2KKUU7ita

Chapter 13: Communication and Messaging Systems
If a VoIP network is not protected via network segmentation, such as a virtual
local area network (VLAN), then the voice network is especially susceptible to
eavesdropping, denial of service, and other attacks. But the VLAN barrier can
be overcome in Cisco and Avaya environments by using a tool called VoIP
Hopper (http://voiphopper.sourceforge.net). Just when you think
your voice systems are secure, a tool like VoIP Hopper comes along. Gotta
love innovation!
Unlike typical computer security vulnerabilities, these issues with VoIP
aren’t easily fixed with simple software patches. These vulnerabilities are
embedded into the Session Initiation Protocol (SIP) and Real-time Transport
Protocol (RTP) that VoIP uses for its communications. The following are two
VoIP-centric tests you should use to assess the security of your voice systems.
It’s important to note that although SIP is the most widely used VoIP protocol,
there is H.323. So, don’t spin your wheels testing for SIP flaws if H.323 is the
protocol in use. Refer to www.packetizer.com/ipmc/h323_vs_sip for
additional details on H.323 versus SIP.
Scanning for vulnerabilities
Outside the basic network, OS, and web application vulnerabilities, you can
uncover other VoIP issues if you use the right tools. A neat Windows-based
tool that’s dedicated to finding vulnerabilities in VoIP networks is SiVuS.
SiVuS allows you to perform the basic ethical hacking steps of scanning, enumerating,
and rooting out vulnerabilities. You can start by downloading and
running the SiVuS installation executable. (As of publication it’s available at
www.voip-security.net/index.php/component/jdownloads/view.
download/30/299.)
After SiVuS is installed, load the program and you’re ready to get started.
Figure 13-14 shows my results of the first SiVuS step — Component Discovery.
You can use Component Discovery to search for one or two specific VoIP
hosts, or you can scan your entire network. I recommend the latter because
I find looking for one specific host is a little quirky — and you never know
what other VoIP systems are out there that you could overlook.
271