2KKUU7ita

270
Part V: Hacking Applications
Figure 13-13:
A
WebInspect
scan of
a VoIP
network
adapter
showing
several
weaknesses.
Looking at these results, apparently this device is just a basic web server.
That’s exactly my point — VoIP systems are nothing more than networked
computer systems that have vulnerabilities that can be exploited.
On the other hand, two major security weaknesses are tied specifically to
VoIP. The first is that of phone service disruption. Yep, VoIP is susceptible to
denial of service just like any other system or application. VoIP is as vulnerable
as the most timing-sensitive applications out there, given the low tolerance
folks have for choppy and dropped phone conversations (cellphones
aside, of course). The other big weakness with VoIP is that voice conversations
are not encrypted and thus can be intercepted and recorded. Imagine
the fun a bad guy could have recording conversations and blackmailing his
victims. This is very easy on unsecured wireless networks, but as I show in
the upcoming “Capturing and recording voice traffic” section, it’s also pretty
simple to carry out on wired networks.