1. Rajeev Bevara CS-555 Security Threats in VoIP

2. What is VoIP ? ➔ VOIP - Voice Over Internet Protocol. ➔ Delivery of voice communications and multimedia sessions over Internet. ➔ It is also referred as IP telephony, Internet telephony. ➔ The first ever internet VoIP program was released in February 1995 by VocalTec Communications. ➔ As the years passed VOIP has gained substantial popularity.

3. Highlights of VOIP ★ Cheaper when compared to that of POTS - Plain Old Telephone Service. ★ We get a lot of other features with NO EXTRA COST. ○Unlimited long Distances ○Caller ID ○Voicemail ○conferencing

4. Types of VOIP services ➔ Computer-Based VOIP Service ➔ Residential VOIP Service ➔ Mobile VOIP Service ➔ Business VOIP Service and Solutions

5. Problems of VOIP VOIP phone service is less reliable and most importantly less secure when compared with ordinary phone service. ❖ Voice Quality ❖ Bandwidth Dependency ❖ Power Dependency ❖ Emergency Calls ❖ SECURITY

6. Security threats in VOIP Voice over IP Security a book published by Cisco Press identifies 4 main categories of security threats. ➢ Threats against availability ➢ Threats against confidentiality ➢ Threats against integrity ➢ Threats against social context

7. Security threats in VOIP ★ Threats against availability ○These threats aim at VOIP service interruption, typically in the form of Denial of Service (DOS). ■Call flooding ■Protocol Fuzzing ■Call hijacking ■Spoofed messages ■Server impersonating

8. Security threats in VOIP ★ Threats against confidentiality ○These threats provide unauthorized means of capturing identities, patterns and credentials ■Eavesdropping ■Call Pattern Tracking ■Data Mining ■Reconstruction

9. Security threats in VOIP ★ Threats against integrity ○These threats allow alteration of initial message and medias in the middle of the network ■Message Alteration ●Call rerouting ●Call Black holing ■Media Alteration ●Media Injection ●Media Degrading

10. Security threats in VOIP ★ Threats against social context ○These threat allow attackers to misrepresent himself as a trusted entity ■VOIP Phishing aka Vishing ■Registration hijacking ■SPIT (Spam over Internet Telephony)

11. Summary VoIP is a relatively new technology. It is still considerably insecure than ordinary phone services. It has to deal with all the security problems of traditional data network plus the new security problem caused by new protocols and components. Businesses and individuals need to take necessary precautions when using this technology.

12. Questions ???

13. References ➔ http://www.cisco.com/cisco/web/solutions/small_business/resource_center/articles/connect_ employees_and_offices/what_voip_can_do_for_you/index.html http://www.cisco.com/cisco/web/solutions/small_business/resource_center/articles/connect_ employees_and_offices/what_voip_can_do_for_you/index.html ➔ http://www.sans.org/reading-room/whitepapers/voip/security-issues-countermeasure-voip- 1701 http://www.sans.org/reading-room/whitepapers/voip/security-issues-countermeasure-voip- 1701 ➔ http://en.wikipedia.org/wiki/Voice_phishing http://en.wikipedia.org/wiki/Voice_phishing ➔ http://voip.nyquist.ro/docs/Registration_hijacking_060105.pdf http://voip.nyquist.ro/docs/Registration_hijacking_060105.pdf ➔ http://www.techopedia.com/definition/13320/spam-over-internet-telephony-spit http://www.techopedia.com/definition/13320/spam-over-internet-telephony-spit ➔ Patrick Park, (2008)Voice over IP Security. Security best practices derived from deep analysis of the latest network threats, Cisco Press.