SlideShare a Scribd company logo

I N T E R O P09 Suhas Desai Secure Your Vo I P Network With Open Source

•
•
Suhas Desai
Suhas Desai

The document discusses securing VoIP networks with open source tools. It describes how open source testing tools like SiVuS and SIP Bomber can be used to assess the security of VoIP implementations. SiVuS is a vulnerability scanner that discovers SIP components, generates attack messages, and produces a security findings report. SIP Bomber tests SIP protocol implementations by generating messages and validating passwords. The document advocates using open source tools to securely configure servers, clients, gateways, and firewalls before deploying VoIP networks.

Related slideshows

The Art of VoIP Hacking - Defcon 23 Workshop
The Art of VoIP Hacking - Defcon 23 WorkshopThe Art of VoIP Hacking - Defcon 23 Workshop
The Art of VoIP Hacking - Defcon 23 Workshop
 
Technical Sheet - PrivateGSM VoIP - english
Technical Sheet - PrivateGSM VoIP - englishTechnical Sheet - PrivateGSM VoIP - english
Technical Sheet - PrivateGSM VoIP - english
 
Hacking SIP Like a Boss!
Hacking SIP Like a Boss!Hacking SIP Like a Boss!
Hacking SIP Like a Boss!
 
1 of 19
Download to read offline
Secure Your VoIP Network with Open Source Suhas Desai www.interop.com/mumbai Friday, 9 October 2009, 12:15–01:30 PM, Bombay Exhibition Centre 10/12/2009 Track: Emerging Technology and Trends - Open Source
Agenda About VoIP Security Open Source Testing Tools Sample Testing Approach Summary Confidential © Tech Mahindra 2008 2
Agenda About VoIP Security Open Source Testing Tools Sample Testing Approach Summary Confidential © Tech Mahindra 2008 3
VoIP Overview Introduction to VoIP  VoIP is being rapidly embraced across most markets as an alternative to the traditional PSTN  VoIP deployment can impact applications, networks and infrastructure that use a wide variety of platform base  The cost savings of VoIP as compared to that of circuit switched networks is encouraging companies to move to VoIP Issues and Concerns  VoIP deployment has brought along with it many security concerns like Non- Repudiation, Authentication, Call Quality, Integrity and Privacy  VoIP calls to PSTN are not allowed in India Confidential © Tech Mahindra 2008 4
VoIP Security Threats & Impact VoIP Security Threats • An attacker tries to break telephone network and uses this network Phreaking for malicious activities like making long calls or to tap conversions. Eavesdropping • An attacker tries to intercept telephone lines with electronic devices. • Voice Phishing is used to leverage VoIP technology for social Vishing engineering to retrieve confidential information like credit card numbers, financial details. SPIT • Spamming over Internet Telephony is like e-mail spamming where VoIP calls are sent as a spam to victim. Impact  Loss of Confidentiality, Integrity and Authentication  Loss of Privacy  Non-repudiation  Social Threats  QoS Confidential © Tech Mahindra 2008 5
Possible Mitigation Considerations Deploy VoIP traffic monitors •Monitor the connections for logging the fraudulent activities. Employ encryption techniques •Strong encryption techniques allow privacy and confidentiality over the network. Use voice firewalls •Control inbound and outbound connections by filtering the traffic. Use adequate security infrastructure •Deploy secure gateways, gatekeepers & proxy servers to protect network traffic. Use IPsec tunneling •IPsec provides the secure communication over network by providing authentication and encryption. Conduct regular security audits •Audit VoIP network regularly for security vulnerabilities . Use VoIP platforms with adequate security features •Prefer proven VoIP platform with built in security features for development and deployment of VoIP applications. Confidential © Tech Mahindra 2008 6
Agenda About VoIP Security Open Source Testing Tools Sample Testing Approach Summary Confidential © Tech Mahindra 2008 7
Commercial Security Tools Need to perform security assessment of VoIP network with below tools! Commercial Security Testing Tools Tool Description CommView VoIP Analyzer Captures Real-time VoIP events. Etherpeek Sniffs VoIP traffic. EnableSecurity VoIPPack for CANVAS Performs scans, enumeration, and password attacks. Detects the actual protocol, administrative interfaces and VoIP Passive Vulnerability Scanner scanner(s). VoIPAudit VoIP vulnerability scanner. SiPBlast Tests VoIP infrastructure. NSAUDITOR SIP UDP traffic generator / flooder . Codenomicon VoIP Fuzzers Commercial versions of the free PROTOS toolset. Mu Dynamics VoIP, IPTV, IMS Fuzzing Platform Fuzzing appliance for SIP, Diameter, H.323 and MGCP protocols. Spirent ThreatEx Protocol Fuzzer and robustness tester. SiPCPE Evaluates SIP infrastructure protocol. Confidential © Tech Mahindra 2008 8
Open Source and VoIP Why Open Source?  Source code available  Easy to customize, code reuse and redistributable.  Cost Savings Open Source Tools SIP Proxies SIP Clients Mini-SIP-Proxy, MjServer, MySIPSwitch, Cockatoo, Ekiga, FreeSWITCH, JPhone, Kphone, NethidPro3.0.6, Net-SIP, JAIN-SIP Linphone, minisip,MjUA, OpenSIPStack, OpenZoep, Proxy,OpenSBC,OpenSER, PJSUA, QuteCom ex-Open Wengo, SFLphone, OpenSIPS, partysip, SaRP, sipd, SIPExpress Router, Shtoom, SipToSis, sipXezPhone, sipXphone, Twinkle, Siproxd, SIPVicious, sipX, Vocal, Yxa. YATE, YeaPhone. SIP Tools H.323 Clients Callflow, Open Source Asterisk AMI, pjsip-perf, miTester for SIP,PROTOS Test Suite, FGnomeMeeting, ohphoneX,OpenPhone SFTF, SIP CallerID, SIPbomber, Sipp, Sipper, SIP Proxy, Sipsak, SIP Soft client, SIPVicious tool suite, SMAP, Vovida.org load balancer. H.323 Gatekeeper RTP Proxies GNU Gatekeeper AG Projects,Maxim Sobolev's RTPproxy,MediaProxy. Confidential © Tech Mahindra 2008 9
Contd… PBX Platforms Security Testing Tools Asterisk, CallWeaver, OpenPBX, VoIP Sniffing Tools PBX4Linux, SIPexchange PBX Pingtel's AuthTool, Cain & Abel, Oreka, PSIPDump, rtpBreak , SIP PBX, sipwitch,sipX. SIPomatic, SIPv6 Analyzer, UCSniff, VoiPong, VoIPong ISO Bootable, VOMIT , WIST. VoIP Scanning and Enumeration Tools: IVR Platforms enumIAX, iaxscan, iWar, SCTPScan, Bayonne, CT Server, OpenVXI,SEMS, sipX PBX, SIP Forum Test Framework (SFTF), SIP-Scan, VoiceXML SIPcrack, Sipflanker, SIPSCAN , SiVuS, SMAP. VoiceMail Servers VoIP Packet Flooding Tools: IAXFlooder, INVITE Flooder, kphone-ddos , RTP Flooder, Scapy, SIPBomber, SIPsak, SIPp . Lintad, OpenUMS, SEMS,VOCP. Fax Servers VoIP Fuzzing Tools: Asteroid, PROTOS H.323 Fuzzer, PROTOS SIP Fuzzer Asterisk Fax Email Gateway, Lintad,Hylafax. VoIP Signaling Manipulation Tools: Development Platforms BYE Teardown, SipRogue, VoIPHopper H323plus, OpenBloX, Ooh323c, ++Skype. Confidential © Tech Mahindra 2008 10
Best Practices for Using Open Source Tools Monitor VoIP traffic • Continuously monitor VoIP traffic to identify VoIP attacks. Use tools - SIP-Scan, SiVuS , SMAP etc. Use encryption • Apply encryption for end points communication. Use SRTP (Secure Real Time Protocol). Use Firewalls • Put VoIP network before open source firewalls. Use firewalls - iptables. Conduct security audits • Audit VoIP network regularly for security vulnerabilities and configuration flaws. Use - VoIP Security Audit Program (VSAP). Secure gateways, gatekeepers • Control the number of concurrent connections for proper utilize bandwidth. Secure proxy servers • Authenticate authorized access control. Use Asterisk. Use IPsec tunneling • Ipsec provides secure communication over the public networks. Secure VoIP platforms • Prefer VoIP platform with built in security features for development and deployment of VoIP applications Confidential © Tech Mahindra 2008 11
Contd… Open source products/tools provides options for :  Secure configuration of servers  Secure configuration of clients  Securing gateways  Securing Firewalls VOIP/SIP Security Assessment with Open Source before deployment : VoIP Security Footprinting Scanning Testing Eavesdropping SiVuS Nessus •Cain and Abel •VoIPong •vomit Fuzzing nmap SiVuS •PROTOS SIP fuzzing suite SIP Protocol Testing •SIP Bomber
Agenda About VoIP Security Open Source Testing Tools Sample Testing Approach Summary Confidential © Tech Mahindra 2008 13
Example 1 : SiVuS Security assessment with SiVuS tool  SiVuS  SiVuS is the vulnerability scanner for VoIP networks that use the SIP protocol.  The scanner provides several powerful features to verify the robustness and secure implementation of a SIP component.  SiVuS is used to verify the robustness and security of their SIP implementations by generating the attacks that are included in the SiVuS database or by crafting their own SIP messages using the SIP message generator. 1. SIP Component Discovery 2. Message Generator Confidential © Tech Mahindra 2008 14
Example 1 : SiVuS Security assessment with SiVuS tool 3. Security Findings Report Confidential © Tech Mahindra 2008 15
Example 2 : SIP Bomber Security assessment with SIP Bomber  SIP Bomber:  SIP Bomber is used to test SIP-protocol implementation.  SIP Bomber is complied on Linux machines with asterisk server for testing of SIP server implementation. 1. Message Generator 2. Password Validation Confidential © Tech Mahindra 2008 16
Agenda About VoIP Security Open Source Testing Tools Sample Testing Approach Summary Confidential © Tech Mahindra 2008 17
Summary  Building VoIP network with open source is cost effective and reliable.  VoIP network can be secured with open source tools, its configurations and settings.  Tools like SiVuS and SIP Bomber can be used to assess your VoIP security. References Web • http://www.voipsa.org • http://www.voip-info.org Books • Patrick Park;”Voice over IP Security” - Ciscopress. • Thomas Porter, Jan Kanclirz Jr;”Practical VoIP Security” - Syngress Publishing, Inc. • James Ransome and John Rittinghouse;”Voice over Internet Protocol Security” - Elsevier • Alan B. Johnston, David M. Piscitello;”Understanding Voice over IP Security” -Artech House Confidential © Tech Mahindra 2008 18
Thank You !!

More Related Content

I N T E R O P09 Suhas Desai Secure Your Vo I P Network With Open Source

  • 1. Secure Your VoIP Network with Open Source Suhas Desai www.interop.com/mumbai Friday, 9 October 2009, 12:15–01:30 PM, Bombay Exhibition Centre 10/12/2009 Track: Emerging Technology and Trends - Open Source
  • 2. Agenda About VoIP Security Open Source Testing Tools Sample Testing Approach Summary Confidential © Tech Mahindra 2008 2
  • 3. Agenda About VoIP Security Open Source Testing Tools Sample Testing Approach Summary Confidential © Tech Mahindra 2008 3
  • 4. VoIP Overview Introduction to VoIP  VoIP is being rapidly embraced across most markets as an alternative to the traditional PSTN  VoIP deployment can impact applications, networks and infrastructure that use a wide variety of platform base  The cost savings of VoIP as compared to that of circuit switched networks is encouraging companies to move to VoIP Issues and Concerns  VoIP deployment has brought along with it many security concerns like Non- Repudiation, Authentication, Call Quality, Integrity and Privacy  VoIP calls to PSTN are not allowed in India Confidential © Tech Mahindra 2008 4
  • 5. VoIP Security Threats & Impact VoIP Security Threats • An attacker tries to break telephone network and uses this network Phreaking for malicious activities like making long calls or to tap conversions. Eavesdropping • An attacker tries to intercept telephone lines with electronic devices. • Voice Phishing is used to leverage VoIP technology for social Vishing engineering to retrieve confidential information like credit card numbers, financial details. SPIT • Spamming over Internet Telephony is like e-mail spamming where VoIP calls are sent as a spam to victim. Impact  Loss of Confidentiality, Integrity and Authentication  Loss of Privacy  Non-repudiation  Social Threats  QoS Confidential © Tech Mahindra 2008 5
  • 6. Possible Mitigation Considerations Deploy VoIP traffic monitors •Monitor the connections for logging the fraudulent activities. Employ encryption techniques •Strong encryption techniques allow privacy and confidentiality over the network. Use voice firewalls •Control inbound and outbound connections by filtering the traffic. Use adequate security infrastructure •Deploy secure gateways, gatekeepers & proxy servers to protect network traffic. Use IPsec tunneling •IPsec provides the secure communication over network by providing authentication and encryption. Conduct regular security audits •Audit VoIP network regularly for security vulnerabilities . Use VoIP platforms with adequate security features •Prefer proven VoIP platform with built in security features for development and deployment of VoIP applications. Confidential © Tech Mahindra 2008 6
  • 7. Agenda About VoIP Security Open Source Testing Tools Sample Testing Approach Summary Confidential © Tech Mahindra 2008 7
  • 8. Commercial Security Tools Need to perform security assessment of VoIP network with below tools! Commercial Security Testing Tools Tool Description CommView VoIP Analyzer Captures Real-time VoIP events. Etherpeek Sniffs VoIP traffic. EnableSecurity VoIPPack for CANVAS Performs scans, enumeration, and password attacks. Detects the actual protocol, administrative interfaces and VoIP Passive Vulnerability Scanner scanner(s). VoIPAudit VoIP vulnerability scanner. SiPBlast Tests VoIP infrastructure. NSAUDITOR SIP UDP traffic generator / flooder . Codenomicon VoIP Fuzzers Commercial versions of the free PROTOS toolset. Mu Dynamics VoIP, IPTV, IMS Fuzzing Platform Fuzzing appliance for SIP, Diameter, H.323 and MGCP protocols. Spirent ThreatEx Protocol Fuzzer and robustness tester. SiPCPE Evaluates SIP infrastructure protocol. Confidential © Tech Mahindra 2008 8
  • 9. Open Source and VoIP Why Open Source?  Source code available  Easy to customize, code reuse and redistributable.  Cost Savings Open Source Tools SIP Proxies SIP Clients Mini-SIP-Proxy, MjServer, MySIPSwitch, Cockatoo, Ekiga, FreeSWITCH, JPhone, Kphone, NethidPro3.0.6, Net-SIP, JAIN-SIP Linphone, minisip,MjUA, OpenSIPStack, OpenZoep, Proxy,OpenSBC,OpenSER, PJSUA, QuteCom ex-Open Wengo, SFLphone, OpenSIPS, partysip, SaRP, sipd, SIPExpress Router, Shtoom, SipToSis, sipXezPhone, sipXphone, Twinkle, Siproxd, SIPVicious, sipX, Vocal, Yxa. YATE, YeaPhone. SIP Tools H.323 Clients Callflow, Open Source Asterisk AMI, pjsip-perf, miTester for SIP,PROTOS Test Suite, FGnomeMeeting, ohphoneX,OpenPhone SFTF, SIP CallerID, SIPbomber, Sipp, Sipper, SIP Proxy, Sipsak, SIP Soft client, SIPVicious tool suite, SMAP, Vovida.org load balancer. H.323 Gatekeeper RTP Proxies GNU Gatekeeper AG Projects,Maxim Sobolev's RTPproxy,MediaProxy. Confidential © Tech Mahindra 2008 9
  • 10. Contd… PBX Platforms Security Testing Tools Asterisk, CallWeaver, OpenPBX, VoIP Sniffing Tools PBX4Linux, SIPexchange PBX Pingtel's AuthTool, Cain & Abel, Oreka, PSIPDump, rtpBreak , SIP PBX, sipwitch,sipX. SIPomatic, SIPv6 Analyzer, UCSniff, VoiPong, VoIPong ISO Bootable, VOMIT , WIST. VoIP Scanning and Enumeration Tools: IVR Platforms enumIAX, iaxscan, iWar, SCTPScan, Bayonne, CT Server, OpenVXI,SEMS, sipX PBX, SIP Forum Test Framework (SFTF), SIP-Scan, VoiceXML SIPcrack, Sipflanker, SIPSCAN , SiVuS, SMAP. VoiceMail Servers VoIP Packet Flooding Tools: IAXFlooder, INVITE Flooder, kphone-ddos , RTP Flooder, Scapy, SIPBomber, SIPsak, SIPp . Lintad, OpenUMS, SEMS,VOCP. Fax Servers VoIP Fuzzing Tools: Asteroid, PROTOS H.323 Fuzzer, PROTOS SIP Fuzzer Asterisk Fax Email Gateway, Lintad,Hylafax. VoIP Signaling Manipulation Tools: Development Platforms BYE Teardown, SipRogue, VoIPHopper H323plus, OpenBloX, Ooh323c, ++Skype. Confidential © Tech Mahindra 2008 10
  • 11. Best Practices for Using Open Source Tools Monitor VoIP traffic • Continuously monitor VoIP traffic to identify VoIP attacks. Use tools - SIP-Scan, SiVuS , SMAP etc. Use encryption • Apply encryption for end points communication. Use SRTP (Secure Real Time Protocol). Use Firewalls • Put VoIP network before open source firewalls. Use firewalls - iptables. Conduct security audits • Audit VoIP network regularly for security vulnerabilities and configuration flaws. Use - VoIP Security Audit Program (VSAP). Secure gateways, gatekeepers • Control the number of concurrent connections for proper utilize bandwidth. Secure proxy servers • Authenticate authorized access control. Use Asterisk. Use IPsec tunneling • Ipsec provides secure communication over the public networks. Secure VoIP platforms • Prefer VoIP platform with built in security features for development and deployment of VoIP applications Confidential © Tech Mahindra 2008 11
  • 12. Contd… Open source products/tools provides options for :  Secure configuration of servers  Secure configuration of clients  Securing gateways  Securing Firewalls VOIP/SIP Security Assessment with Open Source before deployment : VoIP Security Footprinting Scanning Testing Eavesdropping SiVuS Nessus •Cain and Abel •VoIPong •vomit Fuzzing nmap SiVuS •PROTOS SIP fuzzing suite SIP Protocol Testing •SIP Bomber
  • 13. Agenda About VoIP Security Open Source Testing Tools Sample Testing Approach Summary Confidential © Tech Mahindra 2008 13
  • 14. Example 1 : SiVuS Security assessment with SiVuS tool  SiVuS  SiVuS is the vulnerability scanner for VoIP networks that use the SIP protocol.  The scanner provides several powerful features to verify the robustness and secure implementation of a SIP component.  SiVuS is used to verify the robustness and security of their SIP implementations by generating the attacks that are included in the SiVuS database or by crafting their own SIP messages using the SIP message generator. 1. SIP Component Discovery 2. Message Generator Confidential © Tech Mahindra 2008 14
  • 15. Example 1 : SiVuS Security assessment with SiVuS tool 3. Security Findings Report Confidential © Tech Mahindra 2008 15
  • 16. Example 2 : SIP Bomber Security assessment with SIP Bomber  SIP Bomber:  SIP Bomber is used to test SIP-protocol implementation.  SIP Bomber is complied on Linux machines with asterisk server for testing of SIP server implementation. 1. Message Generator 2. Password Validation Confidential © Tech Mahindra 2008 16
  • 17. Agenda About VoIP Security Open Source Testing Tools Sample Testing Approach Summary Confidential © Tech Mahindra 2008 17
  • 18. Summary  Building VoIP network with open source is cost effective and reliable.  VoIP network can be secured with open source tools, its configurations and settings.  Tools like SiVuS and SIP Bomber can be used to assess your VoIP security. References Web • http://www.voipsa.org • http://www.voip-info.org Books • Patrick Park;”Voice over IP Security” - Ciscopress. • Thomas Porter, Jan Kanclirz Jr;”Practical VoIP Security” - Syngress Publishing, Inc. • James Ransome and John Rittinghouse;”Voice over Internet Protocol Security” - Elsevier • Alan B. Johnston, David M. Piscitello;”Understanding Voice over IP Security” -Artech House Confidential © Tech Mahindra 2008 18