From: Brewis, Mark (mark.brewis@eds.com)
Date: Thu Dec 09 2004 - 15:24:46 EST
>>-----Original Message-----
>>From: Brewis, Mark
>>Sent: 16 November 2004 16:49
>>To: 'Frederic Charpentier'; pen-test@securityfocus.com
>>Subject: RE: VoIP pentest ?
>>
The original of this was bounced/timed out.
>>
One tool to have a look at is Sivus - a VoIP Vulnerability Scanner:
www.vopsecurity.org. You do need to understand SIP to get the most out of
this though.
Of course, VoIP isn't just SIP - it is only one of the current protocols.
The SJ Labs SJphone softphone from softjoys.com offers a really flexible
means of testing VOIP environments/connections. The SJ phone is useable for
30 days. There are several other freely available Softphones out there.
Some of the Softphones can also work as PBX, which offers another set of
test scenarios.
Try making peer to peer calls within an environment, (bypassing the normal
architecture) then directly configuring Gateways within the phone to utilise
the VoIP architecture to make calls. In this way it can be possible to
bypass restrictions on numbers (eg mobile or premium rate numbers) or
billing systems.
VoIP can introduce more traditional holes within security architecture, in
routers and firewalls, which are always worth an explore.
Unless VoIP encryption is used, the interception of VoIP data is a major
issue. Ethereal does a really good job of capturing and converting streamed
UDP to .au files. Use the most recent Ethereal for this. It is far easier
to use than Vomit (I've experienced a lot of compile errors with Vomit in
the past) and is available for multiple OS.
As Mark has pointed out, using VoIP multiplies all your network issues.
Power outages may take down your phone system whether they are PSTN or VoIP,
but viruses may take down your phone system, a router config error may take
down your phone system as well under VoIP.
VoIP has a whole raft of novel issues surrounding it - technical,
quality/performance (there's no traffic prioritisation with IP - on loaded
networks, voice quality can be poor), financial, security, legal.
Concentrating on the technical will only give a very small part of the
picture.
Hope this helps,
Mark
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:10 EDT