VOICE OVER IP VIEWPOINT 01/2006

Transcription

1 VOICE OVER IP VIEWPOINT 01/ JANUARY 2006 This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC) a predecessor organisation to the Centre for the Protection of National Infrastructure (CPNI). Hyperlinks in this document may refer to resources that no longer exist. Please see CPNI s website ( for up-to-date information. Disclaimer Reference to any specific commercial product, process or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by CPNI. The views and opinions of authors expressed within this document shall not be used for advertising or product endorsement purposes. To the fullest extent permitted by law, CPNI accepts no liability for any loss or damage (whether direct, indirect or consequential and including, but not limited to, loss of profits or anticipated profits, loss of data, business or goodwill) incurred by any person and howsoever caused arising from or connected with any error or omission in this document or from any person acting, omitting to act or refraining from acting upon, or otherwise using, the information contained in this document or its references. You should make your own judgement as regards use of this document and seek independent professional advice on your particular circumstances.

2 Introduction 1. This short guide to VoIP is broken down into several sections allowing the reader to gain an understanding of the different types of VoIP available, review a summary of high-level vulnerabilities and security concerns across the various types of VoIP, and read more regarding the technical detail of VoIP. 2. Mitigation is not considered in this document which instead presents issues that should be considered when contemplating a VoIP solution. 3. Voice is probably one of the most critical services within your organisation. There is a natural assumption that the telephone will never fail and a dial tone will be heard each time the handset is picked up. 4. VoIP brings numerous perceived benefits. Cost savings Network convergence Integration with other network services New functionality 5. Attention is drawn to the issue that deployment of a VoIP solution may introduce risks not previously considered. Security provisions may affect the ability to realise the benefits listed above. 6. When people discuss VoIP it is often very difficult to know to which type they refer. Terms such as core, derived-voice, voice-over-broadband and enterprise are all used, often interchangeably, by people who do not really understand the breadth of VoIP as a technology. This Viewpoint attempts to give readers the necessary understanding to discuss VoIP with some authority. What flavours of VoIP exist? 7. VoIP can be divided into three main categories: Internet Telephony usually straight forward computer-to-computer voice or video over the internet. The volumes of internet telephony are still relatively low compared to traditional telephony and tend to have geographical pockets eg UK, USA. Internet Telephony is experiencing tremendous growth but the quality is not always consistent. Vonage and Skype are two such examples. 2

3 The diagram below illustrates how users can typically connect and make calls using the Internet. Desktop Computer Smartphone PDA Internet Gateway Gateway Standard Telephone Standard Telephone Typically, Internet Telephony software requires the user to create an online account and sign-in each time they wish to use the service. This login also provides presence information to other users who are online and signed in. Enterprise Telephony the replacement of the office private telephone exchange with an IP solution. This type of VoIP is typically high quality and is feature rich but requires high system availability and is relatively expensive to implement. Internet Firewall Call Manager Server Call Manager Corporate LAN Legacy PBX Many of the vendors offer both softphone (software that works in association with VoIP technologies and emulates a telephone on screen) and IP-phone solutions. The call manager can support networks supporting 1,000s of VoIP phones with built-in one-click calling, diverts, voic , directory services and video conferencing. 3

4 PSTN Replacement Telephony the transformation of major telecommunication operators private networks to carry voice circuits as data. Customer Environment Multi Service Access Node (MSAN) Regional Aggregator Core Node VoIP Security: So how long can you go without a voice service? 8. The vulnerabilities to VoIP come in three broad areas. Generic Protocol Implementation Vendor Specific Generic Protocol Vulnerabilities Signalling 9. Session Initiation Protocol (SIP) is easy to spoof as there is no strong authentication built into the protocol. SIP operates across many different architectural components: IP phones, SIP proxies and call managers, exposing a large surface area of attack. Using SIP securely requires a VoIP compliant firewall in order to ensure SIP messages are monitored for malicious content, DoS attacks and irregular calling patterns. Signalling protocol H.323 has also been seen to suffer from DoS attacks as a result of memory management exploits such as buffer overflows. 4

5 A Typical VoIP Data Packet VoIP is squeezed into data packets usually using a structure similar to below: IP Header UDP Header Transport Header Voice Data VoIP Bandwidth? A sampling rate of 8khz using 8 bit samples provides normal 64kbps good voice quality. (8x 8000 bits for each second = bits per second). Traditional telephone networks are subsequently based around 64Kb/sec channels. Various compression codecs can be used to improve this including some that compress voice to a small 15Kb/sec. Transport 10. Bandwidth exhaustion attacks are possible by flooding VoIP hardware with too many media sessions. Implementation Vulnerabilities Internet Telephony Availability 11. Using Internet Telephony services expose standard Internet threats such as spyware, malware and trojans. VoIP software is often released as freeware but provides no particular guarantees as to the reliability or integrity of the software. This type of telephony is also completely dependent on the resilience of the Internet connection used. Hardware solutions are perhaps better than the soft-phone solutions, but only if the hardware can have its firmware updated. Some predictions suggest Spam over Internet Telephony (SPIT) may also become a problem by filling up voic systems. It is worth noting that Internet Telephony solutions generally do not allow calls to emergency services e.g. 999, as it is currently difficult for the network to derive the emergency caller s location. Confidentiality 12. Standard spoofing techniques can easily perform man-in-the-middle attacks if the voice data is not encrypted. If the voice call traverses to the standard PSTN it is likely that any encryption will be stripped off. Malicious software may intercept the conversations or route them elsewhere. 5

6 Enterprise telephony Authentication and authorisation 13. Authentication is of paramount importance within an enterprise solution. Handsets should authenticate onto the network in order to prevent un-trusted devices operating within the network. Authorisation should also be used to prevent fraud such as prohibited long distance calling. Availability 14. Any IP telephony equipment not connected to the legacy PBX telephone exchange will cease to function in a power cut. Separate power generation for VoIP systems should be considered if the voice network is critical. Uninterruptible Power Supply (UPS) systems will provide some resilience but are not a solution for lengthy power outages. SPIT may be of concern unless measures are put in place to monitor voic services. Servers may become overloaded and prevent genuine messages from being left. Converged networks increase the dependency placed on existing infrastructure such as DNS and DHCP. This should be recognised and accounted for by hardening these components and reinforcing as necessary. Confidentiality 15. Current best practice recommends encryption or at least data separation at the datalink layer to secure signalling and voice data in order to prevent sniffing at any point around the network. The issue then will be to ensure the Quality of Service (QoS) is not affected if encryption is used. A VoIP firewall, or to use its correct name, a Session Border Controller, will need to be correctly configured to provide the appropriate level of protection whilst still enabling the voice and signalling to negotiate the corporate firewall. PSTN Replacement Availability 16. End-to-end reliability for the traditional telephone network is required to meet high standards, usually quoted as % (about 5 mins in a year). Next Generation Networks (NGNs) will need to ensure this high standard is continued. Communication Service Providers should ensure their networks are protected against the exposure inherent in Local Loop Unbundling (LLU) where other providers can install and interconnect their equipment. 6

7 Confidentiality 17. When replacing large amounts of critical national infrastructure such as the communications backbone of a country, assurances will be required to ensure equipment is purchased from trusted sources in order to alleviate overt attacks from untrusted support engineers or covert attacks through hardware or software implants. installed. Vendor Specific Vulnerabilities Availability 18. Most patches and security updates released by vendors have been related to protecting against denial of service attacks due to malformed packets being sent to IP phones or VoIP network equipment. Many vendors who have built their reputation on data network hardware may have little or no experience with voice telephony and the issues surrounding quality of service or security. Conclusion 19. VoIP is a large topic due to the various different flavours of implementation. It is important when moving to a VoIP solution to correctly identify the threats that affect your solution. 20. In the past the PSTN has been a relatively private network. VoIP does not provide the same physical security model. 21. Protecting your VoIP network requires a layered security approach; identify ways to protect hardware such as gateways and IP phones and the data itself, both signalling and voice. Make sure existing elements of the network that VoIP is dependent on e.g. DNS, DHCP, are identified. Ensure the elements are hardened as appropriate or supplemented with additional hardware or backup facilities. 22. Considerations should be given to the implications of a power outage on any VoIP network. Technologies such as Power over-ethernet (PoE) are now available to help provide power to the IP handset. 23. IP handsets are destined to become more intelligent with embedded operating systems included as standard. Ensure the same security principles adopted for desktop computers and laptops are applied to IP handsets where possible. 24. Business benefits such as system integration and consolidation may drive VoIP being deployed within the organisation. Ensure both the voice and data teams within the organisation work together to protect the network. Make certain that risk analysis 7

8 processes are followed before corporate databases and systems are integrated into the voice network. 25. Various estimates suggest that denial of service attacks will rise against VoIP networks as the dependency on VoIP increases. Some observers speculate that next year will see convergence-specific viruses and worms beginning to attack VoIP equipment. 26. To date the VoIP software vendors have released very few specific warnings for internet telephony but the network equipment vendors have released updates and security patches for VoIP vulnerabilities for some years now. 8

9 Annex A Voice over IP: terminology, facts and figures What VoIP technologies exist? VoIP specifications have been standardised by several bodies, including the International Telecommunication Union (ITU), the Internet Engineering Task Force (IETF) and European Telecommunications Standards Institute (ETSI). Layer 7 - Application The technologies supporting VoIP can be broken down into three categories. SIP Signalling used for call management. MEGACO H.248 MGCP The two main signalling protocols widely used are H.323, specified by the ITU and SIP, specified by the Internet Engineering Task Force (IETF). Transport Protocols used to carry the signalling and voice data. VoIP media and signalling systems use different transport protocols. Media data is carried at the transport layer typically by Real Time Protocol (RTP) which normally uses TCP or UDP as its transport protocol (usually UDP). Signalling data is typically carried using TCP but SCTP is growing in popularity as the favoured option. Gateway Control used to interface signalling and media from IP networks to legacy voice networks. Media Gateways provide conversion between traditional telephone circuits and audio signals carried on VoIP networks. Gateway control protocols such as MGCP and H.248 are used to control set up of calls on Media Gateways in response to call management requests received in signalling messages. Layer 6 - Presentation Layer 5 - Session RTP Layer 4 - Transport SCTP TCP UDP Layer 3 - Network Layer 2 - Datalink Layer 1 - Physical Signalling gateways perform a similar function converting PSTN signalling (based on SS7) into a form suitable for an IP network (carried using protocols such SIGTRAN). VoIP Quality of Service For Voice over IP to be effective several properties need to be managed carefully. The terms are explained below. Latency also known as delay. VoIP requires good end-to-end latency otherwise voice quality will be unsuitable for users. It is typically measured in milliseconds (ms). 9

10 The ITU-T recommends, in the G.114 standard, that one-way delay should be kept lower than 150ms for acceptable conversation quality. Approx. VoIP Latency: Encoding 1-30ms Travel Time 100ms Security & Routing 20-50ms Total: 170ms Careful consideration is needed when applying security to VoIP in order to keep the latency within an acceptable range. Packet Loss the real time nature of VoIP connections results in packets not normally being retransmitted if lost en-route. A lost packet will result in a glitch in the received audio. If many packets are lost the call will become unintelligible - in a similar way to that in which a mobile phone call breaks up in an area of bad reception. Jitter the measure of variation between the arrival of consecutive packets of data. VoIP devices will include a buffer to accommodate a degree of jitter but if the jitter becomes too large then the call quality will be greatly reduced. Quality of Service typically abbreviated to QoS this term is used to describe techniques that minimise latency, jitter and packet loss. Glossary INTERNET TELEPHONY Buffer Overflow an error caused when a program stores too much data in a temporary storage area. This can be exploited by hackers to execute malicious code. CODEC Coder-Decoder. Converts the analogue speech into a digital representation. Compression is achieved by a codec which uses techniques such as suppressing higher frequency components completely and removing frequency components that do not affect the intelligibility of the conversation. DNS Domain Naming System. DNS provides a translation between domain names into IP addresses. DHCP Dynamic Host Configuration Protocol. A protocol that dynamically assigns an IP address to a computer or IP phone. LLU Local Loop Unbundling is a process by which the incumbent s local loop lines are disconnected and connected to another provider's network. QoS Quality of Service is the combination of various factors such as Throughput, Availability, Delay, Delay Variation and Loss. SIP Session Initiation Protocol. SIP is used for setting up communication sessions across an IP network. It can setup telephony, presence, events notification and instant messaging. Soft-phone a soft-phone is computer software that works in association with VoIP technologies and emulates a telephone on screen. TCP Transmission Control Protocol. A protocol used along with Internet Protocol (IP) to send data in packets between computers over a network. UDP User Datagram Protocol. Generally assumed to be unreliable and as such a connectionless protocol. UPS Uninterruptible Power Supply. Primarily used as a backup power source for computers and network equipment to ensure on-going operation in the event of a power failure. VoWiFi Voice over WiFi. VoWiFi extends the reach of VoIP to wireless devices. Wireless coverage still prevents VoWiFi challenging GSM networks and wireless Access Points (AP) are currently insufficiently coordinated to allow users to seamlessly hop from one AP to the next. 10

11 Resources VoIP Security Alliance -This website promotes the current state of VoIP security research, VoIP security education and awareness. VoIP Architecture - This website is a good starting point for learning more about VoIP. PSTN REPLAEMENT 11