Hacking VoIP Protocols, Attacks, and Countermeasures by Dwivedi, Himanshu -- Read -- Imperial Library of Trantor

Index

Hacking VoIP Protocols, Attacks, and Countermeasures

ACKNOWLEDGMENTS INTRODUCTION

Book Overview Lab Setup

SIP/IAX/H.323 Server SIP Setup H.323 Setup (Ekiga) IAX Setup

1. AN INTRODUCTION TO VOIP SECURITY

Why VoIP VoIP Basics

How It Works Protocols Deployments

VoIP Security Basics

Authentication Authorization Availability Encryption

Attack Vectors Summary

I. VOIP PROTOCOLS

2. SIGNALING: SIP SECURITY

SIP Basics SIP Messages Making a VoIP Call with SIP Methods

Registration The INVITE Request

Enumeration and Registration

Enumerating SIP Devices on a Network Registering with Identified SIP Devices Authentication Encryption

SIP with TLS SIP with S/MIME

SIP Security Attacks

Username Enumeration

Enumerating SIP Usernames with Error Messages Enumerating SIP Usernames by Sniffing the Network

SIP Password Retrieval

Data Collection for SIP Authentication Attacks An Example Tools to Perform the Attack

Man-in-the-Middle Attack Registration Hijacking Spoofing SIP Proxy Servers and Registrars Denial of Service via BYE Message Denial of Service via REGISTER Denial of Service via Un-register Fuzzing SIP

Summary

3. SIGNALING: H.323 SECURITY

H.323 Security Basics

Enumeration Authentication

Symmetric Encryption Password Hashing Public Key

Authorization

H.323 Security Attacks

Username Enumeration (H.323 ID) H.323 Password Retrieval H.323 Replay Attack H.323 Endpoint Spoofing (E.164 Alias) E.164 Alias Enumeration E.164 Hopping Attacks Denial of Service via NTP

DoS with Authentication Enabled

Denial of Service via UDP (H.225 Registration Reject) Denial of Service via Host Unreachable Packets Denial of Service via H.225 nonStandardMessage

Summary

4. MEDIA: RTP SECURITY

RTP Basics RTP Security Attacks

Passive Eavesdropping

Capturing Packets from Different Endpoints: Man-in-the-Middle Using Cain & Abel for Man-in-the-Middle Attacks Using Wireshark

Active Eavesdropping

Audio Insertion Audio Replacement

Denial of Service

Message Flooding RTCP Bye (Session Teardown)

Summary

5. SIGNALING AND MEDIA: IAX SECURITY

IAX Authentication IAX Security Attacks

Username Enumeration Offline Dictionary Attack Active Dictionary Attack

Targeted attack

IAX Man-in-the-Middle Attack MD5-to-Plaintext Downgrade Attack

Targeted attack-id001 Wildcard attack

Denial of Service Attacks

Registration Reject Call Reject HangUP Targeted attack-id002 Wildcard attack-id001 Hold (QUELCH)

Summary

II. VOIP SECURITY THREATS

6. ATTACKING VOIP INFRASTRUCTURE

Vendor-Specific VoIP Sniffing Hard Phones

Compromising the Phone's Configuration File Uploading a Malicious Configuration File Exploiting Weaknesses of SNMP

Cisco CallManager and Avaya Call Center

Using Nmap to Scan VoIP Devices Scanning Web Management Interfaces with Nikto Discovering Vulnerable Services with Nessus

Modular Messaging Voicemail System Infrastructure Server Impersonation

Spoofing SIP Proxies and Registrars Redirecting H.323 Gatekeepers

Summary

7. UNCONVENTIONAL VOIP SECURITY THREATS

VoIP Phishing

Spreading the Message Receiving the Calls

Making Free Calls Caller ID Spoofing

Example 1 Example 2 Example 3 Example 4

Anonymous Eavesdropping and Call Redirection Spam Over Internet Telephony

SPIT and the City Lightweight SPIT with Skype/Google Talk

Summary

8. HOME VOIP SOLUTIONS

Commercial VoIP Solutions

Vonage

Call Eavesdropping (RTP)

Voice Injection (RTP) Username/Password Retrieval (SIP)

PC-Based VoIP Solutions

Yahoo! Messenger

Eavesdropping on Yahoo! Messenger Injecting Audio into Yahoo! Messenger Calls

Google Talk Microsoft Live Messenger Skype

SOHO Phone Solutions Summary

III. ASSESS AND SECURE VOIP

9. SECURING VOIP

SIP over SSL/TLS Secure RTP

SRTP and Media Protection with AES Cipher SRTP and Authentication and Integrity Protection with HMAC-SHA1 SRTP Key Distribution Method

ZRTP and Zfone Firewalls and Session Border Controllers

The VoIP and Firewall Problem The Solution

Summary

10. AUDITING VOIP FOR SECURITY BEST PRACTICES

VoIP Security Audit Program Summary

About the Author COLOPHON

← Prev
Back
Next →

← Prev
Back
Next →