VOIP Security

[DGK]

I have to assess the security threat of using generic password (12345) for our IP Phones. Apart from making calls on someone elses phone, which the can do anyway using the current setup, is there any major security concerns I should be aware of when setting basic generic passwords?

[Cliphead]

I have to assess the security threat of using generic password (12345) for our IP Phones. Apart from making calls on someone elses phone, which the can do anyway using the current setup, is there any major security concerns I should be aware of when setting basic generic passwords?

You have to ask? Post your bank details here or quit trolling...

[DGK]

In other words you don't know.

Thanks anyway.

[Churchill]

In other words you don't know.

Thanks anyway.

Given access to your VOIP phone you will be able to check the configuration of the phone. Its IP address and its Port numbers (RTP & RTCP).

Once you have the IP Address, RTP & RTCP port numbers it's possible to flood your network with rogue RTP packets and jam voice communication.

Very few VOIP phones actually filter out RTP packets that come from IP addresses other than those authorised during the SIP hand-shaking.

Have fun!

[snaw]

Given access to your VOIP phone you will be able to check the configuration of the phone. Its IP address and its Port numbers (RTP & RTCP).

Once you have the IP Address, RTP & RTCP port numbers it's possible to flood your network with rogue RTP packets and jam voice communication.

Very few VOIP phones actually filter out RTP packets that come from IP addresses other than those authorised during the SIP hand-shaking.

Have fun!

Not quite.

You're inside the network anyway if this your intention, even with a login there is nothing stopping you going up to someone's desk and seeing what their IP address is, then plugging your device in and flooding on UDP 16384 - 32768.

Then again you could have port security +/or using CDP to detect the attached device is a phone mitigating any risk there, also assuming your QOS is done properly (Markings, limit traffic, police scavenger etc) to stop any rogue devices consuming all yer bandwidth

;-)

[Churchill]

Not quite.

You're inside the network anyway if this your intention, even with a login there is nothing stopping you going up to someone's desk and seeing what their IP address is, then plugging your device in and flooding on UDP 16384 - 32768.

Then again you could have port security +/or using CDP to detect the attached device is a phone mitigating any risk there, also assuming your QOS is done properly (Markings, limit traffic, police scavenger etc) to stop any rogue devices consuming all yer bandwidth

;-)

How many VoIP phone systems actually utilise RTCP or even have it implemented?

Most IP Phones will ignore UDP packets unless the RTP header is defined.

[snaw]

It's not the phones that are important. It's the UDP chewing up your bandwidth, or a UDP attack on your call manager/voice gateway. Something along those lines I'd be worried about.

[Churchill]

It's not the phones that are important. It's the UDP chewing up your bandwidth, or a UDP attack on your call manager/voice gateway. Something along those lines I'd be worried about.

How about a series of G711 packets being transmitted with the phrase "**** You too!" on the relevant ports?

You'd really want something to flood the jitter buffer to be really destructive. And that isn't gonna happen unless the RTP header is valid...

[snaw]

How about a series of G711 packets being transmitted with the phrase "**** You too!" on the relevant ports?

You'd really want something to flood the jitter buffer to be really destructive. And that isn't gonna happen unless the RTP header is valid...

Are you just cherry picking VOIP phrases out of a wiki or something?

In terms of damage done by using VOIP, the CODEC doesn't really matter. Most likely you'll not actually be trying to set up a call, you're just hijacking the voice vlan for either DOS type attacks, or maybe just trying to capture traffic so you could replay a conversation. Either way you're relying on physiacl access.

The RTP header validity doesn't matter to a router, if it comes in on the relevant UDP port with a valid destination then it'll forwarded (Remember most likely not trying to set up an actual call when there's an attack). The jitter buffer is dynamic, and yes you could potentially flood it and impact general voice - but that's kind of what I'm saying anyway (By product of chewing your bandwidth up, maxing out your router resources etc) - not really relevant to the phones themselves. If your QOS is done properly then the packets won't get as far as the jitter buffer since they'll be getting dropped before they reach that stage.

[Churchill]

Are you just cherry picking VOIP phrases out of a wiki or something?

In terms of damage done by using VOIP, the CODEC doesn't really matter. Most likely you'll not actually be trying to set up a call, you're just hijacking the voice vlan for either DOS type attacks, or maybe just trying to capture traffic so you could replay a conversation. Either way you're relying on physiacl access.

The RTP header validity doesn't matter to a router, if it comes in on the relevant UDP port with a valid destination then it'll forwarded (Remember most likely not trying to set up an actual call when there's an attack). The jitter buffer is dynamic, and yes you could potentially flood it and impact general voice - but that's kind of what I'm saying anyway (By product of chewing your bandwidth up, maxing out your router resources etc) - not really relevant to the phones themselves. If your QOS is done properly then the packets won't get as far as the jitter buffer since they'll be getting dropped before they reach that stage.

No I'm not "Cherry Picking", I've developed VoIP software for Mitel, ADP Communications and Siemens Nixdorf.

In your posts you're mentioning a complete DOS of the network. I'm answering the original posters questions by detailing what can be done to selectively target the VoIP functionality on a network.

With regards to QOS, not many "rendering" devices (Phones) actually utilise RTCP correctly, as mentioned in my previous posts. I also mention G711 (I could've mentioned G729 or any number of other CODECS but I think you'll find that G729 and G711 are the most common) because it's possible to inject audio into an already established SIP session.

Are you being deliberately antagonistic?