2KKUU7ita

Figure 13-15:
SiVuS
discovered
several
VoIP-centric
vulnerabilities.
Chapter 13: Communication and Messaging Systems
Whether SiVuS’s results and recommendations are an issue in your environment,
I encourage you to sift through each one to determine what can and
should be fixed. Remember, odds are good that the bad guys both inside and
outside your network can see these vulnerabilities just as easily as you can.
You can also use SiVuS to generate SIP messages, which come in handy if you
want to test any built-in VoIP authentication mechanisms on your VoIP hosts.
SiVuS’s documentation outlines the specifics.
Other free tools for analyzing SIP traffic are PROTOS (www.ee.oulu.fi/
research/ouspg/protos/testing/c07/sip/index.html), and sipsak
(http://sipsak.org). A good website that lists all sorts of VoIP tools is
www.voipsa.org/Resources/tools.php.
Capturing and recording voice traffic
If you have access to the wired or wireless network, you can capture VoIP
conversations easily. This is a great way to prove that the network and the
VoIP installation are vulnerable. There are many legal issues associated with
tapping into phone conversations, so make sure you have permission and are
careful not to abuse your test results.
273