Positive Hack Days. Gurzov. VOIP - Reduce Your Expenses, Increase Your Income! Or Vice Versa?

VoIP security legends and myths Konstantin Gurzov Head of Sales Support Department

VoIP is attractive ! VoIP Access company’s network Manage calls ( fraud ) Data defect and replacement Call interception Personal data theft and so on …

VoIP infrastructure components VoIP segment is an integration of a number of specialized platforms and network devices, different networks and technologies

All local network threats are actual for VoIP ,[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],Known threats – former protection measures Примеры рассчитанных метрик на основе "живых" данных при проведении внутренних аудитов ИБ специалистами компании Positive Technologies , 2009 г. About 50% of all network devices have default or easily bruteforced passwords

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Examples Reconfiguration Minoring Interception

[object Object],[object Object],[object Object],[object Object],[object Object],Known threats – former protection measures If an attacker manages to access your device web interface, attacks are guaranteed to be successful

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Examples The possibility to detect vulnerabilities of different risk level, based on analysis of 5560 sites conducted by Positive Technologies experts, 2009

Known threats – former protection measures ,[object Object],Arbitrary code execution from the network in в CISCO Call Manager 6 Vulnerability allows attackers to execute arbitrary code

Known threats – former protection measures ,[object Object],Denial of service in CISCO Call Manager 6 Vulnerability allows attackers to cause a denial of service

[object Object],[object Object],[object Object],Known threats – former protection measures Any VoIP device is a member of Ethernet network, so it is vulnerable to a most part of network attacks

[object Object],[object Object],[object Object],[object Object],Known threats – former protection measures Traffic listening leads to violation of confidentiality and personal data thefts

Examples of real attacks ,[object Object],[object Object],[object Object]

Traffic fraud IP PBX 1 – Client’s IP PBX of «А» company IP PBX 2 – Attacker’s IP PBX ,[object Object],[object Object],[object Object],[object Object]

Traffic fraud – attacker’s actions ,[object Object],[object Object],[object Object],1 2 3 «А» operator is unable to explicitly separate responsibilities between itself and its client, so it pays always

Traffic fraud – can be avoided if ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Interception of negotiations ,[object Object],[object Object],[object Object],[object Object]

Capture corporate network ,[object Object]

Capture corporate network – attacker’s actions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2 3 ,[object Object],https://www.example.org/ccmuser/personaladdressbookEdit.do?key='+UNION+ALL+SELECT+'','','',user,'',password+from+applicationuser;-- 1 An attacker can capture all local network via VoIP services

Conclusions ,[object Object],[object Object],[object Object]

Advices to create secure infrastructure ,[object Object],[object Object],[object Object],[object Object],[object Object]

Thank you for your attention ! Questions ? Konstantin Gurzov [email_address]

Positive Hack Days. Gurzov. VOIP - Reduce Your Expenses, Increase Your Income! Or Vice Versa?

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (19)

En vedette

En vedette (7)

Similaire à Positive Hack Days. Gurzov. VOIP - Reduce Your Expenses, Increase Your Income! Or Vice Versa?

Similaire à Positive Hack Days. Gurzov. VOIP - Reduce Your Expenses, Increase Your Income! Or Vice Versa? (20)

Plus de Positive Hack Days

Plus de Positive Hack Days (20)

Dernier

Dernier (20)

Positive Hack Days. Gurzov. VOIP - Reduce Your Expenses, Increase Your Income! Or Vice Versa?

Notes de l'éditeur