VoIP Wars: Attack of the Cisco Phones
|
|
|
- Willa Elliott
- 8 years ago
- Views:
Transcription
1 VoIP Wars: Attack of the Cisco Phones Compliance, Protection & Business Confidence Sense of Security Pty Ltd Sydney Level 8, 66 King Street Melbourne Level 10, 401 Docklands Drv T: T: +61 (0) info@senseofsecurity.com.au Sydney NSW 2000 Australia Docklands VIC 3008 Australia F: +61 (0) ABN: Sense of Security 2013 Page # 13-Sep-13
2 Speaker Fatih Ozavci Senior Security Consultant Interests VoIP Mobile Applications Network Infrastructure Author of Viproy VoIP Penetration Testing Kit Public Speaker Defcon, BlackHat Arsenal, AusCert, Ruxcon Sense of Security 2014 Page 2 of 60 Aug-14
3 Viproy VoIP Toolkit Viproy is a Vulcan-ish Word that means "Call" Viproy VoIP Penetration and Exploitation Kit Testing modules for Metasploit, MSF license Old techniques, new approach SIP library for new module development Custom header support, authentication support Trust analyser, SIP proxy bounce, MITM proxy, Skinny Modules Options, Register, Invite, Message Brute-forcers, Enumerator SIP trust analyser,sip proxy, Fake service Cisco Skinny analysers Cisco UCM/UCDM exploits Sense of Security 2014 Page 3 of 60 Aug-14
4 Agenda Hosted VoIP 101 Network Attacks Attacking SIP Attacking CUCDM Attacking CUCM Attacking Clients Attacking Skinny Sense of Security 2014 Page 4 of 60 Aug-14
5 Hosted VoIP services Sense of Security 2014 Page 5 of 60 Aug-14
6 Hosted VoIP environment Vendors are Cisco and VOSS Solutions Web based services IP Phone services (Cisco, VOSS* IP Phone XML Services) Tenant client services management (VOSS* Selfcare) Tenant* services management (VOSS* Domain Manager) VoIP services Skinny (SCCP) services for Cisco phones SIP services for other tenant phones RTP services for media streaming PBX/ISDN gateways, network equipment * Tenant => Customer of hosted VoIP service * VOSS => VOSS Solutions, hosted VoIP provider & Cisco partner * VOSS a.k.a Voice Over Super Slick, created by Jason Ostrom Sense of Security 2014 Page 6 of 60 Aug-14
7 Discovery for hosted VoIP networks Discover VoIP network configuration, design and requirements Find Voice VLAN and gain access Gain access using PC port on IP Phone Understand the switching security for: Main vendor for VoIP infrastructure Network authentication requirements VLAN ID and requirements IP Phone management services Supportive services in use Sense of Security 2014 Page 7 of 60 Aug-14
8 Protected and isolated? Sense of Security 2014 Page 8 of 60 Aug-14
9 Switching manipulation Attack Types PC Ports of the IP phone and handsets CDP sniffing/spoofing for Voice VLAN DTP and VLAN Trunking Protocol attacks ARP spoofing for MITM attacks DHCP spoofing & snooping Persistent access Tapberry Pi (a.k.a berry-tap) Tampered phone Power over ethernet (PoE) 3G/4G for connectivity Sense of Security 2014 Page 9 of 60 Aug-14
10 How to make your own Tapberry Pi RJ45 Connection Pins Sense of Security 2014 Page 10 of 60 Aug-14
11 How to make your own Tapberry Pi Speaker Power Patch the Cat5 cable Sense of Security 2014 Page 11 of 60 Aug-14
12 Attacking the TFTP server Obtaining configuration files for MAC addresses SEPDefault.cnf, SEPXXXXXXXXXXXX.cnf.xml SIPDefault.cnf, SIPXXXXXXXXXXXX.cnf.xml Identifying SIP, Skinny, RTP and web settings Finding IP phone software and updates Configuration files may contain credentials Digital signature/encryption usage for files Tip: TFTPTheft, Metasploit, Viproy TFTP module Sense of Security 2014 Page 12 of 60 Aug-14
13 Configuration file content <deviceprotocol>sccp</deviceprotocol> <sshuserid></sshuserid> <sshpassword></sshpassword> <webaccess>1</webaccess> <settingsaccess>1</settingsaccess> <sidetonelevel>0</sidetonelevel> <spantopcport>1</spantopcport> <sshaccess>1</sshaccess> <phonepassword></phonepassword> Sense of Security 2014 Page 13 of 60 Aug-14
14 Becoming the TFTP server Send fake configurations for HTTP server IP phone management server SIP server and proxy Skinny server RTP server and proxy Deploy SSH public keys for SSH on IP Phones Update custom settings of IP Phones Deploy custom OS update and code execution Tip: Metasploit TFTP & FakeDNS servers, Viproxy Sense of Security 2014 Page 14 of 60 Aug-14
15 Cisco Hosted Collaboration Suite Cisco UC Domain Manager VOSS IP Phone XML services VOSS Self Care customer portal VOSS Tenant services management Cisco UC Manager Cisco Unified Dialed Number Analyzer Cisco Unified Reporting Cisco Unified CM CDR Analysis and Reporting Multiple Vulnerabilities in Cisco Unified Communications Domain Manager CiscoSecurityAdvisory/cisco-sa cucdm Sense of Security 2014 Page 15 of 60 Aug-14
16 VOSS Self Care Tenant user services Password & PIN management Voic configuration Presence Corporate Directory access Extension mobility Weaknesses Cross-site scripting vulnerabilities Sense of Security 2014 Page 16 of 60 Aug-14
17 Account details stored XSS Sense of Security 2014 Page 17 of 60 Aug-14
18 VOSS domain manager Tenant administration services User management Location and dial plan management CLI and number translation configuration Weaknesses User enumeration Privilege escalation vulnerabilities Cross-site scripting vulnerabilities SQL injections and SOAP manipulations Sense of Security 2014 Page 18 of 60 Aug-14
19 Errors, Information Leakage /emapp/emappservlet?device=user /bvsm/iptusermgt/disassociateuser.cgi Sense of Security 2014 Page 19 of 60 Aug-14
20 Insecure File Upload /bvsm/iptbulkadmin /bvsm/iptbulkloadmgt/bulkloaduploadform.cgi Sense of Security 2014 Page 20 of 60 Aug-14
21 Privilege Escalation /bvsm/iptusermgt/moduser.cgi (stored XSS, change users role) /bvsm/iptadminusermgt/adduserform.cgi?user_type=adminuser /bvsm/iptnumtransmgt/editnumbertranslationform.cgi?id=1 Sense of Security 2014 Page 21 of 60 Aug-14
22 IP Phone management VOSS IP Phone XML services Shared service for all tenants Call forwarding (Skinny has, SIP has not) Speed dial management Voic PIN management Services speeddials changepinform showcallfwd callfwdmenu Actions CallForwardAll CallForwardBusy Sense of Security 2014 Page 22 of 60 Aug-14
23 IP Phone management Authentication and Authorisation free MAC address is sufficient Jailbreaking tenant services Viproy Modules Call Forwarding Speed Dial Sense of Security 2014 Page 23 of 60 Aug-14
24 Demonstration of VOSS attacks Sense of Security 2014 Page 24 of 60 Aug-14
25 Unified Communications Forget TDM and PSTN SIP, Skinny, H.248, RTP, MSAN/MGW Smart customer modems & phones Cisco UCM Linux operating system Web based management services VoIP services (Skinny, SIP, RTP) Essential network services (TFTP, DHCP) Call centre, voic , value added services Sense of Security 2014 Page 25 of 60 Aug-14
26 Discovering VoIP servers Looking for Signalling servers (e.g. SIP, Skinny, H.323, H.248) Proxy servers (e.g. RTP, SIP, SDP) Contact Centre services Voic and integration Call recordings, call data records, log servers Discovering Operating systems, versions and patch level Management services (e.g. SNMP, Telnet, HTTP, SSH) Weak or default credentials Sense of Security 2014 Page 26 of 60 Aug-14
27 Attacking SIP services Essential analysis Registration and invitation analysis User enumeration, brute force for credentials Discovery for SIP trunks, gateways and trusts Caller ID spoofing (w/wo register or trunk) Advanced analysis Finding value added services and voic SIP trust hacking SIP proxy bounce attack Sense of Security 2014 Page 27 of 60 Aug-14
28 Cisco specific SIP registration Extensions (e.g. 1001) MAC address in Contact field SIP digest authentication (user + password) SIP x.509 authentication All authentication elements must be valid Good news, we have SIP enumeration inputs Warning: 399 bhcucm "Line not configured Warning: 399 bhcucm "Unable to find device/user in database" Warning: 399 bhcucm "Unable to find a device handler for the request received on port from Warning: 399 bhcucm "Device type mismatch" Sense of Security 2014 Page 28 of 60 Aug-14
29 Register and Subscribe Register / Subscribe (FROM, TO, Credentials) Sense of Security 2014 Page 29 of 60 Aug-14
30 Invite, CDR and Billing tests Invite / Ack / Re-Invite / Update (FROM, TO, VIA, Credentials) Sense of Security 2014 Page 30 of 60 Aug-14
31 SIP Proxy Bounce attack Sydney Production SIP Service Melbourne Brisbane SIP Proxy Bounce Attacks SIP trust relationship hacking Attacking inaccessible servers Attacking the SIP software and protocol Software, Version, Type, Realm Sense of Security 2014 Page 31 of 60 Aug-14
32 Denial of Service attacks Sydney Production SIP Service IP spoofed UDP SIP request Melbourne Brisbane SIP based DoS attacks UDP vulnerabilities and IP spoofing Too many errors, very very verbose mode ICMP errors Alderaan Sense of Security 2014 Page 32 of 60 Aug-14
33 Hacking SIP trust relationships Sydney Production SIP Service UDP Trust Melbourne Brisbane IP spoofed UDP SIP request From field has IP and Port Universal Trust Tatooine Send INVITE/MESSAGE requests with IP spoofing (source is Brisbane), from field contains Spoofed IP and Port, the caller ID will be your trusted host. Sense of Security 2014 Page 33 of 60 Aug-14
34 Attacking a client using SIP trust Sydney Production SIP Service UDP Trust Melbourne Brisbane IP spoofed UDP SIP request From field has bogus characters Universal Trust It s a TRAP Tatooine Send INVITE/MESSAGE requests with IP spoofing (source is Brisbane), from field contains special number, you will have fun or voic access. Sense of Security 2014 Page 34 of 60 Aug-14
35 Toll fraud for CUCM Cisco UCM accepts MAC address as identity No authentication (secure deployment?) Rogue SIP gateway with no authentication Caller ID spoofing with proxy headers Via field, From field P-Asserted-Identity, P-Called-Party-ID P-Preferred-Identity ISDN Calling Party Number, Remote-Party-ID* Billing bypass with proxy headers P-Charging-Vector (Spoofing, Manipulating) Re-Invite, Update (With/Without P-Charging-Vector) * Sense of Security 2014 Page 35 of 60 Aug-14
36 Remote-Party-ID header Source: Cisco CUCM SIP Line Messaging Guide Sense of Security 2014 Page 36 of 60 Aug-14
37 Caller ID spoofing on CUCM Remote-Party-ID header Remote-Party-ID: What for? Caller ID spoofing Billing bypass Accessing voic 3rd party operators Sense of Security 2014 Page 37 of 60 Aug-14
38 Caller ID fraud for all operators? Telecom operators trust source Caller ID One insecure operator to rule them all Sense of Security 2014 Page 38 of 60 Aug-14
39 Fake Caller ID for messages? Call me back function on voic / calls Sending many spoofed messages for DoS Overseas? Roaming? Social engineering (voic notification) Value added services Add a data package to my line Subscribe me to a new mobile TV service Reset my password/pin/2fa Group messages, celebrations Sense of Security 2014 Page 39 of 60 Aug-14
40 Demonstration of SIP attacks Sense of Security 2014 Page 40 of 60 Aug-14
41 VoIP client security Different Client Types Mobile, Desktop, Teleconference, Handsets Information Disclosure Unnecessary services and ports (SNMP, FTP) Weak management services (Telnet, SSH, HTTP) Stored credentials and sensitive information Unauthorised Access Password or TFTP attacks, enforced upgrades Weak VoIP Services Clients may accept direct invite, register or notify Sense of Security 2014 Page 41 of 60 Aug-14
42 Cisco VoIP clients Cisco IP Phones Cisco IP Communicator Cisco Unified Personal Communicator Cisco Webex Client Cisco Jabber services Cisco Jabber Voice/Video IM for 3rd party clients Mobile, desktop, Mac Jabber SDK for web Source: Sense of Security 2014 Page 42 of 60 Aug-14
43 Rogue services and DSITM Use ARP/DNS Spoof & VLAN hopping & Manual config Collect credentials, hashes, information Change client's request to add a feature (e.g. Spoofing) Change the SDP features to redirect calls Add a proxy header to bypass billing & CDR Manipulate request at runtime to find BoF vulnerabilities Trigger software upgrades for malwared executables Death Star in the Middle Sense of Security 2014 Page 43 of 60 Aug-14
44 Attacking a client using SIP service Caller ID spoofed messages to install a malicious application or an SSL certificate to redirect voic s or calls Fake caller ID for Scam, Vishing or Spying Manipulate the content or content-type on messaging Trigger a crash/bof on the remote client Inject cross-site scripting to the conversation Proxies with TLS+TCP interception and manipulation Viproxy (github.com/fozavci/viproxy) MITMproxy Sense of Security 2014 Page 44 of 60 Aug-14
45 SMS phishing using SIP messages Sense of Security 2014 Page 45 of 60 Aug-14
46 Attacking a client using SIP trust SIP server redirects a few fields to client FROM, FROM NAME, Contact Other fields depend on server (e.g. SDP, MIME) Message content Clients have buffer overflow in FROM? Send 2000 chars to test it Crash it or execute your shellcode if available Clients trust SIP servers and trust is UDP based Trust hacking module can be used for the trust between server and client too. Viproy Penetration Testing Kit SIP Modules Simple fuzz support (FROM=FUZZ 2000) You can modify it for further attacks Sense of Security 2014 Page 46 of 60 Aug-14
47 Attacking a client using SIP trust Sydney Production SIP Service UDP Trust Melbourne Brisbane IP spoofed UDP SIP request From field has bogus characters Universal Trust Crash Tatooine Send INVITE/MESSAGE requests with IP spoofing (source is Brisbane), from field contains exploit, the client will be your stormtrooper. Adore iphone App Sense of Security 2014 Page 47 of 60 Aug-14
48 Attacking clients using VoIP Video demo for SIP based client attacks Manipulating instant messaging between clients Initiate a call using fake Caller ID Send a fake message from the Operator Send bogus message to crash Send too many calls and create a crash Sense of Security 2014 Page 48 of 58 Aug-14
49 Attacking Skinny services Cisco Skinny (SCCP) Binary, not plain text Different versions No authentication MAC address is identity Auto registration Basic attacks Register as a phone Disconnect other phones Call forwarding Unauthorised calls Source: Cisco Sense of Security 2014 Page 49 of 60 Aug-14
50 Other Skinny researches Skinny vulnerabilities published CiscoSecurityAdvisory/cisco-sa cucm by Felix Lindner by Sipera VIPER Lab IxVoice SCCP (Skinny) Test Library VIPER UCSniff supports Skinny VIPER LAVA has Skinny support(?) VoIP Security not found. Did you mean Jason Ostrom? He is not only passionate about VoIP Sense of Security 2014 Page 50 of 60 Aug-14
51 Attacking Skinny services Sense of Security 2014 Page 51 of 60 Aug-14
52 Attacking Skinny services Viproy has a Skinny library for easier development and sample attack modules Skinny auto registration Skinny register Skinny call Skinny call forwarding Sense of Security 2014 Page 52 of 60 Aug-14
53 Attacking Skinny services Everybody can develop a Skinny module now, even Ewoks Register Unauthorised Call Sense of Security 2014 Page 53 of 60 Aug-14
54 Preparing a proper client for Skinny Install Cisco IP Communicator Change the MAC address of Windows Register the software with this MAC Sense of Security 2014 Page 54 of 60 Aug-14
55 Demonstration of Skinny attacks Sense of Security 2014 Page 55 of 60 Aug-14
56 Summary Hosted VoIP 101 Network Attacks Attacking SIP Attacking CUCDM Attacking CUCM Attacking Clients Attacking Skinny Sense of Security 2014 Page 56 of 60 Aug-14
57 Solutions Install the Cisco security patches From CVE to CVE , CVE , CVE CSCum75078, CSCun17309, CSCum77041, CSCuo51517, CSCum76930, CSCun49862 Secure network design IP phone services MUST be DEDICATED, not SHARED Secure deployment with PKI Authentication with X.509, software signatures Secure SSL configuration Secure protocols Skinny authentication, SIP authentication HTTP instead of TFTP, SSH instead of Telnet Sense of Security 2014 Page 57 of 60 Aug-14
58 References Viproy Homepage and Documentation Attacking SIP servers using Viproy VoIP Kit VoIP Pen-Test Environment VulnVoIP Credits and thanks go to Sense of Security Team, Jason Ostrom, Mark Collier, Paul Henry, Sandro Gauci Sense of Security 2014 Page 58 of 60 Aug-14
59 Questions? Sense of Security 2014 Page 59 of 60 Aug-14
60 Thank you Recognised as Australia s fastest growing information security and risk management consulting firm through the Deloitte Technology Fast 50 & BRW Fast 100 programs Head office is level 8, 66 King Street, Sydney, NSW 2000, Australia. Owner of trademark and all copyright is Sense of Security Pty Ltd. Neither text or images can be reproduced without written permission. T: T: +61 (0) F: +61 (0) info@senseofsecurity.com.au Sense of Security 2014 Page 60 of 60 Aug-14
VoIP Wars: Attack of the Cisco Phones
VoIP Wars: Attack of the Cisco Phones Compliance, Protection & Business Confidence Sense of Security Pty Ltd Sydney Level 8, 66 King Street Melbourne Level 10, 401 Docklands Drv T: 1300 922 923 T: +61
Viproy Reloaded 2.0. Compliance, Protection & Business Confidence. Melbourne Level 10, 401 Docklands Drv
Viproy Reloaded 2.0 Compliance, Protection & Business Confidence Sense of Security Pty Ltd Sydney Level 8, 66 King Street Melbourne Level 10, 401 Docklands Drv T: 1300 922 923 T: +61 (0) 2 9290 4444 info@senseofsecurity.com.au
Practical VoIP Hacking with Viproy
Practical VoIP Hacking with Viproy 9 December 2014 Compliance, Protection & Business Confidence Sense of Security Pty Ltd Sydney Level 8, 66 King Street Sydney NSW 2000 Australia Melbourne Level 10, 401
VoIP Wars: Destroying Jar Jar Lync
VoIP Wars: Destroying Jar Jar Lync Fatih Ozavci 25 October 2015 Compliance, Protection & Business Confidence Sense of Security Pty Ltd Sydney Melbourne T: 1300 922 923 info@senseofsecurity.com.au Level
VoIP Wars : Return of the SIP
VoIP Wars : Return of the SIP Fatih Özavcı Information Security Researcher & Consultant fatih.ozavci at viproy.com viproy.com/fozavci # whois Information Security Consultant @ Viproy / Turkey 10+ Years
VoIP Wars : Return of the SIP
VoIP Wars : Return of the SIP Fatih Özavcı Security Consultant @ Sense of Security (Australia) www.senseofsecurity.com.au @fozavci # whois Security Consultant @ Sense of Security (Australia) 10+ Years
Hacking SIP Services Like a Boss. Fatih Özavcı Information Security Researcher & Consultant
Hacking SIP Services Like a Boss Fatih Özavcı Information Security Researcher & Consultant fatih.ozavci at viproy.com viproy.com/fozavci #direngezi 2 #direngezi 3 #direngezi 4 About Me Information Security
Sense of Security VoIP Security Testing Training
Sense of Security VoIP Security Testing Training Fatih Ozavci Christos Archimandritis 8 August 2015 Compliance, Protection & Business Confidence Sense of Security Pty Ltd Sydney Level 8, 66 King Street
Sense of Security VoIP Security Testing Training
Sense of Security VoIP Security Testing Training Fatih Ozavci Christos Archimandritis 8 August 2015 Compliance, Protection & Business Confidence Sense of Security Pty Ltd Sydney Level 8, 66 King Street
VOIP WARS: THE PHREAKERS AWAKEN. Fatih Ozavci @fozavci Managing Consultant Context Information Security
VOIP WARS: THE PHREAKERS AWAKEN Fatih Ozavci @fozavci Managing Consultant Context Information Security Fatih Ozavci, Managing Consultant VoIP & phreaking Mobile applications and devices Network infrastructure
A Brief Security Analysis of Microsoft Skype for Business
A Whitepaper Prepared by Sense of Security A Brief Security Analysis of Microsoft Skype for Business Version No: 1.0 Document No: SFB-Tech-1215 Author: Fatih Ozavci 17 December 2015 Sense of Security is
The Trivial Cisco IP Phones Compromise
Security analysis of the implications of deploying Cisco Systems SIP-based IP Phones model 7960 Ofir Arkin Founder The Sys-Security Group ofir@sys-security.com http://www.sys-security.com September 2002
Hacking Trust Relationships of SIP Gateways
Hacking Trust Relationships of SIP Gateways Author : Fatih Özavcı Homepage : gamasec.net/fozavci SIP Project Page : github.com/fozavci/gamasec-sipmodules Version : 0.9 Hacking Trust Relationship Between
Voice over IP. VoIP (In) Security. Presented by Darren Bilby NZISF 14 July 2005
Voice over IP VoIP (In) Security Presented by Darren Bilby NZISF 14 July 2005 Security-Assessment.com Who We Are NZ s only pure-play security firm Largest team of security professionals in NZ Offices in
How To Test For Security On A Vlan Vlan On A Cell Phone At A Hotel Room (For A Hotel)
VoIP Penetration Testing Lessons learned, tools, techniques Presented to: SANS WhatWorks in Penetration Testing & Web Application Attacks 2009 Jason Ostrom Director, VIPER Lab Agenda Introduction About
Penetration Testing with Kali Linux
Penetration Testing with Kali Linux PWK Copyright 2014 Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security, 2014 No part of this publication, in whole or
Cconducted at the Cisco facility and Miercom lab. Specific areas examined
Lab Testing Summary Report July 2009 Report 090708 Product Category: Unified Communications Vendor Tested: Key findings and conclusions: Cisco Unified Communications solution uses multilayered security
Penetration Testing. How Government Can Achieve Better Outcomes. Delivered by Murray Goldschmidt, Chief Operating Officer
Penetration Testing How Government Can Achieve Better Outcomes Delivered by Murray Goldschmidt, Chief Operating Officer Cyber Security for Government Conference, 25&26 October 2011, Sydney Compliance,
Securing SIP Trunks APPLICATION NOTE. www.sipera.com
APPLICATION NOTE Securing SIP Trunks SIP Trunks are offered by Internet Telephony Service Providers (ITSPs) to connect an enterprise s IP PBX to the traditional Public Switched Telephone Network (PSTN)
Penetration Testing SIP Services
Penetration Testing SIP Services Using Metasploit Framework Writer Version : 0.2 : Fatih Özavcı (fatih.ozavci at viproy.com) Introduction Viproy VoIP Penetration Testing Kit Sayfa 2 Table of Contents 1
SECURITY TRENDS & VULNERABILITIES REVIEW 2015
SECURITY TRENDS & VULNERABILITIES REVIEW 2015 Contents 1. Introduction...3 2. Executive summary...4 3. Inputs...6 4. Statistics as of 2014. Comparative study of results obtained in 2013...7 4.1. Overall
Vulnerability Assessment and Penetration Testing
Vulnerability Assessment and Penetration Testing Module 1: Vulnerability Assessment & Penetration Testing: Introduction 1.1 Brief Introduction of Linux 1.2 About Vulnerability Assessment and Penetration
Introducing Cisco Voice and Unified Communications Administration Volume 1
Introducing Cisco Voice and Unified Communications Administration Volume 1 Course Introduction Overview Learner Skills and Knowledge Course Goal and Course Flow Additional Cisco Glossary of Terms Your
https://elearn.zdresearch.com https://training.zdresearch.com/course/pentesting
https://elearn.zdresearch.com https://training.zdresearch.com/course/pentesting Chapter 1 1. Introducing Penetration Testing 1.1 What is penetration testing 1.2 Different types of test 1.2.1 External Tests
Learn Ethical Hacking, Become a Pentester
Learn Ethical Hacking, Become a Pentester Course Syllabus & Certification Program DOCUMENT CLASSIFICATION: PUBLIC Copyrighted Material No part of this publication, in whole or in part, may be reproduced,
Ron Shuck, CISSP, CISM, CISA, GCIA Infrastructure Security Architect Spirit AeroSystems
Ron Shuck, CISSP, CISM, CISA, GCIA Infrastructure Security Architect Spirit AeroSystems VOIP Components Common Threats How Threats are Used Future Trends Provides basic network connectivity and transport
Protect Yourself Against VoIP Hacking. Mark D. Collier Chief Technology Officer SecureLogix Corporation
Protect Yourself Against VoIP Hacking Mark D. Collier Chief Technology Officer SecureLogix Corporation What Will Be Covered How to assess the security of your IPT network: In house/external and ground
Web Application Hacking (Penetration Testing) 5-day Hands-On Course
Web Application Hacking (Penetration Testing) 5-day Hands-On Course Web Application Hacking (Penetration Testing) 5-day Hands-On Course Course Description Our web sites are under attack on a daily basis
VoIP Security regarding the Open Source Software Asterisk
Cybernetics and Information Technologies, Systems and Applications (CITSA) 2008 VoIP Security regarding the Open Source Software Asterisk Prof. Dr.-Ing. Kai-Oliver Detken Company: DECOIT GmbH URL: http://www.decoit.de
VOIP SECURITY: BEST PRACTICES TO SAFEGUARD YOUR NETWORK ======
VOIP SECURITY: BEST PRACTICES TO SAFEGUARD YOUR NETWORK ====== Table of Contents Introduction to VoIP Security... 2 Meet Our Expert - Momentum Telecom... 2 BroadWorks... 2 VoIP Vulnerabilities... 3 Call
Ports Reference Guide for Cisco Virtualization Experience Media Engine for SUSE Linux Release 9.0
Ports Reference Guide for Cisco Virtualization Experience Media Engine for SUSE Linux Release 9.0 Ports 2 Virtualization Experience Media Engine 2 Virtualization Experience Client Manager 3 Cisco Jabber
Implementing Cisco Collaboration Applications **Part of the CCNP Collaboration certification track**
Course: Duration: Price: $ 3,795.00 Learning Credits: 38 Certification: Implementing Cisco Collaboration Applications Implementing Cisco Collaboration Applications**Part of the CCNP Collaboration certification
Footprinting. Vendor press releases and case studies Resumes of VoIP personnel Mailing lists and user group postings Web-based VoIP logins
Voice Over IP Security Mark D. Collier Chief Technology Officer SecureLogix Corporation mark.collier@securelogix.com www.securelogix.com www.voipsecurityblog.com Outline Outline Introduction Attacking
PENTEST. Pentest Services. VoIP & Web. www.novacybersecurity.com
PENTEST VoIP & Web Pentest Services VoIP & WEB Penetration Testing The Experinced and National VoIP/Unified Communications R&D organization, NETAŞ NOVA Pentest Services test the applications, infrastructure
Attack and Penetration Testing 101
Attack and Penetration Testing 101 Presented by Paul Petefish PaulPetefish@Solutionary.com July 15, 2009 Copyright 2000-2009, Solutionary, Inc. All rights reserved. Version 2.2 Agenda Penetration Testing
Certified Ethical Hacker Exam 312-50 Version Comparison. Version Comparison
CEHv8 vs CEHv7 CEHv7 CEHv8 19 Modules 20 Modules 90 Labs 110 Labs 1700 Slides 1770 Slides Updated information as per the latest developments with a proper flow Classroom friendly with diagrammatic representation
Configuring the Dolby Conference Phone with Cisco Unified Communications Manager
Configuring the Dolby Conference Phone with Cisco Unified Communications Manager Version 1.2 December 10, 2015 This product is protected by one or more patents in the United States and elsewhere. For more
Voice Over IP (VoIP) Denial of Service (DoS)
Introduction Voice Over IP (VoIP) Denial of Service (DoS) By Mark Collier Chief Technology Officer SecureLogix Corporation mark.collier@securelogix.com Denial of Service (DoS) is an issue for any IP network-based
NetComm V90 VoIP Phone Quick Start Guide Draft Release 0.1
NetComm V90 VoIP Phone Quick Start Guide Draft Release 0.1 Copyright NetComm Ltd Overview NetComm V90 SIP VoIP Phone User Guide Table of Contents Overview... 3 V90 VoIP Phone Specification...4 Shipping
CYBERTRON NETWORK SOLUTIONS
CYBERTRON NETWORK SOLUTIONS CybertTron Certified Ethical Hacker (CT-CEH) CT-CEH a Certification offered by CyberTron @Copyright 2015 CyberTron Network Solutions All Rights Reserved CyberTron Certified
How to make free phone calls and influence people by the grugq
VoIPhreaking How to make free phone calls and influence people by the grugq Agenda Introduction VoIP Overview Security Conclusion Voice over IP (VoIP) Good News Other News Cheap phone calls Explosive growth
NetVanta 7060/7100 Configuration Checklist
NetVanta 7060/7100 Configuration Checklist AOS Versions Supported: AOS A1.01.00 and above. AOS Versions Supporting SIP Trunking and Networking: AOS A2.02.00 and above. This document is designed to provide
Basic Vulnerability Issues for SIP Security
Introduction Basic Vulnerability Issues for SIP Security By Mark Collier Chief Technology Officer SecureLogix Corporation mark.collier@securelogix.com The Session Initiation Protocol (SIP) is the future
Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion
Network Security Tampere Seminar 23rd October 2008 1 Copyright 2008 Hirschmann 2008 Hirschmann Automation and and Control GmbH. Contents Overview Switch Security Firewalls Conclusion 2 Copyright 2008 Hirschmann
640-461: Introducing Cisco Voice and Unified Communications Administration (ICOMM) v8.0 Course Introduction
640-461: Introducing Cisco Voice and Unified Communications Administration (ICOMM) v8.0 Course Introduction Course Introduction Module 01 - Overview of Cisco Unified Communications Solutions Understanding
The #1 Issue on VoIP, Fraud!
Know your enemy Sun Tzu's The Art of War The #1 Issue on VoIP, Fraud! How to identify, prevent and reduce damages caused by fraud Flavio E. Goncalves About me Author of the book Building Telephony Systems
IP PBX. SD Card Slot. FXO Ports. PBX WAN port. FXO Ports LED, RED means online
1 IP PBX SD Card Slot FXO Ports PBX LAN port PBX WAN port FXO Ports LED, RED means online 2 Connect the IP PBX to Your LAN Internet PSTN Router Ethernet Switch FXO Ports 3 Access the PBX s WEB GUI The
Implementing Cisco IOS Telephony and Unified Communications Express (IITUCX)
Implementing Cisco IOS Telephony and Unified Communications Express (IITUCX) Course Objectives Explain the benefits and components of a Cisco Unified Communications system Describe how traditional telephony
Link Gate SIP. (Firmware version 1.20)
Link Gate SIP (Firmware version 1.20) User guide v1.0 1 Content 2 1. Technical parameters - Dimensions 133 x 233 x 60 mm - Weight 850 g - Operating position various - Operating condition temperature: +5
Nokia Call Connect v1.1 for Cisco User s Guide. Part Number: N450000431 Rev 003 Issue 1
Nokia Call Connect v1.1 for Cisco User s Guide Part Number: N450000431 Rev 003 Issue 1 Reproduction, transfer, distribution or storage of part or all of the contents in this document in any form without
Enumerating and Breaking VoIP
Enumerating and Breaking VoIP Introduction Voice over Internet Protocol (VoIP) has seen rapid implementation over the past few years. Most of the organizations which have implemented VoIP are either unaware
CyberData VoIP V2 Speaker with VoIP Clock Kit Configuration Guide for OmniPCX Enterprise
CyberData VoIP V2 Speaker with VoIP Clock Kit Configuration Guide for OmniPCX Enterprise CyberData Corporation 2555 Garden Road Monterey, CA 93940 T:831-373-2601 F: 831-373-4193 www.cyberdata.net 2 Introduction
Network Attacks. Common Network Attacks and Exploits
Common and Exploits AGENDA A Few Observations Hacker Resources Attack Categories Some Common Attacks Wireless Specific Attacks Wireless Observations Because of Common Network Layers, Most of the Attacks
Cisco CallManager configuration for BLU-103
Cisco CallManager configuration for BLU-103 This document details the steps required to configure a Cisco CallManager VoIP system to work with a BLU-103 VoIP interface. 10653 South River Front Pkwy, Suite
Cisco VoIP (in)security
Cisco VoIP (in)security Sandro GAUCI sandro@enablesecurity.com Joffrey CZARNY snorky@insomnihack.net VoIP VoIP (Voice over IP) is a technology to allows Voice communication over IP network Call flow VLAN
VOIP-500 Series Phone CUCM 8.0.3a Integration Guide
I. Introduction This provides general instructions for integration of the VOIP-500 Series Phone with a Cisco Call Manager installation. It is recommended to read this instruction set completely before
Session Initiation Protocol (SIP) Vulnerabilities. Mark D. Collier Chief Technology Officer SecureLogix Corporation
Session Initiation Protocol (SIP) Vulnerabilities Mark D. Collier Chief Technology Officer SecureLogix Corporation What Will Be Covered Introduction to SIP General SIP security SIP vulnerabilities and
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration
Understanding Security Testing
Understanding Security Testing Choosing between vulnerability assessments and penetration testing need not be confusing or onerous. Arian Eigen Heald, M.A., Ms.IA., CNE, CISA, CISSP I. Introduction Many
VOICE OVER IP SECURITY
VOICE OVER IP SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without
Configuring the Sonus SBC 2000 with Cisco Unified Call Manager 10.5 for Verizon Deployment
Configuring the Sonus SBC 2000 with Cisco Unified Call Manager 10.5 for Verizon Deployment Application Notes Rev 1.0 P/N 550-06690 Last Updated: October 26, 2015 Revision History Revision Date Revised
Cisco Analog Telephone Adaptor Overview
CHAPTER 1 This section describes the hardware and software features of the Cisco Analog Telephone Adaptor (Cisco ATA) and includes a brief overview of the Skinny Client Control Protocol (SCCP). The Cisco
Protecting Your Organisation from Targeted Cyber Intrusion
Protecting Your Organisation from Targeted Cyber Intrusion How the 35 mitigations against targeted cyber intrusion published by Defence Signals Directorate can be implemented on the Microsoft technology
Threats to be considered (1) ERSTE GROUP
VoIP-Implementation Lessons Learned Philipp Schaumann Erste Group Bank AG Group IT-Security philipp.schaumann@erstegroup.com http://sicherheitskultur.at/ Seite 1 Threats to be considered (1) Eavesdropping
VoIP Survivor s s Guide
VoIP Survivor s s Guide Can you really save $, improve operations, AND achieve greater security and availability? Presented by Peggy Gritt, Founder and CEO of the VoIP A non-biased organization for the
Infrastructure developments to build on AARNet s VoIP and Video services. Leon Li. Overview. Enterprise UC Network. Beta program.
Infrastructure developments to build on AARNet s VoIP and Video services Leon Li IT Engineer QUESTnet, Gold Coast July 2009 Overview Enterprise UC Network Demonstration Beta program What we have today
Implementing Cisco IOS Network Security
Implementing Cisco IOS Network Security IINS v3.0; 5 Days, Instructor-led Course Description Implementing Cisco Network Security (IINS) v3.0 is a 5-day instructor-led course focusing on security principles
Implementing Cisco Collaboration Devices CICD v1.0; 5 Days; Instructor-led
Implementing Cisco Collaboration Devices CICD v1.0; 5 Days; Instructor-led Course Description Implementing Cisco Collaboration Devices (CICD v1.0) is an extended hours 5-day course focusing on providing
The MOST Affordable HD Video Conferencing. Conferencing for Enterprises, Conferencing for SMBs
The MOST Affordable HD Video Conferencing Video conferencing has become an increasingly popular service, being widely used by enterprises, organizations and individuals. Thanks to the enormous growth in
How to Configure the Cisco UC500 for use with Integra Telecom SIP Solutions
How to Configure the Cisco UC500 for use with Integra Telecom SIP Solutions Overview: This document provides a reference for configuration of the Cisco UC500 IP PBX to connect to Integra Telecom SIP Trunks.
Implementing Cisco IOS Telephony and Unified Communications Express (IITUCX)
Implementing Cisco IOS Telephony and Unified Communications Express (IITUCX) Who should attend The primary audience for this course is as follows: Network administrators Network engineers Systems engineers
6.40A AudioCodes Mediant 800 MSBG
AudioCodes Mediant 800 MSBG Page 1 of 66 6.40A AudioCodes Mediant 800 MSBG 1. Important Notes Check the SIP 3 rd Party Validation Website for current validation status. The SIP 3 rd party Validation Website
Mobile Application Hacking for Android and iphone. 4-Day Hands-On Course. Syllabus
Mobile Application Hacking for Android and iphone 4-Day Hands-On Course Syllabus Android and iphone Mobile Application Hacking 4-Day Hands-On Course Course description This course will focus on the techniques
MITEL SIP CoE. Technical. Configuration Notes. Configure the Mitel 3300 MCD 4.1 for use with Paetec Broadworks Softswitch. SIP CoE 08-4940-00035
MITEL SIP CoE Technical Configuration Notes Configure the Mitel 3300 MCD 4.1 for use with Broadworks Softswitch SIP CoE 08-4940-00035 NOTICE The information contained in this document is believed to be
Threat Mitigation for VoIP
Threat Mitigation for VoIP Bogdan Materna, VP Engineering and CTO VoIPshield Systems Third Annual VoIP Security Workshop June 2, 2006 Overview Basics VoIP Security Impact Examples of real vulnerabilities
COURSE NAME: INFORMATION SECURITY INTERNSHIP PROGRAM
COURSE NAME: INFORMATION SECURITY INTERNSHIP PROGRAM Course Description This is the Information Security Training program. The Training provides you Penetration Testing in the various field of cyber world.
210-060. Implementing Cisco Collaboration Devices v1.0. Version: Demo. Page <<1/10>>
210-060 Implementing Cisco Collaboration Devices v1.0 Version: Demo Page 1. Which two technologies comprise a Cisco Presence deployment? (Choose two.) A. Cisco Unified Presence Server B. Cisco
Integrating a Hitachi IP5000 Wireless IP Phone
November, 2007 Avaya Quick Edition Integrating a Hitachi IP5000 Wireless IP Phone This application note explains how to configure the Hitachi IP5000 wireless IP telephone to connect with Avaya Quick Edition
Sample Configuration for SIP Trunking between Avaya IP Office R8.0 and Cisco Unified Communications Manager 8.6.2 Issue 1.0
Avaya Solution & Interoperability Test Lab Sample Configuration for SIP Trunking between Avaya IP Office R8.0 and Cisco Unified Communications Manager 8.6.2 Issue 1.0 Abstract These Application Notes describe
Configuration Note for Jeron Provider 790 and Cisco CallManager
Configuration Note for Jeron Provider 790 and Cisco CallManager 1. Jeron Provider 790 Setup 1.1 Configure the SIP Server Connectivity Set Brekeke SIP Server's IP address in the [SIP Server IP] field and
SIP Security Controllers. Product Overview
SIP Security Controllers Product Overview Document Version: V1.1 Date: October 2008 1. Introduction UM Labs have developed a range of perimeter security gateways for VoIP and other applications running
ANNEXURE-1 TO THE TENDER ENQUIRY NO.: DPS/AMPU/MIC/1896. Network Security Software Nessus- Technical Details
Sub: Supply, Installation, setup and testing of Tenable Network Security Nessus vulnerability scanner professional version 6 or latest for scanning the LAN, VLAN, VPN and IPs with 3 years License/Subscription
Cisco Unified Communications Manager (CUCM)
Spectralink 87-Series Wireless Telephone Cisco Unified Communications Manager (CUCM) Interoperability Guide 721-0016-000 Rev: B March 2015 Copyright Notice 2014-2015 Spectralink Corporation All rights
KISUMU LAW COURTS: SPECIFICATIONS FOR A UNIFIED COMMUNICATION SYSTEM / VOICE OVER INTERNET PROTOCOL (VOIP) SOLUTION. Page 54 of 60
SPECIFICATIONS FOR A UNIFIED COMMUNICATION SYSTEM / VOICE OVER INTERNET PROTOCOL (VOIP) SOLUTION Page 54 of 60 UNIFIED COMMUNICATION SYSTEM (VOIP) PROPOSAL FOR KISUMU JUDICIARY COURTS. 1.0 PARTICULARS
nexvortex Setup Guide
nexvortex Setup Guide CISCO UC500 March 2012 Introduction This document is intended only for nexvortex customers and resellers as an aid to setting up the Cisco PBX software to connect to the nexvortex
IoT IT Security and Secure Development Life Cycle
IoT IT Security and Secure Development Life Cycle Security BSides Ljubljana, 2015 By Christopher Scheuring, ERNW Germany #2 /whoami Christopher Scheuring Security Analyst @ ERNW Since 2010 IT Security
- Basic Router Security -
1 Enable Passwords - Basic Router Security - The enable password protects a router s Privileged mode. This password can be set or changed from Global Configuration mode: Router(config)# enable password
mobile unified communications client and docking station
FREQUENTLY ASKED QUESTIONS mobile unified communications client and docking station What are the target customer characteristics of a Mobile UC subscriber? + Verizon Wireless as mobile carrier. Mobile
a) Encryption is enabled on the access point. b) The conference room network is on a separate virtual local area network (VLAN)
MIS5206 Week 12 Your Name Date 1. Which significant risk is introduced by running the file transfer protocol (FTP) service on a server in a demilitarized zone (DMZ)? a) User from within could send a file
Juniper Networks EX Series Ethernet Switches/ Cisco VoIP Interoperability Test Results. September 25, 2009
Juniper Networks EX Series Ethernet Switches/ Cisco VoIP Interoperability Test Results September 25, 2009 Executive Summary Juniper Networks commissioned Network Test to assess interoperability between
VoIP Security: How Secure is Your IP Phone?
VoIP Security: How Secure is Your IP Phone? Dan York, CISSP Director of IP Technology, Office of the CTO Chair, Mitel Product Security Team Member, Board of Directors, VoIP Security Alliance (VOIPSA) ICT
NTP VoIP Platform: A SIP VoIP Platform and Its Services
NTP VoIP Platform: A SIP VoIP Platform and Its Services Speaker: Dr. Chai-Hien Gan National Chiao Tung University, Taiwan Email: chgan@csie.nctu.edu.tw Date: 2006/05/02 1 Outline Introduction NTP VoIP
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
Deployment Guide for the Polycom SoundStructure VoIP Interface for Cisco Unified Communications Manager (SIP)
Deployment Guide for the Polycom SoundStructure VoIP Interface for Cisco Unified Communications Manager (SIP) UC Software 4.0.1 December 2011 1725-33223-001 Rev. A Trademark Information POLYCOM, the Polycom
Knowledgebase Solution
Knowledgebase Solution Goal Enable coexistence of a 3 rd -party VPN / Firewall with an EdgeMarc appliance. Describe characteristics and tradeoffs of different topologies. Provide configuration information
NEW!!! Industry s only Comprehensive VoIP Security Boot Camp
NEW!!! Industry s only Comprehensive VoIP Security Boot Camp IP 3, Inc. the nation s leading trainer for Securing Emerging Technologies has partnered with Salare Security to launch one of the most intense
Avaya IP Office 8.1 Configuration Guide
Avaya IP Office 8.1 Configuration Guide Performed By tekvizion PVS, Inc. Contact: 214-242-5900 www.tekvizion.com Revision: 1.1 Date: 10/14/2013 Copyright 2013 by tekvizion PVS, Inc. All Rights Reserved.
Grandstream Networks, Inc. UCM6100 Security Manual
Grandstream Networks, Inc. UCM6100 Security Manual Index Table of Contents OVERVIEW... 3 WEB UI ACCESS... 4 UCM6100 HTTP SERVER ACCESS... 4 PROTOCOL TYPE... 4 USER LOGIN... 4 LOGIN TIMEOUT... 5 TWO-LEVEL
mobile uc client End user guide
mobile uc client End user guide 1 Mobile Unified Communications User Guide About Mobile UC Currently, the following five Droid Phones are supported for Mobile UC: + Droid X + Droid X2 + Droid 2 Global
Network Security Audit. Vulnerability Assessment (VA)
Network Security Audit Vulnerability Assessment (VA) Introduction Vulnerability Assessment is the systematic examination of an information system (IS) or product to determine the adequacy of security measures.