 Tiered Approach to security Integrated control between layers of the network Filter at the edge –Use equipment that can be controlled to filter at the edge –Don’t allow unwanted traffic into the network Provide Topology hiding at the edge –Hide all the internal network Centralised Management –Alerts come to a central place –Operator can be involved in the process Threat risk reduced by layers –If one layer misses the threat another catches it

September 10-12, 2007 Los Angeles Convention Center Los Angeles, California 8 VoIP Security Toolkit IDP to mitigate VoIP attacks Zone Based Architecture Security through Firewall ALGs Voice Eavesdropping Prevention through encryption Unauthorized Use Prevention with Policy access control Resilient VPN Connectivity with Dynamic Tunnel Failover

September 10-12, 2007 Los Angeles Convention Center Los Angeles, California 9 Defense Against VoIP Security Threats VoIP Security ThreatRamificationsDefense Technology Unauthorized access to PBX or voice mail system All voice communications fail FW with SIP attack protection IDP with SIP sigs/protocol anom DoS attack on PBX, IP Phone or gateway Hacker listens to voice mails, accesses call logs, company directories, etc. Zones, ALGs, policy-based access control Toll fraud Hacker utilizes PBX for long-distance calling, increasing costs VPNs, encryption (IPSec or other) Eavesdropping or man-in-the-middle attack Voice conversations unknowingly intercepted and altered Worms/trojans/viruses on IP phones, PBX Infected PBX and/or phones rendered useless, spread problems throughout network IDP with SIP protocol anomaly and stateful signatures SPIT (VoIP SPAM) and Vishing Lost productivity, annoyance and financial Loss ALGs, SIP attack prevention, SIP source IP limitations, UDP Flood Protection, Authentication