New vulnerabilities of VoIP that threaten Data Security

VoIP vulnerabilities have once become a threat to VoIP and its devices, resulting in unavailability or poor call quality. However, a recent finding shows that some types of VoIP attacks can be used to access the data network and steal information.

According to a survey by Sipera VIPER laboratory, portable computers running VoIP smart phones are the most vulnerable to attacks, which means that a portable computer running an enterprise VoIP Software phone can be compromised by security, moreover, hackers can control and delete or steal data on the portable computer.

Middleware in Joglekar is the leader in Sipera VIPER laboratory vulnerability research. He said the discovery was "significant" and its potential impact was even greater. The Sipera VIPER lab has discovered and released VoIP vulnerabilities to protect users from potential security vulnerabilities.

Joglekar said: "In general, VoIP and unified communication products are backdoors. attackers and hackers can access the network and steal your data ."

In the past, software phones running on Windows XP machines with SP2 patches were vulnerable to buffer overflow attacks, resulting in phone paralysis. However, a similar attack uses the SIP protocol to exploit this overflow attack. This attack embeds the code into the SIP protocol, arrives at the victim machine, and establishes a connection from the victim machine to the hacker computer, allowing the hacker to view, copy, delete, or steal files.

Joglekar said the vulnerability was tested on some types of software phones, but the probability of "other software phones" being attacked is also high.

"In any way, this vulnerability does not target a software phone or product," he said ."

"Data can be obtained from VoIP," he added. "typical data security tools cannot protect your data ."

Brendan Ziolo, the marketing director of Sipera Systems, said the threat is a new threat to the prospect of VoIP, which was previously considered as an isolated part of the network.

"The VoIP network has been disabled," he said. "If you destroy it, you will destroy the phone number. This is the result ."

However, the expansion of the VoIP network using the SIP Trunk Line and the increasing use of Wi-Fi dual-mode phones and other tools increase the risk because VoIP and data converge in one place.

To defend against such attacks, Joglekar said the company needs to ensure that their operating system patches are up-to-date and that robust encryption and authentication must be deployed on VoIP. There is a general misunderstanding that the VoIP device itself has built-in security. This is correct in many cases, but this level of security is not enabled in the default settings.

In addition, Ziolo says firewall and intrusion protection systems lack protection against certain VoIP vulnerabilities because they only focus on data and do not include enhanced VoIP protection. Since such attacks are carried out behind the scenes and won't attract people's attention for a long time, this will lead to a wrong security awareness.

Joglekar said the company believes that the firewall provides adequate protection, but considering that portable computers are more likely to act as servers that generate and receive calls, using VoIP and Unified Communication as typical IP communication is not enough.

"The firewall cannot truly protect voice and Unified Communication in real time," he added. To ensure the security of VoIP communication, deep packet inspection and behavior analysis are imperative.

Some tools provide special encryption, authentication, and other protection for VoIP, but many companies do not realize that similar tools they use in data are not compliant in the VoIP world. Similar vulnerabilities are also identified in Wi-Fi dual-mode fields and other Unified Communication tools (such as instant messaging tools.

Eric Winsborrow is the CMO of Sipera and former Deputy Director of product marketing at McAfee. He said that vulnerabilities related to VoIP that threaten data security should be a wake-up for more protection of VoIP.

"Enterprises spend billions of dollars on traditional data security and closely monitor the announcement of operating system vulnerabilities on the first Tuesday of the month," Winsborrow said. "At the same time, the Sipera VIPER lab has identified a detailed list of VoIP vulnerabilities that can be used to disrupt critical enterprise communications and steal confidential data through a security vulnerability that cannot be addressed by data security vendors. It is only for the use of such vulnerabilities. if they occur, the consequences will be very serious ."

1. Small security measures block VoIP Security Vulnerabilities
2. Cisco VoIP server and webshell Server Security Vulnerability
3. Security risks of VoIP in WLAN Networks