VoIP Security Vulnerability Analysis and protection methods (1)

As the bandwidth of the Data Network continues to expand, it is possible to reach the desktop by Mbit/s or even Gbit/s. The increase in bandwidth also provides powerful preconditions for voice transmission over the data network. At the same time, the VoIP technology is becoming increasingly mature. topics such as voice compression and Qos quality assurance have been widely discussed and reached consensus. It can be said that the VoIP technology has been dedicated to mature commercial applications from the original experimental nature.

Although the earliest application of VoIP in China is supplemented by circuit switching among operators, many enterprise users have begun to pay attention to the application of VoIP. For emerging small office enterprises, using the ample bandwidth of the new data network to carry voice is much easier than building an independent voice system, features are also not available in traditional voice switches such as mobile office. For industrial users, because there is a data network connected to each branch node, the use of IP relay for interconnection between Headquarters and branch nodes can save the high cost of renting long-distance circuit relay. Therefore, VoIP technology will be widely used in enterprise users.

However, in the implementation project or in the use process, users and equipment suppliers will focus more on how to improve the voice quality and integrate with existing data networks, the security risks of VoIP are rarely considered. Just as we put all important application servers under the protection of the firewall; in fact, in the case of VoIP, voice is also the same as that of data applications, it also becomes a "Packet ", it will also suffer from various viruses and hacker attacks. It's no wonder that someone said, "This is the first time in history that computer viruses can make your phone unable to work normally ."

What factors will affect VoIP? First, problems with the product itself. At present, the most common voice establishment and control signals for VoIP technology are H.323 and SIP. Although there are several differences between them, they are all an open protocol system. Each device manufacturer has its own components to carry, including IP terminal login registration, access control, and password connection. Some of these products use Windows NT operating systems, and some are based on Linux or VxWorks. The more open the operating system, the more vulnerable it is to virus and malicious attacks. Especially when some devices need to provide a Web-based management interface, they will have the opportunity to use Microsoft IIS or Apache to provide services, these applications are installed on the device when the product leaves the factory. It cannot be ensured that the latest version or commitment has already compensated for some security vulnerabilities.

Second, DoS attacks based on open ports. From the perspective of the methods and effects of network attacks, DoS is a simple and effective attack method. Attackers send a considerable number of service requests with fake addresses to the server. However, because the reply address is false, the server will not be able to wait for the response message, until all resources are exhausted. VoIP technology already has many well-known ports, such as 1719, 1720, and 5060. There are also some ports that the product itself needs to be used for remote management or private information transmission. In short, there are more ports than a common simple data application. As long as the attacker's PC and these application ports are in the same network segment, more detailed information can be obtained through simple scanning tools such as X-Way shared software.

A recent Security vulnerability was reported by NISCC (UK National Infrastructure Security Co-ordi-nation Center). The test results show that: "Many VoIP systems using the H.323 protocol in the market have vulnerabilities during H.245 setup, which are prone to DoS attacks on port 1720, resulting in system instability and even paralysis ".

The second is service theft. This problem also exists in the case of analog phones. Just as we have received multiple phone numbers on a common analog phone line, there will be a problem of phone hacking. Although the IP phone cannot be called in parallel, the user can also obtain the phone permission by stealing the login password of the user's IP Phone. Generally, when an IP Phone is logged on to the system for the first time, a prompt is prompted to enter the extension number and password of each person. Many enterprises that use VoIP need to facilitate remote/mobile work for employees, when a desktop phone is assigned, a virtual IP Phone is assigned and the password and dial-up permissions are granted.

In this way, even if employees are on a business trip or working at home, they can access the company's Lan through VPN, and then run the IP software in the computer to answer the phone or call the local phone, just like working in a company. After the password is lost, anyone can use their own soft phone to log in to another person's extension number. If you get the permission, you can freely call a domestic or international long-distance number, it will bring huge losses to enterprises and it is difficult to trace them.

The last is the question of media stream listening. The analog phones have the problem of parallel eavesdropping. When enterprise users use digital phones, it is difficult to listen through simple means because they all use proprietary protocols. However, this problem was raised again in the VoIP environment. A typical VoIP call requires two steps: signaling and media stream. RTP/RTCP is a protocol for voice information during packet-based network transmission. Because the Protocol itself is open, even a small piece of media stream can be replayed without the need for Association of the front and back information. If someone records all information on the data network through Sniffer and replays it through software, it will cause a crisis of trust in the communication between employees.