VoIP Monitor - Security

Security Researcher Demonstrates Enterprise VoIP Phone Hack at Recent Amphion Forum

VoIP Monitor — Wed, 12 Dec 2012 22:24:43 GMT

During the recent Amphion Forum, a conference where device and mobile security experts from different disciplines gather, Ang Cui, a fifth-year grad student from the Columbia University Intrusion Detection Systems Lab, demonstrated how connected devices such as networked printers and VoIP phones can be easily hijacked to give intruders virtually unlimited remote access to extremely sensitive information and allow them to eavesdrop on private conversations. The Amphion Forum is hosted by Mocana, a leader in device and mobile security.

Using a common Cisco-branded VoIP phone, Cui inserted and then removed a small external circuit board from the phone’s Ethernet port—something Cui asserted could be easily accomplished by a company visitor left unattended for a few seconds—and starting using his own smartphone to capture every word spoken near the VoIP phone, even though it was still ‘on-hook.’ While he did not specify the precise vulnerability, Cui said it allowed him to patch the phone’s software with arbitrary pieces of code, and that this allowed him to turn the Off-Hook Switch into what he called a “funtenna.” According to Cui, once one phone is compromised, the entire network of phones is vulnerable. Cui later said he could also perform a similar exploit remotely, without the need to insert a circuit board at all.

The vulnerability Cui demonstrated was based on work he did over the last year on what he called ‘Project Gunman v2’, where a laser printer firmware update could be compromised to include additional, and potentially malicious, code. With this, it becomes possible to remotely compromise a printer located within the organization’s firewall and eavesdrop on documents being printed or stored, without ever setting foot on the premises. The compromised printer could then be used to launch other attacks on the internal network. The demonstration at the Amphion Forum in San Francisco took such an attack even further.

Cui pointed out that current security solutions don’t work with embedded systems like VoIP phones and printers and code signing isn’t enough. “Signing files doesn’t make the files secure,” Cui said.

He also said that routers, printers and phones are general-purpose computers without host-based intrusion systems or antivirus protection built in, so they make attractive targets. Further, they often lack encryption for data in motion or at rest.

Cui’s research was carried out as part of a DARPA CRASH (from the I2O office) and IARPA Stonesoup Program, and he recently briefed agencies of the U.S. federal government about the potential for a serious attack on all its Cisco Unified VoIP phones.

“The VoIP phone vulnerability demonstrated at the Amphion Forum was a stark reminder of the need to address the device security mess. The sad fact is that most devices connected to corporate networks, like printers and VoIP phones, are almost totally unsecured,” said Kurt Stammberger, CISSP, vice president of market development at Mocana and chair of the Amphion Forum. “The Amphion Forum is a unique event where thought leaders from academia, business, government and technology can gather to discuss the threats and opportunities presented by the unprecedented proliferation of mobile and connected devices that are creating the Internet of Things.”

The Amphion Forum was founded to provide a medium for stakeholders in the smart device economy to share solutions and forge a clear direction for the future of the Internet of Things. The most recent event was held in San Francisco on December 5 and attracted more than 350 participants and thought-leader presenters, making it the largest and most successful Amphion event since it was founded in 2011. Event organizers believe that by fostering a World Economic Forum-type environment, where big thinkers can share ideas for some of the most pressing issues facing the global device infrastructure, safer medical electronics, increased energy security and more secure industrial automation.

Vertex Telecom Selects RedShift Networks as the VOIP/SIP Security Solution for Enterprise and Wholesale Customers

VoIP Monitor — Tue, 02 Oct 2012 21:20:15 GMT

Vertex Telecom has selected RedShift Networks to provide their Unified Communications, Collaborations, VoIP and Video UCTM Security technology; which is currently being switched on Vertex Telecom VOIP/SIP network. Additionally, Vertex Telecom has selected RedShift Networks to develop three custom program models for wholesale into three sectors: Financial, Healthcare and Government. The three additional models will work in conjunction with the “core” and “edge” products installed at Vertex Telecom.

RedShift Networks has deployed its UCTM appliances as a first step to further protect and lock down the “core” and “edge” of Vertex networks. According to Amitava Mukherjee, president, CEO and founder of Redshift Networks, “Our UCTM appliance security solution includes a patented behavioral learning engine that automatically gathers network intelligence identifying potentially dangerous vulnerabilities. Coupled with Redshift’s global threat signature database and blacklisting service, Vertex now has a comprehensive UC/VOIP threat management solution built into its core network.”

“We are very excited with our security solutions being implemented into award winning facilities like Vertex Telecom’s. We expect to grow our enterprise business with Vertex into the Philippines and Taiwan telecom markets with the rest of this year and in 2013.” RedShift Networks, Robert Barker, Regional Sales Director, RedShift Networks.

netTALK Announces Free Advanced Privacy Features Added to its DUO VoIP Devices

VoIP Monitor — Thu, 12 Jul 2012 20:23:01 GMT

netTALK.com announces the launch of new privacy features: Caller ID Block and Call Blocking. These are being added to netTALK’s long list of free features, which is already overflowing with value and convenience for netTALK DUO digital phone users. All you need is a high speed internet connection and any standard home phone.

The new privacy features are now fully-integrated into all netTALK DUO digital phone service accounts, and using them could not be more simple or easy:

For caller ID blocking on your outgoing calls, simply dial *77, followed by the number and your call will come up as “UNKNOWN” on the recipient’s caller ID.
To block incoming calls from a specific number, log into your account and click on 'Phone Numbers' and enter a phone number you want to block including callers that use UNKNOWN or anonymous on their caller ID.

Sangoma Enhances IP Security Offering with SBC Release

VoIP Monitor — Tue, 08 May 2012 20:45:30 GMT

Sangoma announces the release of its Vega 400 SBC stand-alone Session Border Controller appliance,. The solution is designed to provide seamless connectivity between VoIP networks and SIP Trunking connections, while delivering security and policy enforcement to ensure call quality and reliability.

Located between disparate IP networks or systems, the SBC helps customers contain and control vulnerabilities that can be exploited in SIP-based networks to misappropriate or misuse VoIP resources and systems. The Vega 400 SBC provides encryption of media and signaling, as well as call access control, secure network logon and secure management interfaces. In addition to the security functions, the SBC provides a broad range of intermediation and core VoIP capabilities necessary to ensure proper call handling and call quality.

Supporting a wide range of audio codecs, the Vega 400 SBC performs transcoding when necessary to facilitate call media handling. Key VoIP call quality measures and features enable the device to provide many VoIP gateway functions, such as adaptive jitter removal, comfort noise generation and silence suppression, QoS statistics reporting, and hardware-based echo cancellation.

VoIP Fraud Could Kill Your Company - FraudStopper Kills the Fraud

VoIP Monitor — Mon, 03 Oct 2011 22:50:02 GMT

ECG announces the success of FraudStopper, a new toll-fraud detection system optimized for VoIP providers. FraudStopper was deployed in June 2011 at a nationwide CLEC based in New York City. The system has successfully detected numerous incidents of attempted theft of service, saving the CLEC tens of thousands of dollars in losses for international termination.

VoIP Toll Fraud became a major issue for many carriers in November 2010, when thieves began using the "SIPVicious" security scanning tool to search the Internet for VoIP service that could be stolen. ECG estimates that over US $1M in international termination service has been stolen by criminals targeting VoIP service providers in the United States. Some individual incidents have amounted to more than US $160,000.

Most fraud detection systems have simplistic thresholds to identify risky behavior. If a customer appears to make a large number of international calls, the system will alert automatically. But if that same customer routinely makes a large number of international calls and pays for the service, it could simply be their normal course of business. Such simplistic schemes cannot handle the wide diversity among VoIP customers, some of whom make no international calls, while others make numerous calls.

“FraudStopper learns the normal behavior for customers by analyzing historical billing records to determine what is routine for each individual,” said James Puckett, President of ECG. “Statistics are tracked per customer in the User Behavior Database. When international calling occurs that does not match a customer's profile, FraudStopper can detect that change and report the risk.”

However, ordinary activity on a Monday might be fraudulent levels on a Saturday. FraudStopper's dynamic database understands weekly patterns of work. The User Behavior Database compares details from the day of the week extending far into the past to make accurate judgments and reduce false positives.

Alerting from FraudStopper is done through email and SNMP. The email describes the user suspected of fraud, and the historical profile for the user. This allows operations staff to determine the risk and make a judgment. The SNMP trap allows integration with Network-Management tools like HP OpenView and SolarWinds.

The Real-Time Call Progress Monitor in FraudStopper can receive input data from practically any source. Full integration with real-time or batched data sources is available. ECG has integrated using CDRs from Metaswitch, BroadSoft, Acme Packet, Alcatel-Lucent, and others.

VoIP Supply Adds Grandstream IP Surveillance Line

VoIP Monitor — Tue, 09 Aug 2011 21:02:35 GMT

VoIP Supply is pleased to announce a refreshed Grandstream Networks product line and the addition of a brand new category, Grandstream IP Surveillance.

Making customer research easier by revamping and reorganizing Grandstream products with newly segmented Grandstream Video Phones and Grandstream IP PBX appliance categories, VoIP Supply has also added the Grandstream IP Surveillance line featuring IP cameras for network-based surveillance.

Just like Grandstream’s VoIP devices, Grandstream IP Surveillance products offer the same broad interoperability, enhanced features, and flexibility at price-performance competitiveness allowing easy entry into IP network-based security systems.

“VoIP Supply’s Grandstream line just got a lot stronger with Grandstream IP Surveillance products,” said Garrett Smith, Chief Marketing Officer at VoIP Supply. “VoIP and IP camera technology are intertwined so it’s great to give customers a single stop to research all of Grandstream’s cost effective network-based solutions.”

Cellcrypt Launches Encrypted Voice Calling for Android Smartphones

VoIP Monitor — Tue, 14 Jun 2011 17:40:20 GMT

Cellcrypt has launched Cellcrypt Mobile for Android, a version of its encrypted voice calling application that runs on Android devices operating over Wi-Fi, GSM and CDMA wireless networks.

Cellcrypt Mobile provides encrypted voice calling for off-the-shelf cell phones using government-certified security in an easy-to-use downloadable application that makes highly secure calling as easy as making or placing a normal phone call. It is a software-only solution that uses the IP data channel of cellular (2G, 3G, 4G), Wi-Fi and satellite networks and can be deployed to personnel anywhere in the world in as little as 10 minutes.

Cellcrypt Mobile is in use by governments and corporations globally, uses cryptography certified to U.S. government National Institute of Standards and Technology FIPS 140-2 security standards and has been awarded the CESG Claims Tested Mark from the U.K. government’s information assurance authority.

The interception threat level increased during 2010 as hackers developed, demonstrated and published details of low-cost air-interface interception equipment that uses open source software freely downloadable from the internet and a generic off-the-shelf radio transceiver costing less than $2,000. Another group of hackers demonstrated interception in December 2010 using four modified cell phones as transceivers each costing $15 (interception was filmed in London by the BBC in April 2011 http://www.bbc.co.uk/news/technology-13013577). At least one top-tier European University has added practical lessons in GSM interception to its curriculum.

At the same time as the threat level is increasing, the use of cell phones for discussing sensitive and confidential information has also increased, even among government employees, due to the ease of use, ubiquity and interoperability of mobile phones. This leads to an increased need for government-grade end-to-end protection that provides assurance that call security is controlled along all points of the call path between caller and recipient and risks are adequately mitigated in compliance with internal security policies.

Cellcrypt Mobile for Android is available immediately on devices supporting Android 2.3 and is interoperable with Cellcrypt running on other devices such as Nokia and BlackBerry® smartphones.

Dialogic Selected by microDATA to Support Next Generation 9-1-1 Services

VoIP Monitor — Wed, 01 Jun 2011 15:59:44 GMT

Dialogic announced that microDATA selected Dialogic to support its Next Generation 9-1-1 services. Through its use of Dialogic technology, microDATA provides reliable call routing support for high volumes of calls and other forms of communication like SMS and data messaging, and will be able to roll out its NG9-1-1 services quickly while complying with ever-evolving industry standards.

microDATA also selected Dialogic’s technology in order to poise itself to handle increased data and information sharing requirements for the future. Advancements in communication technologies have made some existing 9-1-1 systems outdated. Using Dialogic’s technology, microDATA works with phone companies to update legacy networks to IP-based services as well as to enable 9-1-1 systems to receive packet-based voice data and field other forms of communication like SMS, data messaging and video conferencing.

NextAlarm Launches New VoIPAlarm Marketing Campaign

VoIP Monitor — Wed, 01 Jun 2011 15:51:01 GMT

NextAlarm announces the launch of an extensive marketing campaign targeted at the alarm industry. The company's VoIPAlarm brand, focused on sales to alarm companies, will receive a push from well-known industry veterans Tom Christ and Terry Gurley. A series of biweekly webinars has begun to educate dealers about the product.

Christ and Gurley, with over twenty collective years of experience in the alarm industry, have previously built dealer networks of over 800 companies within 18 months. They specialize in high-tech products in the security space and are expert in training alarm dealers to identify, sell to, and support customers of technologies like VoIPAlarm's alarm broadband adapter.

VoIPAlarm was designed as a solution for alarm dealers and monitoring services losing customers due to the advent of VoIP telephone services. The majority of alarm systems installed in homes and businesses today are unable to reliably communicate over VoIP, as they were designed with the specific tolerances and DTMF ranges of standard PSTN phone lines. VoIPAlarm allows these alarm systems to communicate over broadband with the addition of a single, inexpensive adapter, called the broadband IP adapter. The adapter also works to re-enable alarms in locations that have disconnected their phone lines entirely, such as homes whose residents have switched to using cell phones. Unlike other broadband alarm products, VoIPAlarm is compatible with most alarm systems built in the last 20 years, and functions over any broadband Internet connection. Also unique to VoIPAlarm is support for two-way voice communication between a central station operator and an alarm owner, a feature common in medical alert systems and higher-end security systems.

VoIPAlarm also offers the IP video product NextView, which currently includes a fixed camera and a movable camera with pan and tilt, with an outdoor camera available soon. NextView cameras feature customized firmware that allows the NextView service to react to any alarm event. When an alarm panel reports an event through the VoIPAlarm platform, the system provides the customer and authorized dealer with video both prior to and after the alarm event. Using a proprietary buffering technology, the subscriber or dealer can view the seconds leading up to an alarm, as well as video taken after the event occurred.

Webinars are held twice a week to show VoIPAlarm to alarm dealers and other interested parties. Special introductory pricing is available exclusively through these webinars. To register for a free session, visit http://www.voipalarm.com/webinar.

VoIP and SIP Trunking - The Security Issues

VoIP Monitor — Mon, 16 May 2011 16:31:50 GMT

For those of you looking to replace PSTN connectivity, so you can take full advantage of VoIP, giving you much cheaper local, toll-free, domestic and international long-distance services, then SIP trunking can help you save money. That’s why it’s increasingly popular.

SIP trunks eliminate costly time-division multiplexing trunks and gateways, allowing calls to be routed over the carrier’s backbone and use the same IP connection for all communications.

But the caveat is that it needs to be secured. With most VoIP systems, the PSTN serves as a barrier between a company and the outside world, minimising the risk of attack from the Internet. If SIP trunking replaces the PSTN, then that barrier is removed and your phone system becomes vulnerable to IP-based attacks through the SIP trunk.

Security issues around SIP trunking include whether or not you have the same security requirements and security policies as your provider; what changes might have to be made to the firewall, NAT device, IP PBX, private IP addresses, numbering plan and other components; and how you will maintain user/caller ID privacy.

You wouldn’t contemplate connecting your data network to the Internet just relying on the router for security. Everyone has a firewall for good reason. Similarly, protecting your SIP connection is crucial.

To ensure security, you need to deploy a real-time security solution which provides comprehensive threat protection, strict policy enforcement, robust access control, and privacy.

Some data firewall suppliers have now extended their solutions to meet some of the security requirements for connectivity. However, as in all things to do with security, it is sometimes better to deploy specialist solutions for specialised requirements.

Companies like Sipera are now providing solutions which specifically address UC security issues, including SIP trunking. Sipera’s UC-Sec appliance solution, for example, serves as the demarcation point for the client’s VoIP and UC network, enforcing fine-grained security policies.

It protects against SIP and RTP threats, by blocking them at the enterprise perimeter. It maintains the privacy of the internal network, caller/user IDs, and communications, as well as performing firewall/NAT traversal to simplify the deployment of SIP trunks.

Ooma Provides Real-time Emergency Alerts with New 911 Notifications Feature

VoIP Monitor — Tue, 10 May 2011 15:00:56 GMT

Ooma introduced its 911 Notifications feature, radically advancing critical communications during a home emergency situation. With the 911 Notifications feature, Ooma Premier subscribers can enter up to three email addresses or mobile phone numbers into the 911 Notifications area of the “My Ooma” online control panel. The Ooma 911 Notifications feature will then send alert messages to specified recipients the very moment 911 is called from the subscriber’s Ooma phone number. When safety is a top priority, the 911 Notifications feature from Ooma fits the bill like no other.

Pricing

Ooma Telo retails for $249.99. Ooma Premier is an optional level of service offering multiple advanced telephony features and services, including new 911 Notifications, and costs $9.99 per month. New customers signing-up for one-year of Ooma Premier service receive their choice of a free number port, Ooma Telo handset, Ooma Bluetooth Adapter or extended warranty.

Availability

The Ooma Telo is available at Ooma authorized resellers including: Best Buy, Costco, Datavision, Fry’s Electronics, J&R, Micro Center, and leading online destinations including Amazon, BestBuy.com, Buy.com, Costco.com, Dell.com, JandR.com, NewEgg.com, OfficeDepot.com, PC Mall, Provantage, Shop Harmony, Staples.com, Sears.com, K-Mart.com, Tiger Direct, RCS, Nebraska Furniture Mart, B&H Photo and Walmart.com.

Report: Mobile VoIP - Is it Really a Threat to Operator Voice Revenues?

VoIP Monitor — Tue, 03 May 2011 17:35:53 GMT

Research and Markets has announced the addition of the "Mobile VoIP - Is it Really a Threat to Operator Voice Revenues?" report to their offering.

This study looks at the changing landscape of the mobile VoIP market; the main over the top players, the new entrants together with what they bring, and how the operators are reacting. The technical challenges are assessed, and an analysis as to the level of threat mobile VoIP brings to operator revenues is made. It concludes with a scenario for the development of this emerging market.

Key Questions

Who are the new entrants in the mobile VoIP market and how does it change the competition landscape?
User experiences, current networks and upcoming LTE deployments - what are the technological challenges ?
Which major OTT and managed solutions are on the Mobile VoIP market? How are the Internet Giants positioning there?
What are the key trends for Mobile VoIP applications?
How will the mobile VoIP market evolve by 2015, in the context of more regulation& competition on the voice market?

Data & Forecasts up to 2015 covered in the report:

Worldwide mobile VoIP user and penetration of 3G subscribers
Worldwide mobile VoIP volume (billion minutes)

Sipera Systems UC Security Solution Undergoes Compatibility Testing With McAfee ePolicy Orchestrator Security Management Platform

VoIP Monitor — Tue, 19 Apr 2011 21:40:56 GMT

Sipera Systems announced that its award-winning UC-Sec enterprise communications security solution is undergoing compatibility testing with McAfee ePolicy Orchestrator security management platform.

When the testing is completed, security managers can gain visibility into the entire spectrum of IP-based business communications -- including voice, video, data and web applications -- from a single central management point. This enables security managers to have unprecedented control over the security of voice-over-IP, IP video conferencing, SIP trunks, collaboration applications and other UC applications.

The Sipera UC-Sec appliance is a plug-and-play network device that provides comprehensive security for real-time UC applications. As a complement to the existing security architecture, the UC-Sec provides application-layer firewalling, intrusion prevention, threat mitigation, access control and policy enforcement in real-time for delay sensitive applications.

The UC-Sec encrypts UC-traffic, terminates SIP trunks, forks media and signaling for compliance, and permits an enterprise to safely and securely extend VoIP and UC to any end point in any location. Sipera's customers use the appliance to conduct secure VoIP on smartphones, in remote offices, to distributed call center representatives and to enforce security policies on all UC traffic in real-time.

The Sipera security system is undergoing compatibility testing as part of its participation in the McAfee® Security Innovation Alliance (SIA) program, which helps accelerate the development of interoperable security products and simplifies the integration of these products within complex customer environments.

Sipera's groundbreaking "Borderless UC" architecture enables all communications to be encrypted and compliant on any UC device, at any internal and external location.

cAfee ePolicy Orchestrator platform is the first to let enterprises and governments centrally manage security and compliance products from multiple vendors, offering unprecedented cost savings and return on investment. With more than 40,000 customers and managing more than 60 million PCs and servers, this unique platform is helping McAfee SIA partners to extend their reach and create complementary functionality.

SANS to Teach VoIP Security Course for First Time in Europe

VoIP Monitor — Mon, 18 Apr 2011 19:50:07 GMT

The SANS Institute will be teaching the first European session of its new Security 540: VoIP Security course at the upcoming SANS Secure Europe event in Amsterdam this May. The 6-day course which debuted last year in Sacramento has proven popular and is already at 50% capacity.

“Voice over IP is a rapidly growing area due to the huge cost saving potential but organisations often fail to consider the security impact,” explains Paul Henry, one of the world's foremost information security and computer forensic experts with more than 20 years' experience.

Henry points to examples such as arrests made In Budapest and London last year of 30 members of an organised criminal gang that allegedly stole 11 million Euro’s through VoIP toll fraud. The gang used thousands of stolen VoIP account details to make 1.5 million calls to premium rate numbers which, in turn paid the gang a percentage of the inflated call charges. Other cases like Edwin Andres Pena who was sentenced to 10 years in jail in a US Federal Court for stealing and reselling VoIP call credits are part of a growing trend. “The automated billing mechanisms of VoIP services using direct debit or credit cards make these prized targets for criminals who often have difficulty selling stolen data,” Henry adds.

However, the problem is not just the theft of calling credits. As data and voice coexist on the same networks, criminals use weaknesses in one area to gain access to the other. “The information gained from hacking into sensitive voice conversations can be used for insider trading or corporate espionage,” explains Henry who points out that few organisations encrypt VoIP traffic sent across shared networks. “The widely held assumption that VoIP traffic is difficult to intercept is plainly wrong,” he comments, pointing to a growing number of free tools that will capture SIP based voice calls and turn them into audio files via minimal access to a shared IP network.

Henry, who regularly advises and consults on some of the world's most challenging and high-risk information security projects, believes that only 1 in 10 organisations that deploy VoIP specifically look at the security implications of these new voice services.

The SEC540 course that Henry will teach at SANS Secure Europe provides VoIP security best practices and technologies in order to design, deploy, and audit trusted VoIP infrastructures. The intensive course offers a detailed in-class analysis of infrastructure, signalling, and media attacks to expose the security risks of VoIP networks for service providers, carriers, and enterprises.

Students will be shown how to understand and protect against various attacks from VoIP signalling and media eavesdropping, caller ID impersonation, and VoIP authentication cracking to man-in-the-middle call manipulation and media injection. “The course is very hands on and will give attendees a real understanding of how to test and protect VoIP networks against an increasingly focused and organised criminal element,” Henry concludes.

More information on SANS Secure Europe 2011, which takes place from May 9th to 21st in Amsterdam, is available at http://www.sans.org/secure-amsterdam-2011

Voip-Pal.Com Announces the Launch of Its New PointsPhone Platinum Suite Which Includes an Antivirus Program for North America Android Users

VoIP Monitor — Mon, 11 Apr 2011 14:43:48 GMT

Voip-Pal.Com announces the availability for North America Android users of its PointsPhone Platinum Suite package which bundles an Antivirus Program. The Antivirus Program has been designed specifically to guard smartphones against spyware, malware and viruses.

The PointsPhone Platinum Suite is now available in North America only for all Google Android smartphones, including the new high-performing Motorola ATRIX and Samsung's Galaxy 4G. The Platinum Suite will include a one year subscription to a state-of-art antivirus program, substantial domestic and international airtime minutes, enhanced Voice Mail features and a free North America phone number. The antivirus program is truly comprehensive, providing automatic real-time protection against viruses, spyware and other malware. Memory cards are automatically scanned when they are inserted to prevent transfer of malware and viruses. A GPS locating system is available to track down lost or stolen smartphones. A Remote Backup feature is available to backup all data stored on the smartphone in case the smartphone is lost or stolen.

Users will register and purchase a Platinum Suite for $29.95. A User account and password will be created and users will have immediate access to their account for airtime minutes, Voice Mail and virtual phone numbers. A registration number for their Antivirus Program will be sent as a text message to their smartphone which will provide access to download their Antivirus Program within 48 hours (to complete fraud check). A free North America Phone Number is allocated. The PointsPhone Mobile App for the Android is downloaded free from the Android Market App Store (search 'pointsphone').

For more information on PointsPhone products and services please click on link: http://www.youtube.com/watch?v=-vSnIpCsnS0

WatchGuard Teams with Mitel

VoIP Monitor — Fri, 08 Apr 2011 17:16:24 GMT

WatchGuard Technologies will provide next-generation firewall appliances for businesses using Mitel unified communications solutions. By doing so, businesses gain superior VoIP protection for their award-winning Mitel UC solutions, as well as their corporate networks, applications and data.

All WatchGuard XTM security appliances provide unparalleled VoIP protection, which is critical in securing business UC environments. Specifically by having SIP and H.323 proxy protection, WatchGuard XTM appliances protect against a multitude of VoIP threats, including denial of service attacks, spam over Internet telephony (SPIT), voice service theft, registration hijacking, eavesdropping, directory harvesting, voice phishing (vishing) and more.

NextAlarm Announces Streamlined Interface for VoIPAlarm Broadband Alarm Conversion

VoIP Monitor — Thu, 07 Apr 2011 16:59:43 GMT

NextAlarm announces a complete overhaul of its VoIPAlarm platform. VoIPAlarm, in operation for several years, is a product that upgrades most alarm systems to send signals over broadband Internet, even if they were built to use only standard telephone lines. The enhancements to the platform are designed to enhance usability and streamline operation, and will speed up installations for alarm dealers using the product.

VoIPAlarm was designed as a solution for alarm dealers and monitoring services losing customers due to the advent of Voice-over-Internet Protocol, or VoIP, telephone services. The majority of alarm systems installed in homes and businesses today are unable to communicate over VoIP, as they were designed with the specific tolerances and DTMF ranges of standard PSTN phone lines. VoIPAlarm allows these alarm systems to communicate over broadband with the addition of a single, inexpensive adapter, called the alarm broadband adapter. The adapter also works to re-enable alarm signaling in locations that have disconnected their phone lines entirely, such as homes whose residents have switched to using cell phones.

The alarm broadband adapter is compatible with any alarm system that supports the Contact ID reporting format, which includes most alarm systems built in the last 20 years, and functions over any broadband Internet connection. When the alarm system attempts to send signals, the adapter captures those signals and transmits them over IP to the VoIPAlarm servers. VoIPAlarm then decodes the signals and retransmits them over its own dedicated phone lines to the central station of the dealer's choice. Signals arrive at the destination receiver in an identical manner to signals sent via traditional means, with no extra equipment required at the station. In addition to carrying a much lower cost than replacing an entire alarm system with one built for IP communications, VoIPAlarm adds a number of features the dealer can offer to their customer. These include an online signal log, online test mode, selective suppression of signals like tests and arm/disarm reports, and email notifications of alarms.

VoIPAlarm also adds line security to any system, as the adapter is continuously tracked by the VoIPAlarm servers. If an adapter loses its connection, an alarm signal can optionally be generated by VoIPAlarm, triggering a response from the customer's monitoring service. This feature is not available with standard telephone lines, where the central station has no way to tell if a system's phone line has been cut or otherwise disrupted.

The revamped interface for installing VoIPAlarm is based on a "plug & play" philosophy. The adapter can simply be connected to the alarm system's phone line, to power, and to the Internet. It will immediately begin to send the alarm system's signals to its central station, using the settings already programmed into the system. No setup or configuration whatsoever is needed, and the alarm system's operation will continue exactly as over a standard phone line. A standard telephone can be used to test that the signals were processed correctly, using a simple voice menu system. Within five days, the alarm dealer must log into the VoIPAlarm website to arrange payment for the VoIPAlarm service. This can be done from the dealer's office or anywhere else, and does not need to be done during the actual installation. These enhancements are estimated to cut the installation time to below 30 minutes, and to require no special equipment or training on the part of the alarm installer.

VoIPAlarm and the alarm broadband adapter are available now from several distributors.

Sipera Systems and Future Com Partner to Secure Enterprise Unified Communications

VoIP Monitor — Thu, 07 Apr 2011 16:55:51 GMT

Sipera Systems announces a partnership to better secure enterprise UC. Future Com has joined Sipera's Reseller Program as a Gold Tier Reseller, and is working with a major aviation industry customer, updating its security infrastructure to include UC, using best practice recommendations from Sipera and Future Com.

Sipera's UC-Sec appliances proactively address security risks associated with UC applications such as VoIP, instant messaging, IP video and collaboration tools, enabling government agencies and enterprise customers to adopt UC applications and apply comprehensive security. Sipera's groundbreaking "Borderless UC" architecture enables all communications to be encrypted and compliant on any UC device, at any internal and external location.

Sipera Systems' Solutions Streamline, Simplify VoIP Security for Payment Card Privacy Compliance

VoIP Monitor — Mon, 28 Mar 2011 17:31:00 GMT

Sipera Systems announced its innovative VoIP security solutions enable rapid and simple compliance with new guidance issued by the industry council for payment card privacy.

Earlier this month, the PCI Security Standards Council issued new guidance to protect credit card and payment card information in telephone-based transactions, including VoIP. The guidance advises businesses that handle credit cards to ensure the privacy and encryption of VoIP communications carrying cardholder data, and to control archiving and monitoring of these communications in compliance with PCI Data Security Standard rules.

Sipera's award-winning security appliance solution provides comprehensive application-layer security for VoIP, enabling an enterprise to implement these important security controls simply and easily.

Pre-integrated and interoperable with enterprise VoIP infrastructure from all leading manufacturers, Sipera's UC-Sec provides a complete application-layer security architecture for VoIP and UC in one simple appliance. The UC-Sec enables an enterprise to comply with the PCI SSC guidance on VoIP security with these capabilities:

Provides application-layer encryption and privacy to any supporting end-point.
Forks both signaling and media for monitoring and recording of clear traffic, even when it is encrypted, enabling centralized call recording and simpler architectures.
Enables full privacy of communications to remote call centers, and teleworkers, traveling workers, with no VPN appliances or concentrators to configure and manage.
Safely supports SIP trunks with the industry's best protection against toll fraud, eavesdropping and intrusion.
Supports advanced access control and user authentication, including clientless two-factor authentication, for VoIP phones.
Enables compliant VoIP and Unified Communications to VoIP phones, smartphones, soft-clients, video phones and other devices.
Complements an existing security architecture and compliance processes, including firewalls, IDS/IPS and other functions.

Sipera also offers the breakthrough E-SBC solution, a highly cost-effective enterprise Session Border Controller. The E-SBC enables enterprises to adopt low-cost SIP trunks to decrease telecom costs, while enhancing the security architecture and preparing the enterprise for advanced Unified Communications applications.

Sipera Systems Highlights Simplified Enterprise Smartphone Security at Enterprise Connect 2011 in Orlando

VoIP Monitor — Mon, 28 Feb 2011 18:06:56 GMT

Sipera Systems will be conducting live demonstrations of its SLiC smartphone security system at the Enterprise Connect 2011 conference in Orlando, February 28 - March 2, 2011.

The company also announced SLiC's integration with CounterPath's Bria iPhone Edition application, a SIP-based phone for Apple iPhone and iPod touch that uses Wi-Fi or 3G connections to make and receive calls.

Sipera will be conducting the demonstrations in its Gaylord Palms Convention Center booth, #628, Cisco booth #1009, and Presidio Networked Solutions booth #1037.

Sipera SLiC makes VoIP and UC on the smartphone "ready for business." Unlike untrusted, uncontrolled third-party VoIP or IM applications that are out of the enterprise IT or telecom group's control, Sipera SLiC integrates the smartphone into the enterprise's UC infrastructure. Sipera SLiC consists of:

A security appliance that sits in the enterprise DMZ, providing access control, authentication, encryption, policy enforcement, and threat detection and mitigation.
Interoperable smartphones with native SIP clients, or the downloadable Sipera SLiC client, which provides a secure SIP stack, VoIP capabilities and integration with enterprise security.

VoIP-Pal.com Announces the Successful Beta Test Completion of Its Antivirus Program for the Google Android Smartphones

VoIP Monitor — Wed, 02 Feb 2011 17:36:47 GMT

VoIP-Pal.com announces the successful completion of Beta Testing of its new antivirus program for Google Android smartphones. With VoIP-Pal's antivirus program, smartphone users can be protected against spyware and viruses such as Trojans and worms, and tools will be made available to reduce the risk of lost and stolen handheld smartphones. VoIP-Pal's antivirus program will be supported on Google Android 1.6, 2.1 and 2.2.

VoIP-Pal's new security product has now been tested and proven to work on any Google Android smartphone. It will provide automatic real-time protection against viruses, spyware, and other malware. In case your smartphone is stolen, an anti-theft protection is available which includes a GPS location system. Memory cards are automatically scanned when they are inserted to prevent any viruses or spyware on a card from infecting your smartphone. The Remote Backup feature of the program will backup all data stored on the smartphone so that important data can be recovered even if the device is stolen or lost.

VoIP-Pal's antivirus program for the Google Android will be made available to the public as a bundled package (PointsPhone Platinum™ which will also include a free Android App download, air time minutes, and DID) once released on its retail website www.pointsphone.com within the next coming weeks.

CyberData Releases the VoIP Indoor Keypad Intercom with Night Ringer

VoIP Monitor — Tue, 11 Jan 2011 18:48:56 GMT

CyberData Corporation announces the release of the highly anticipated VoIP Indoor Keypad Intercom with Night Ringer, available in flush or wall mount versions.

The Keypad Intercom, next in the line of SIP intercom devices which includes the Outdoor, Emergency and Indoor Intercoms, combines the functions of the current line of intercoms with a 12-key keypad that has programmable speed dial and provides local and remote secure door lock control.

Additional features now include priority-based multicast paging, a push to talk option, night ringer function and event reporting, as well as web based updating for firmware and user provided ring tones.

Kryptos Launches Military Grade Voice Encryption App for iPhone Available on iTunes

VoIP Monitor — Wed, 15 Dec 2010 18:55:54 GMT

Kryptos has launched a new iPhone application named Kryptos available for immediate download on iTunes for only $4.99. Kryptos utilizes 256 bit AES military grade encryption to encrypt voice communications between users while using 1024 bit RSA encryption during the symmetric key exchange.

Kryptos is a Secure Voice Over IP application. The product provides VoIP connectivity for secure calls over several networks including 3G, 4G and WiFi. As the access to cellular phones and mobile devices has evolved so has the propensity for security threats in regards to interception of calls made and received. Most people are not aware of how simple it is for hackers to use readily available tools, devices, etc., to intercept standard cellular calls.

Users download the Kryptos App from iTunes on their computer or directly from the App Store on their iPhone. Users then activate their account with Kryptos. Each user will receive an individual ID. Secure calls are made peer-to-peer between users.

On-Demand Webinars: E911 Solutions for VoIP and UC Deployments

VoIP Monitor — Tue, 07 Dec 2010 18:48:10 GMT

The webinars from 911 Enable's recently concluded E911 Solutions for VoIP and UC Deployments webinar series are now available for download "on-demand." They cover how IP telephony impacts E911, and provide in-depth information about how 911 Enable's products and services integrate with today's leading IP-PBX vendors. To learn more, download the webinar PowerPoint presentations or recordings here.

Redscan Publishes a Free Guide on Combating VOIP Security Threats

VoIP Monitor — Wed, 01 Dec 2010 17:23:01 GMT

VOIP technology is becoming increasingly popular as businesses seek to provide employees with latest telephony services, connect remote workers and keep costs under control, but the associated security threats must be recognised and guarded against, according to a new guide from managed security company, Redscan.

The guide, Securing Voice Over IP systems/a> sets out the major security risks that businesses which use VOIP systems and software can encounter.

Including:

Privacy concerns: the data from VOIP calls can be intercepted easily when compared to analogue calls. Businesses can mitigate the risk by taking security measures such as using individually firewalled vLANs and encrypting calls.

Access and authentication: there needs to be a strong authentication process in place. If a single password is used to identify a user it must be strong enough to discourage hackers.

Denial of Service attacks: VOIP networks are vulnerable to DoS attacks such as hackers flooding servers with connection requests - such attacks can bring down the entire system. Businesses that have an application firewall in place can protect themselves against these attacks.

Vishing: criminals have started using VOIP to carry out phishing campaigns, with some attacks being masked as coming from a trusted phone number. These attacks are likely to increase in sophistication and businesses must remain vigilant to avoid handing over any data to criminals.

The guide also covers; toll fraud; VOIP spam; replay attacks and traffic manipulation.

Simon Heron, Internet Security Analyst, Redscan says: VOIP brings many benefits to businesses such as reduced telephony costs, increased productivity and the flexibility of making and receiving calls to work numbers remotely, however, implementing VOIP systems and software does provide increased opportunities for cybercriminals to exploit security loopholes in corporate networks. Our guide highlights the main threats to businesses and provides advice on how managers can mitigate the risks associated with using VOIP.

Ingate Bundles Free SIP IDS/IPS Security Module with Firewall, SIParator Enterprise SBCs

VoIP Monitor — Mon, 04 Oct 2010 16:19:28 GMT

Ingate announces that Intrusion Detection System/Intrusion Prevention System solutions for SIP are now bundled as a free software module on Ingate Firewall and Ingate SIParator products. Firewalls and SIParators already in use can be upgraded for free.

With IP attacks to steal VoIP service a genuine threat, weak passwords still providing an opportunity for malicious activity and the potential for overloading VoIP systems a possibility, IDS/IPS has become a crucial security measure for enterprise deployments of SIP. Ingate is giving its SIP IDS/IPS module to all users of Ingate Firewalls and SIParators to protect against attacks targeting SIP devices, such as IP-PBXs. IDS/IPS works in tandem with Ingate's existing security technologies, further strengthening security for VoIP, SIP trunking, Unified Communications and other SIP applications.

Maximum VoIP Security

In addition to SIP IDS/IPS, Ingate also offers an optional Enhanced Security software module. Enhanced Security offers the ability to encrypt all SIP communications which makes it impossible for eavesdroppers to retrieve the original media streams or signaling.

The Enhanced Security Software Module includes:

Transport Layer Security which authenticates communication parties and encrypts the signaling on the public side, even if it is in the clear on the LAN.
Secure Realtime Transport Protocol, which adds encryption when the voice media streams are transported outside the enterprise LAN. When combined with TLS it further shields users from eavesdroppers, hackers and spoofers.

Availability

IDS/IPS is available now as a free software download for all Ingate Firewalls and SIParators.

For more information visit Ingate at ITEXPO West, October 4-6, 2010 at the SIP Trunk-Unified Communications Summit -- free to all ITEXPO attendees, in room 403A of the Los Angeles Convention Center.

Cellcrypt Launches Secure Mobile Phone Conference Calling

VoIP Monitor — Tue, 27 Jul 2010 18:02:47 GMT

Cellcrypt has launched a secure conference service that provides both device authentication and voice call encryption to participants using popular mobile phones like BlackBerry and Nokia smartphones.

Organisations depend on conference calls to run their daily operations and often discuss confidential and highly sensitive information on calls such as sales, supplier and executive management meetings, intellectual property discussions, high value business deal talks, crisis management calls or even discussions concerning disaster scenarios and national security.

But traditional conference calling services are open to abuse through unauthorised access. Where access security is in place for conference calls, it is often poorly managed with dial-in details and PINs seldom changing. A commonly reported scenario is for ex-employees to continue to access regular conference calls or pass details to unauthorised personnel.

Furthermore, as participants have become more dispersed, they often access conference calls using mobile phones, which are increasingly at risk of interception.

The Cellcrypt Secure Conference Service both authenticates the participant’s mobile phone and encrypts conversations end-to-end between each participant and the conference bridge, to ensure important conversations, from team briefings to board calls, remain confidential.

The conference calling service is easy-to-use, with participants simply selecting a bridge number from their Cellcrypt Mobile enabled Blackberry or Nokia smartphone to enter the call. Office phones can also securely participate in conference calls when connected via Cellcrypt’s Enterprise Gateway solution.

Organisations can manage conference calls using a simple web console to define all users that may access the conferencing service, create bridge numbers, define policies such as user white lists and additional access PINs. Optionally, a bridge may allow access from selected public telephones using Caller ID and PINs for authentication in geographies where the threat of interception is regarded as controlled (the call segments from public telephones are not encrypted).

The service builds on Cellcrypt’s existing solutions that provide encrypted voice calls on mobile phones, such as BlackBerry and Nokia smartphones, delivering government-grade security in an easy-to-use application that makes highly secure calling as easy as making a normal phone call. Utilising the IP data channel it supports all major wireless networks, Wi-Fi® and satellite. Encryption is government-grade and certified to FIPS 140-2 standard by the US National Institute of Standards and Technology.

Report: VoIP Cyber-Security Risks Predicted to Raise Insurance Rates

VoIP Monitor — Wed, 26 May 2010 15:36:06 GMT

Spurred by the lure of low cost, the unregulated and unprotected Internet–based telephone services are expected to produce major insurance losses according to a report issued by NJ-based telephone technology development and licensing company, Emerson Development.

The report, “VoIP Security Review: Insurance”, states that the discount VoIP telephone service, which is rapidly being adopted in the U.S. and throughout the world, is causing a shift from the reliable, secure traditional telephone network now in use, to an Internet environment of extreme risk.

As it becomes more prevalent, the report anticipates that VoIP will be increasingly attractive to those with malicious intent, and therefore will be progressively more vulnerable to hostile acts such as spying / espionage, hacking, intrusion, identity and intellectual property theft, and interruption of service. It points out that VoIP is exposed to all the cyber-risks of the Internet, plus unique risks related to voice communications such as eavesdropping on and recording of phone calls, or redirecting calls to an imposter organization (e.g., a hacker instead of a bank).

This is significant to the Insurance Industry because a growing range of insured user sectors are depending upon VoIP online telephone service. These sectors include, but are not limited to government, the military, manufacturers, the legal profession, the banking industry, the transportation sector, hospitals, pharmaceutical companies and medical practices, the not-for-profit sector, and private individuals in greater and greater numbers.

“Because of the Internet’s open architecture, every person and every system has direct access to one another,” the report’s primary author and CEO of Emerson Development, Mr. Harry Emerson states, “therefore,” he continues, “we all implicitly have a trusted relationship with every hacker and terrorist in the world”. This fundamental Internet architecture, the report explains, enables the broad range of cyber-security threats experienced today; VoIP, as an Internet application, has the same unavoidable vulnerabilities.

According to FBI Director Robert Mueller, in an April 23rd release, “The FBI considers the cyber threat against our nation to be one of the greatest concerns of the 21st century.”

Report co-author, risk-management expert Mr. Glenn Tippy, President and Managing Partner of Insurance Agency Gerrity, Baker, Williams Inc., anticipates that insurance carriers will increasingly price for Internet / VoIP telephone exposure. “Cyber insurance products will be created for users of VoIP, as well as for VoIP providers and vendors. The effects upon our economy will be profound,” he said.

Verizon Global Wholesale Boosts Functionality and Security for Selected VoIP Services

VoIP Monitor — Thu, 06 May 2010 19:06:37 GMT

Verizon Global Wholesale is now offering additional functionality for three of its product platforms, providing voice-over-Internet-protocol customers with a secure connection for transmitting information over the Internet and other public networks.

This new functionality enables the product platforms -- SIP Gateway Service, Advanced Toll Free IP Termination and Carrier IP Termination Transport -- to share a single, secure virtual private network connection called an IP Security tunnel. Currently, Verizon is the only major provider offering this connection, which provides additional security during call setup. Because IPSec is an industry standard and supported by most major equipment vendors, there is no need to create vendor-specific security protocols.

An IPSec tunnel maintains integrity and confidentiality because all data is encrypted prior to transmission, then authenticated upon receipt to verify the data has not been altered. The source of the data is also authenticated to prevent the possibility of such security breaches as "spoofing" an IP address – a fraudulent network technique in which a program or person masquerades as another.

Verizon's wholesale VoIP products continue to grow as more customers migrate from traditional voice platforms to IP platforms while taking advantage of the quality and extensive reach of the Verizon network.

Verizon's SIP Gateway Service, which carries billions of minutes of use each quarter, comes in four configurations: Inbound Complete, Two-Way Local, Two-Way Complete and Outbound.

SIP Gateway Services are complemented by Carrier IP Termination Service. This offering allows customers to take advantage of the cost savings of originating long-distance traffic and terminating that traffic via SIP protocol over a global network.

Verizon's Advanced Toll Free Service, which has been growing since its introduction in 2008, allows U.S.-based customers to support toll-free calling solutions on a global basis. Verizon's International Toll Free Service supports in-country toll-free dialing outside the U.S. across more than 80 countries and Universal International Freefone Numbers across more than 40 countries, giving customers a superior offering that combines expansive coverage with flexible configurations and robust features.

Cellcrypt Launches Secure Mobile-to-Office Voice Calling

VoIP Monitor — Tue, 27 Apr 2010 17:48:11 GMT

Cellcrypt launches Cellcrypt Enterprise Gateway which enables business executives to securely call office desk phones from their cell phone. The solution is aimed at senior executives travelling to hostile countries where phone interception is widespread.

In addition, mobile executives can securely access standard office telephony features – such as voicemail, conference calls and calling out to the public telephone network – allowing them to seamlessly continue their normal business routine when abroad assured that confidential corporate and personal information is kept private.

Cellcrypt Enterprise Gateway is an enterprise software application that interfaces with office phone systems (PBXs) and provides encrypted voice calling to Blackberry and Nokia mobile phones running Cellcrypt Mobile software. It also passes commands to and from PBXs via keypad tones and interactive commands to enable secure remote access to existing PBX telephony features such as conference calling.

Executives increasingly recognise the risk of call interception by foreign states, competitors, journalists and kidnappers, especially when travelling abroad. As recently as April 2010, an unauthorised spy centre was discovered in Latin America containing sophisticated cellular interception equipment used for spying on businesses, politicians and journalists. This is the latest example of illegal phone interception whose breadth and depth is only recently coming to the public stage. A 2005 report to US Congress* showed that far from being restricted to a few rogue nations, state sponsored interception is widespread, stating, for example, that 108 countries are actively engaged in collection efforts against US technology assets.

Another reason for business travellers to secure cell phone calls when abroad is to protect personal information from kidnappers in high-risk regions, such as South America. In 2009, an estimated 9,000 kidnappings took place in Venezuela alone.

Cellcrypt provides encrypted voice calls on mobile phones such as BlackBerry and Nokia smartphones delivering government-grade security in an easy-to-use application that makes highly secure calling as easy as making a normal phone call. Utilising the IP data channel it supports all major wireless networks including 2G (GPRS/ EDGE), 3G (HSPA, CDMA/EV-DO), Wi-Fi and satellite. Cellcrypt's encryption technology is compliant to FIPS 140-2 security standard, approved by the US National Institute of Standards and Technology.

gateProtect Releases New Skype Blocker Security Patch

VoIP Monitor — Thu, 22 Apr 2010 17:26:26 GMT

gateProtect released a security patch for its Unified Threat Management appliances that allows companies to block the use of Skype. This gives them a reliable way of stopping dangerous malware from entering the network via a potential security vulnerability, while preventing unwanted messaging and chatting during working hours. The patch, called HU-01050, is available immediately and will be installed automatically on all gateProtect firewall systems from Version 8.6 via the update server.

In almost all companies, the use of instant messaging programs like Skype, ICQ and AOL Instant Messenger is unwelcome. As they enable people to share files, they can pose a risk to corporate networks while distracting staff from their work. Skype is a particularly tough instant messenger as it is based on proprietary protocols that escape detection by proxies and firewalls in various ways, including encryption.

“Skype’s ability to slip through firewalls and NAT gateways is well known,” says Dennis Monner, CEO of gateProtect. “Administrators have long had an ongoing battle to block Skype. As no administrator permissions are needed to install it, many employees are unaware of their company’s security policies and use it without informing their IT department. As a result, companies have virtually no control over the data users share via Skype.” The Skype service uses Port 80 (HTTP) and Port 443 (HTTPS) for its internet connection, and in most companies these ports are open as they are needed for web use. Skype can also use higher ports (above1024) for its internet access.

Broadvox SIP Trunking Interoperability Certified with UM Labs Enhanced SIP Security Controller

VoIP Monitor — Tue, 20 Apr 2010 17:18:05 GMT

Broadvox and UM Labs announce interoperability certification between Broadvox GO! SIP Trunking and UM Labs’ family of enhanced SIP security controllers.

“Interoperability certification provides resellers and customers with confidence that Broadvox’s growing ecosystem of technology partners can support their specific PBX environment and provide enhanced cost effective connectivity and security solutions”, said Isaac Parampottil, Director of Product Management at Broadvox. “We welcome UM Labs as a technology interop partner.”

Peter Cox, CEO of UM Labs agreed, “We are very pleased to work with Broadvox, an industry leader in SIP Trunking, to provide their customers with additional proven solutions for SIP connectivity, security and voice encryption.”

The interoperability certification covers the entire range of Broadvox SIP Trunking services and UM Labs RC-2100 Small Business and EC-4200 Enterprise product lines.

Sipera Systems Unveils Enterprise VoIP and UC on iPhone

VoIP Monitor — Fri, 19 Mar 2010 17:32:37 GMT

Sipera Systems unveils a series of enterprise UC application security breakthroughs at the VoiceCon Orlando conference next week. Sipera also announced its SLiC smartphone security solution has been designated a Best in VoiceCon award finalist.

Sipera, a VoiceCon Orlando Silver sponsor, will conduct multiple demonstrations and product overviews in Sipera's booth, #408, the Cisco Systems Partner Pavilion, booth #1111, and with Coleman, a Presidio Company, in booth #937. Highlights include:

Unveiling secure Unified Communications on the iPhone, extending private, controlled and compliant IP-based UC from the enterprise to employees in any location using the Sipera SLiC secure smartphone UC solution. Sipera SLiC already supports leading smartphones and secures the mobile UC traffic of thousands of enterprise employees in countries around the world.
Demonstrating compliant and secure enterprise Video Conferencing for teleworkers and the distributed virtual enterprise. Demonstrations will showcase methods to avoid common service disruption risks, prevent security violations and ensure communications compliance.
Securing enterprise Instant Messaging, to satisfy privacy and security mandates, which is critical for users in healthcare, financial services, and other industries handling large quantities of real-time and historic sensitive information.

Sipera will also showcase UC application and device security best practices, and the company's solutions, including the UC-Sec product family and SLiC.

Acme Packet to Showcase Security and Interoperability Solutions at VoiceCon Orlando 2010

VoIP Monitor — Tue, 16 Mar 2010 18:23:20 GMT

Acme Packet will showcase its Net-Net session border controller solutions that deliver trusted, first-class unified communications for enterprise, contact center and government organizations March 22 – 25 at VoiceCon 2010, in Orlando, Fla. Acme Packet, a Best of VoiceCon award finalist, will be presenting, exhibiting and demonstrating its Net-Net product family at the Gaylord Palms Resort & Convention Center in booth 1129 located in the Florida Exhibit Hall on the lower level.

Acme Packet is one of seven finalists, out of over 40 submissions, for the 2010 Best of VoiceCon awards for the Net-Net SBC’s role in the Skype for SIP program. Skype deployed Acme Packet Net-Net SBCs to simplify the interoperability and feature compatibility of the Skype for SIP offering with enterprise IP-PBX equipment. Judged by a panel of industry experts, the Best of VoiceCon awards recognize exhibitors who have made significant technological advancements within the enterprise communications industry. The winner will be announced on Wednesday, March 24 at VoiceCon Orlando.

On the show floor, Acme Packet senior staff will be available to discuss how Net-Net SBCs are enabling enterprises in various industries to deliver secure, high-quality, real-time interactive communications. Enterprises are deploying Acme Packet SBCs to extend the benefits of IP communications beyond voice services to include real-time presence-based voice, videoconferencing, chat/instant messaging, multimedia collaboration, telepresence and more. To schedule a meeting with Acme Packet or view the demonstrations at VoiceCon, complete a meeting request form.

Acme Packet will be hosting product demonstrations highlighting secure enterprise SIP trunking, as well as how the Net-Net SBC protects an enterprise VoIP network against both malicious and non-malicious attacks. The demonstration will also showcase how the SBC enables secure access to all voice applications for remote workers, providing both enterprise and contact center organization the flexibility to deliver the same level of IP communications to home workers as if they were working from the corporate headquarters.

During the educational conference at VoiceCon, Acme Packet will be presenting in a Deep Dive session on Monday, March 22 at 9 a.m. Seamus Hourihan, executive vice president of marketing and product management at Acme Packet, will be speaking on the panel titled “SIP Trunking: Who's Offering What? Part 2” to discuss the role of the SBC in SIP trunking. More information on the 2010 VoiceCon Conference, including the speaking and award programs, is available on the VoiceCon website.

360networks Turns to Empirix to Enhance Network Monitoring and Troubleshooting

VoIP Monitor — Wed, 10 Mar 2010 18:49:17 GMT

360networks has selected Empirix’s Hammer XMS to enhance its monitoring and troubleshooting capabilities of potential issues across its more than 17,000 route miles of fiber optic network across the western United States.

360networks helps its voice, data and web-based application and service provider customers quickly pursue next-generation strategies, migrate from legacy networks, grow into new markets and services, and increase network diversity. By providing increased efficiency for analyzing, diagnosing and troubleshooting network issues, as well as providing the ability to correlate multiple VoIP and SS7 protocols, Hammer XMS enables 360networks to deliver high quality services to these customers.

Hammer XMS delivers carrier-class network monitoring that provides complete visualization into real-time service quality. Along with a flexible and easy-to-use Graphical User Interface, it optimizes the search and diagnosis process, while continuously monitoring the network. This benefit enables service providers to detect negative trends in voice quality early on, thus preventing poor service quality from reaching the customer.

SonicWALL Discusses VoIP Firewall at VoiceCon

VoIP Monitor — Tue, 03 Nov 2009 20:18:48 GMT

SonicWALL will be exhibiting at the VoiceCon conference in San Francisco, November 2-5, where the company will be discussing the rising use of VoIP, how to maintain high Quality of Service and low latency for voice traffic in a secure network environment. SonicWALL invites attendees to join them at booth #503 to view product demonstrations, join associated seminars and meet with executives to learn more about the new threats facing companies today and which questions to ask vendors when considering such voice deployments.

Managing the VoIP Bandwidth Conundrum

The movement to VoIP technologies for many companies brings more traffic to already crowded networks, busy with multiple other applications and data transfers. Network managers and administrators are now asked to work to maintain security levels at an absolute maximum to ensure the integrity of the corporate network, while securing suitable bandwidth for "heavy network-usage" applications such as VoIP. Key to the success of such deployments includes the ability to prioritize applications on the network (i.e. VoIP based apps), keeping connections clean to prevent viruses and other malware accessing the network and having visibility into all network traffic to better control it.

To achieve the above, companies should plan on using an Application Firewall within the IT infrastructure, providing them with granularity to decide which apps have access to the network and which don't. Such Firewalls also ensure a clean connection is always made by allowing it to tag VoIP traffic guaranteeing it the highest priority when receiving, inspecting, assembling and accepting VoIP content and is the best path to maximizing call quality and providing network protection.

VoIP Introduces New Threats

While the expansion of digital telephony and teleconferencing in today's business has brought VoIP into the mainstream, so too has it brought new threats into the corporate environment. Not only is VoIP vulnerable to classic network threats such as SPIT (Spam over Internet Telephony), phishing, Trojans, worms and viruses; it also introduces a slew of other threats to the corporate network including Eavesdropping, Interception (or call hijacking), Denial of Service attacks and more.

More key considerations when implementing a VoIP based deployment can be found at: http://www.sonicwall.com/us/products/resources/10661_14513.html

Sipera SLiC Delivers Smartphone Security for 'Business Ready' Mobile VoIP and Unified Communications

VoIP Monitor — Mon, 26 Oct 2009 18:59:10 GMT

Sipera Systems announces availability of the Sipera Secure Live Communications (SLiC) mobility solution. Delivering breakthrough enterprise-class communications privacy and security for VoIP and UC on smartphones, Sipera SLiC makes smartphone VoIP and UC "business ready."

Sipera SLiC is the industry's first security solution enabling enterprises to "tame" the smartphone, permitting employees to use VoIP, UC, cloud telephony, and other low-cost and feature-rich communications applications on mobile devices with complete security and privacy. In an important industry first, Sipera SLiC enables smartphone VoIP to include smart-card card authentication for accessing enterprise resources, providing unparalleled access control and communications privacy.

As a result, enterprises can:

Extend UC and VoIP to smartphones while ensuring privacy and security compliance by seamlessly extending the enterprise security perimeter to these devices.
Securely enable office phone functionality on smartphones, such as interoffice extension dialing, no matter where the employee is using the smartphone.
Offload cellular minutes to VoIP for dramatic savings, while maintaining confidentiality of mission-critical communications. This enables fully secure utilization of VoIP with dual-mode mobile phones.
For the first time ever, use Two-Factor Authentication with smartphone VoIP for enhanced access control.
Block threats that result in data leakage, toll fraud and a host of other security risks.
Enforce control on incoming voice spam with a one-click option on the phone to black list calls.
Easily manage and enforce the enterprise communications security posture on any device in any place, both inside and outside the enterprise border.

This includes office phones, home office UC devices, soft-clients on PCs and, now, smartphones and similar smart mobile devices.

Sipera SLiC already is in use by multiple customers, including a Fortune Global 500 enterprise, which is using Sipera SLiC to securely offload millions of minutes in cellular usage to VoIP. This case study and others will be introduced when Sipera SLiC is unveiled during a special free webinar on UC Security: "The Final Frontier: Secure Unified Communications to Any Device in Any Place".

As the smartphone market has exploded, hundreds of communication applications have been introduced that take advantage of WiFi and data services such as 3G, GPRS and other technologies. But these applications do not natively integrate into the enterprise security infrastructure, making it difficult for communications security managers to ensure communications privacy, data integrity, and other critical security requirements. As a result, employees are using unauthorized VoIP or other UC applications on their smartphones and violating privacy mandates and confidentiality rules, exposing themselves to eavesdropping, and increasing information security risks.

Sipera SLiC solves the smartphone security challenge by integrating the smartphone into the enterprise communications security infrastructure. The solution:

Automatically authenticates the smartphone back into the enterprise PBX or call manager.
Ensures encryption of IP-based communications.
Enforces security policies in real-time.
Blocks threats or blacklisted callers.

With SLiC, enterprises can ensure smartphone VoIP communications support compliance with FERPA, GLBA, HIPAA, PCI DSS, Sarbanes-Oxley and other government and industry mandates regarding control and privacy of information.

Sipera SLiC solution consists of:

Sipera's award-winning UC-Sec security appliance, deployed in the enterprise VoIP or UC network and providing encryption, access control and authentication, policy enforcement, and threat mitigation.
Integration and interoperability of UC-Sec with the enterprise's smartphones, which could be complemented by the Sipera SLiC Client, available for leading smartphone operating systems.

Mobile UC security will be the focus of a free webinar sponsored by Sipera on Wednesday, Oct. 28, at Noon Eastern time: "The Final Frontier: Secure Unified Communications to Any Device in Any Place." Featuring Aberdeen Group Senior Research Analyst Andrew Borg, the webinar will review the latest industry research, costs analysis, case studies and best practices for deploying UC, including to smartphones.

Patrick Sweeney Explains Security and Political Implications of VoIP and Video Network Control

VoIP Monitor — Wed, 09 Sep 2009 00:47:54 GMT

SonicWALL announces Patrick Sweeney, VP of Product Management and its resident expert on VoIP and video technologies, is available for comment about the threats associated with VoIP and video transmissions. He is also available to discuss the emerging requirements to control bandwidth and prioritize business critical applications as converged networks continue to grow. If interested, he can comment on the recent attempts by certain governments to control VoIP use.

The mainstream use of digital telephony by businesses is growing. Businesses large and now small are turning to VoIP and video to reduce expenses, simplify telephony administration, increase collaboration and improve productivity. Nevertheless, this switch also carries dangerous side effects. Because packet-based voice and video is only effective in real-time, quality of service interruptions, hackers and--sometimes even political leaders -- can increase message latency, jitter, packet loss and echo that either makes the communication unintelligible or blocks it. Each day employees download large files such as streaming audio and video or collaborate using video conferencing making bandwidth prioritization critical for conducting business.

Sweeney is available to talk about the security and technical issues, as well as the political implications of these actions that can include:

Denial of Service (DoS) attacks causing VoIP services to fail
Directory Harvesting entailing hackers using brute force to search for VoIP on a network
Eavesdropping using man in the middle attaches spoofing the MAC address of two users forcing the VoIP packets hackers force the packets to pass through their system for eavesdropping
Registration Hijacking where hackers get the Session Initiation Protocol (SIP), disable a valid user's SIP registration, and substitute it with their IP address
Spam over Internet Telephony (SPIT) produced by botnets using compromised systems to target millions of VoIP users.
Vishing (Voice Phishing) seeking to make users disclose sensitive or personal information for identity theft
Voice Service Theft involving unauthorized users who get access to a VoIP network

Recent examples of government intervention include: a coalition of government forces in Russia against the use of VoIP, South Korea's interference with VoIP transmissions and Costa Rica's objection to installing VoIP in the country.

Because of these emerging VoIP threats, an ideal solution delivers comprehensive protection against VoIP and video security threats, while providing the bandwidth and prioritization tools needed to optimize quality of service, says Sweeney..

BIO:         SonicWALL Vice President, Product Management Patrick Sweeney
             Patrick Sweeney is SonicWALL's Vice President, Product
             Management for all SonicWALL Business Units. With more than
             20 years of software development and product management
             experience, his current focus at SonicWALL is developing
             products that keep networks secure and wipe out the scourge
             of spam and phishing from inboxes, digital telephony and
             video everywhere.

WHAT:        Sweeney is available to discuss packet manipulation trends in
             VoIP and video technology and the potential political issues
             spawned by hackers and dictators working together in
             countries like China and Belize.

RESOURCE:    Easily managed and highly cost-effective, SonicWALL Converged
             Network Security solutions offer a high performance, multi-
             layered security approach that also maintains quality of
             service for time-sensitive voice and video applications.
             Further, all VoIP traffic between third-party VoIP telephony
             devices can be easily configured to traverse any SonicWALL
             Secure Remote Access solution.

Sipera Systems and Westcon to Provide Comprehensive VoIP/UC Security Solutions

VoIP Monitor — Wed, 19 Aug 2009 16:45:17 GMT

Sipera Systems announces an initiative with Westcon Group the leading specialty distributor in networking, convergence, security and mobility, to provide comprehensive VoIP/UC security solutions customized for education, healthcare, and finance.

As adoption of VoIP and UC has accelerated over the past several years, the security needs around these deployments have become increasingly apparent, including the unique security and privacy compliance needs of enterprises in various industries. Sipera and Westcon are working together to provide rapidly deployable solutions for resellers addressing enterprise customers in these vertical markets. This new initiative was made possible by the existing distribution partnership that supports Westcon's network of resellers and integrators developing solutions for target verticals using Sipera's solutions and appliances.

Among other features, the joint solutions enable:

Protection against denial of service attacks, eavesdropping, and toll fraud, as well as reconnaissance attacks and spoofing that lead to social engineering, vishing, SWATing, ID theft and similar criminal activity
Pandemic planning, business continuity and remote teleworker capabilities
Compliance with HIPAA and patient privacy requirements in healthcare
Targeted security architectures that meet FERPA privacy requirements in education
Encryption and privacy compliance that satisfy PCI DSS, GLBA and other mandates in financial services

The Sipera UC-Sec products are comprehensive, real-time UC security and VoIP security solutions that simplify and protect next-generation communications over any network to any device. Dozens of customers around the world rely on the UC-Sec appliances to safeguard their communications and boost compliance with privacy laws, regulatory mandates and mission-critical confidentiality requirements. Backed by the extensive vulnerability research of VIPER Lab, the UC-Sec solutions provide threat protection, policy enforcement, access control and privacy in a single, real-time appliance.

Increase in VoIP Installs, Pushes Security Vendor to License vPurity Software

VoIP Monitor — Wed, 05 Aug 2009 18:30:09 GMT

The explosive growth of the VoIP market, has compelled security vendors to look for solutions to harden VoIP installations for their clients. When Salare Security recently announced its vPurity solution to address VoIP security, one OEM Security vendor jumped at the opportunity to license it to protect its clients from the increasing security risks of VoIP that require mitigation.

vPurity OEM software was licensed to that OEM Security vendor in the second quarter of 2009. Details of the size of the licensing deal and the specific vendor are being withheld due to a non-disclosure agreement in place between Salare and the licensed company. "We see such an explosive growth of VoIP vulnerabilities and a massive array of potential covert channels that we had to rapidly expand our set of solutions. The best way to get our solution to the market is through these strategic partnerships," said Karen Letain, VP Marketing for Salare Security.

Salare's vPurity software works to stop the theft of electronic information using three key proprietary technologies: FlowSpect software, vTect software, and Active Network Behavior Analysis. FlowSpect software identifies the type of data payload that flows through a transmission without the use of traditional deep packet inspection and avoids the individual privacy concerns of deep packet inspection approaches. vTect software identifies data flow types based on observations about how packets flow through the transmission by examining very high-level statistical characteristics about the transmission's packets. Active Network Behavior Analysis finds malicious transmissions by pro-actively stimulating expected or unexpected responses from the transmissions. Combined together these technologies provide very robust protection against the theft of electronic information.

Sipera Systems Reports VoIP Toll Fraud Continues to Escalate

VoIP Monitor — Mon, 08 Jun 2009 19:24:42 GMT

Sipera Systems reports that VoIP toll fraud continues to escalate, based on evidence uncovered in numerous VoIP and UC architectures. Across dozens of security architecture reviews and solution deployments, Sipera's security experts have discovered numerous cases of vulnerabilities commonly exploited for toll fraud, including confirmed fraud resulting in losses ranging from a few thousand dollars to hundreds of thousands of dollars.

The vulnerabilities affect both enterprises and service providers, and they stem from widespread gaps in insufficient VoIP and UC security architectures. Toll fraud occurs when unauthorized users, often external to the service provider or enterprise, exploit vulnerabilities to make toll calls to domestic or international locations. The unsuspecting enterprise or service provider is subsequently hit with extraordinarily high toll charges or call termination charges that have no clear cause.

The primary security architecture shortcomings leading to toll fraud include:

Telecom Connectivity Vulnerabilities: Many enterprises have moved to SIP trunking for low-cost telecommunications connectivity. Unfortunately, these enterprises often rely on Session Border Controllers for security of real-time VoIP and UC traffic, making them highly vulnerable to toll fraud. In production security architecture analysis, Sipera has identified nine common configuration errors, vulnerabilities and functional limitations that leave enterprises using SBCs for VoIP security exposed to toll fraud risk.
Application-Level Vulnerabilities: In many cases, application servers, voicemail systems, and other communication systems can be easily exploited by fraudsters because of weak passwords and authentication schemes. Furthermore, security policy enforcement mechanisms in such systems are often inadequate to stop fraudsters from using them to gain access to toll calling facilities.
End-Point Vulnerabilities: Weak security on user devices and inadequate authentication schemes enable fraudsters to exploit these devices to pose as authorized users and gain access to toll calling facilities.

Along with partners like Vigilar, Sipera Systems and Sipera's VIPER Lab security research and consulting arm offer these solutions to customers seeking to improve their defenses against toll fraud:

Security assessments: Sipera's VIPER Lab offers the industry's most advanced VoIP and UC security architecture consulting services, including VoIP penetration testing and comprehensive UC vulnerability assessments.
Seamlessly integrated security appliances: Sipera's award-winning UC-Sec security appliances are the industry's only purpose-built, comprehensive security solutions designed for real-time VoIP and UC traffic. Used in dozens of deployments worldwide, UC-Sec prevents toll fraud in VoIP and UC via policy enforcement, access control, threat mitigation and encryption. UC-Sec fits flexibly into any security architecture to complement and enhance an enterprise's security posture.

SIP Security Book Gives a Detailed Overview of SIP Security Issues

VoIP Monitor — Tue, 02 Jun 2009 22:38:39 GMT

Research and Markets has announced the addition of John Wiley and Sons Ltd's new report "SIP Security" to their offering.

This book gives a detailed overview of SIP specific security issues and how to solve them. While the standards and products for VoIP and SIP services have reached market maturity, security and regulatory aspects of such services are still being discussed. SIP itself specifies only a basic set of security mechanisms that cover a subset of possible security issues. In this book, the authors survey important aspects of securing SIP-based services. This encompasses a description of the problems themselves and the standards-based solutions for such problems. Where a standards-based solution has not been defined, the alternatives are discussed and the benefits and constraints of the different solutions are highlighted.

Key Features:

Will help the readers to understand the actual problems of using and developing VoIP services, and to distinguish between real problems and the general hype of VoIP security
Discusses key aspects of SIP security including authentication, integrity, confidentiality, non-repudiation and signalling
Assesses the real security issues facing users of SIP, and details the latest theoretical and practical solutions to SIP Security issues
Covers secure SIP access, inter-provider secure communication, media security, security of the IMS infrastructures as well as VoIP services

Vulnerabilities and countermeasures against Denial-of-Service attacks and VoIP spam this book will be of interest to IT staff involved in deploying and developing VoIP, service users of SIP, network engineers, designers and managers. Advanced undergraduate and graduate students studying data/voice/multimedia communications as well as researchers in academia and industry will also find this book valuable.

WatchGuard: Strong Growth of VoIP Makes it a Target

VoIP Monitor — Tue, 14 Apr 2009 18:07:56 GMT

Recently published reports predict that nearly 75 percent of corporate phone lines will be using VoIP in the next two years; expectations are that half of small-to-medium sized businesses and two-thirds of all enterprise organizations will be using VoIP. By this year's end, the global total number of VoIP subscribers (residential and commercial) is expected to reach nearly 100 million users. Because of the ubiquity of VoIP, it is quickly emerging as a new and substantive threat vector to businesses worldwide. The following are the leading threats to business networks that use VoIP:

Denial of Service (DoS) - Similar to DoS attacks on data networks, VoIP DoS attacks leverage the same tactic of running multiple packet streams, such as call requests and registrations, to the point where VoIP services fail. These types of attack often target SIP (Session Initiation Protocol) extensions that ultimately exhaust VoIP server resources, which cause busy signals or disconnects.
Spam over Internet Telephony (SPIT) - Much like the majority of e-mail spam, SPIT can be generated in a similar way with botnets that target millions of VoIP users from compromised systems. Like junk mail, SPIT messages can slow system performance, clog voicemail boxes and inhibit user productivity.
Voice Service Theft - VoIP service theft can happen when an unauthorized user gains access to a VoIP network, usually by way of a valid user name and password, or gains physical access to a VoIP device, and initiates outbound calls. Often, these are international phone calls to take advantage of VoIP's toll by-pass capabilities.
Registration Hijacking - A SIP registration hijack works by a hacker disabling a valid user's SIP registration, and replacing it with the hacker's IP address instead. This allows the hacker to then intercept incoming calls and reroute, replay or terminate calls as they wish.
Eavesdropping - Like data packets, voice packets are subject to man-in-the-middle attacks where a hacker spoofs the MAC address of two parties, and forces VoIP packets to flow through the hacker's system. By doing so, the hacker can then reassemble voice packets and literally listen in to real-time conversations. From this type of attack, hackers can also purloin all sorts of sensitive data and information, such as user names, passwords, and VoIP system information.
Directory Harvesting - VoIP directory harvesting attacks occur when attackers attempt to find valid VoIP addresses by conducting "brute force" attacks on a network. When a hacker sends thousands of VoIP addresses to a particular VoIP domain, most of the VoIP addresses will "bounce back" as invalid, but from those that are not returned, the hacker can identify valid VoIP addresses. By harvesting the VoIP user directory, the hacker now gains a new list of VoIP subscribers that can be new targets to other VoIP threats, such as SPIT or vishing attacks.
Vishing (Voice Phishing) - Vishing mimics traditional forms of phishing - attempts to get users to divulge personal and sensitive information, such as user names, account numbers and passwords. The trick works by spamming or "spitting" users and luring them to call their bank or service provider to verify account information. Once valid user information is given, criminals are free to sell this data to others, or in many cases, directly siphon funds from credit cards or bank accounts.
Because of these quickly emerging threats, WatchGuard recommends that businesses using VoIP systems review their perimeter and VoIP security to ensure they have the most proficient security solutions in place.

Mark Collier Looks into his Crystal Ball, VoIP Security Trends and Predictions for 2009

VoIP Monitor — Wed, 28 Jan 2009 17:48:01 GMT

Mark Collier, a leading telephony and VoIP security scientist, author, and blogger, announces the release of his “VoIP Security Trends and Predictions for 2009.” The latest edition of Collier’s annual prognostications was posted today to his popular VoIP security blog at www.voipsecurityblog.com, alongside a “2008 VoIP Security Year in Review” companion discussion posted on January 13, 2009. Collier is CTO and VP of engineering of SecureLogix Corporation, an enterprise telephony security, optimization, and management company.

In summarizing his predictions, Collier noted “the poor economy will slow the adoption rate for VoIP and Unified Communications, and the rate of pure VoIP attacks will be basically the same as in 2008. Denial of Service, including floods, fuzzing, etc., will continue to be the biggest vulnerability for VoIP/UC deployments, though attacks will not be very common. However, I think the real voice security story through 2009 will be the continued increase in the types, frequency, and severity of application-level attacks against traditional and VoIP/UC voice systems, such as toll fraud, data network penetrations via modems, phone-based social engineering and identity theft, fax spam, and harassing or threatening calls.”

Collier added that “a larger transition to VoIP/SIP trunking at the enterprise network edge is the real lynchpin that will escalate the number and frequency of pure VoIP attacks in the future. While I think we’ll see a small increase in the adoption of SIP trunks in 2009, most enterprises will continue to use T1 or ISDN/PRI trunks for off-campus calls, thereby keeping VoIP security threats as largely an internal network risk or concern.”

FBI Warns of New Vishing Attacks Targeting PBX Systems

VoIP Monitor — Tue, 09 Dec 2008 17:05:00 GMT

The FBI has identified a new technique used to conduct vishing attacks where hackers exploit a known security vulnerability in Asterisk softwar e. Asterisk is free and widely used software developed to integrate PBX systems with VoIP digital Internet voice calling services; however, early versions of the Asterisk software are known to have a vulnerability. The vulnerability can be exploited by cyber criminals to use the system as an auto dialer, generating thousands of vishing telephone calls to consumers within one hour.

Digium released a Security Advisory, AST-2008-003, in March 2008, which contains the information necessary for users to configure a system, patch the software, or upgrade the software to protect against this vulnerability.

If a consumer falls victim to this exploit, their personally identifiable information will be compromised. To prevent further loss of consumers’ PII and to reduce the spread of this new technique, it is imperative that businesses using Asterisk upgrade their software to a version that has had the vulnerability fixed.

Further, consumers should not release personal information in response to unsolicited telephone calls. Providing your PII will compromise your identity.

“As with all types of scams, whether by computer, phone, or mail, using common sense can protect you,” said Special Agent Richard Kolko, Chief, National Press Office, Washington, D.C.

To receive the latest information about cyber scams, please go to the FBI website and sign up for e-mail alerts by clicking on one of the red envelopes. If you have received a scam e-mail, please notify the IC3 by filing a complaint at www.ic3.gov. For more information on e-scams, please visit the FBI's New E-Scams and Warnings webpage.

Detected Fraudulent VoIP Companies at VoIPFraud.net

VoIP Monitor — Mon, 17 Nov 2008 18:50:46 GMT

How the world crisis affects telecoms? What tricks can you expect and how is it possible to protect yourself from them? We decided to talk about it with Daniel, executive manager of www.voipfraud.net – so far the most reliable anti-fraud web-portal concerning VoIP business. He noted that during the last month the number of publications about cases of fraud on www.voipfraud.net increased by about 20 percent against the previous month. “We had 5 companies added only during the last two days” – he says, - “the number of registered users on our portal has essentially increased as well. We believe, it shows that people are concerned about the situation on telecommunications’ market and they are trying to get as much information, as they can, to protect themselves.”

The worst if that fraud companies create a chain reaction, which can affect 3-4 or even more companies at a time. The company, that run into some major fraud in crisis period, may become a defaulter itself, so now its’ partners will not get expected earnings and may be forced to freeze their payments as well. So, now we are facing the situation when even honest company may become a threat for your business.

What can be done in this situation? Credit checks are not always 100% reliable, are they? Of course, the most obvious answer is to stop giving any credits and work only on pre-paid terms, but it would destroy most of small and middle telecoms and, correspondingly, weaken even powerful corporations.

Speedflow Communications has worked out trade-off decision intended for securing ourselves from defaulters and frauds as well as for preserving convenient conditions of partnership. In the nearest time all contracts with our partners will be reviewed with corrections in mutual credit lines. It will assure that all circumstances of current situation are taken into consideration and companies did their best to ensure themselves from risk of unreasonably big credits.

Taking all necessary measures so that our partners and clients don’t feel any pressure of this complicated situation, our major priorities now are to keep the quality of our services at the highest level and to make collaborating with us comfortable and mutually beneficial. We believe that having joined to live through hard times, we will strengthen partnering and continue growing together.

VoIPshield Discovers Security Flaws in Microsoft VoIP Products

VoIP Monitor — Wed, 12 Nov 2008 15:50:33 GMT

VoIPshield is making its first-ever announcement in a new category of research related to security vulnerabilities in VoIP and Unified Communications systems. These vulnerabilities affect applications that use media stream protocols like RTP, a popular standardized packet format for delivering audio and instant messaging over the Internet.

The Microsoft products affected are Office Communications Server 2007, Office Communicator and Windows Live Messenger. These products deliver software-powered VoIP, presence, instant messaging and audio/video/Web conferencing functionality to end users. Microsoft estimates that over 250 million computers worldwide run these applications. All use RTP to deliver the content of the message; therefore all are vulnerable to this class of attack.

The Microsoft vulnerabilities announced today, if exploited, cause a Denial of Service condition against not only the stated applications but the entire desktop environment.

Under its Responsible Disclosure Policy, VoIPshield confidentially discloses full details of the vulnerabilities to the affected vendors, and works with them to facilitate the development of application fixes. Details of the vulnerabilities are not publicly disclosed.

Securing the media stream is particularly challenging because once the messaging session is established, the flow of voice packets is not always monitored and managed by the call server.

Effective immediately, customers of VoIPshield's VoIPguard VoIP/UC Intrusion Prevention System can download the new signatures using the VoIPshield Update subscription service. VoIPguard contains over 500 VoIP/UC specific signatures to detect and prevent malicious signalling and media traffic.

Hacking VoIP: New Book Shows How Easy it Is to Attack VoIP

VoIP Monitor — Thu, 30 Oct 2008 16:39:53 GMT

VoIP is an increasingly widespread new technology that allows users to escape the tyranny of big telecom and make phone calls over the Internet. But while VoIP may be cheap and convenient, it's notoriously lacking in security. With little effort, attackers can eavesdrop on conversations, disrupt phone calls, inject content into existing conversations, change caller IDs, and access sensitive information—all without the awareness of the VoIP users making the phone calls.

Hacking VoIP approaches VoIP security from two angles, explaining VoIP's many security holes to both hackers and administrators. The book raises awareness of the importance of VoIP security, describes potential attacks, explains VoIP's biggest weaknesses, and offers solutions for protecting against potential exposure and attacks. Readers learn how to defend against VoIP attacks as they explore issues with VoIP security and the boundaries of VoIP protocols.

"VoIP is fun, but it's remarkably easy to attack," said No Starch Press founder Bill Pollock. "People think that when they pick up the telephone they're on a secure line, but not when that call is being made over VoIP. Hacking VoIP demonstrates just how easy it is to attack VoIP, and how best to plug those security holes."

Hacking VoIP explains every aspect of VoIP security, discusses popular security assessment tools, and explores the inherent vulnerabilities of common hardware and software packages. Readers learn how to:

Identify and defend against VoIP security attacks such as eavesdropping, audio injection, caller ID spoofing, and VoIP phishing
Audit VoIP network security and assess the security of enterprise-level VoIP networks such as Cisco, Avaya, and Asterisk and home implementations like Yahoo! and Vonage
Use VoIP protocols like H.323, SIP, RTP, and IAX
Locate potential vulnerabilities in any VoIP network
Use both existing and newly released VoIP security tools

Whether setting up and defending VoIP networks against attacks or just having sick fun testing the limits of VoIP security, Hacking VoIP is every user's go-to source for VoIP security and defense.

Cellcrypt Looks to Address Growing Concerns about Voice Security

VoIP Monitor — Wed, 08 Oct 2008 20:23:34 GMT

Cellcrypt is on a mission to appoint key channel partners worldwide to address the increasing concern about voice security. Many individuals and organisations have recognised the issue of voice security, however traditional encrypted mobile phones have severe limitations. Cellcrypt Mobile breaks through these barriers allowing resellers to offer dramatically improved solutions to existing customers and to reach customers whose problems they haven’t been able to solve until now.

While the risk of telephone calls being tapped has long been recognised, recent technology changes have increased the risk; this has led to a greater demand for voice security as individual’s and organisations’ integrity is threatened by risks to sensitive information in M&A transactions, corporate strategy, executive conference calls, contract negotiations, intellectual property discussions, investor relations, board discussions, increasingly across international boundaries.

Until now, secure mobile phone solutions have used the CSD data channel to transmit calls, which creates three major drawbacks: poor voice quality; long latency; and the inability to make international calls reliably. Cellcrypt Mobile makes secure calls over a mobile internet connection, allowing it to overcome all these issues, with the added benefit of low cost calls.

Cellcrypt’s new programme creates opportunities for partners to reach new and existing customers with a highly differentiated product that generates recurring revenues. The programme offers a strong financial incentive programme; a complete training curriculum; access to technical support services; and marketing, selling, and skills enablement.

Cellcrypt Mobile is a software application that, when installed on standard smartphones, encrypts voice calls between the mobile phones without impacting call quality. Cellcrypt Mobile uses high grade encryption and a very efficient VOIP implementation to deliver secure voice calls with low latency across 3G, WiFi, and GPRS networks.

VoIPshield Uncovers New Security Vulnerabilities in Enterprise VoIP Systems

VoIP Monitor — Wed, 08 Oct 2008 19:34:23 GMT

VoIPshield made its third announcement of security vulnerabilities in VoIP systems marketed by Avaya, Cisco and Nortel. This brings the total number of vulnerability groups reported to VoIP vendors in 2008 to over sixty, representing over 200 unique vulnerabilities. The vulnerability groups will be disclosed in limited detail at noon EDT today on VoIPshield's website at www.voipshield.com/research.

Under its Responsible Disclosure Policy, VoIPshield works with the VoIP vendors to assist them in reproducing the vulnerabilities in their labs, thus facilitating the development of software patches for the affected products. Avaya, Cisco and Nortel are acknowledging these vulnerabilities today on their websites, and issuing their own security advisories and patches.

Vulnerabilities were also discovered in Microsoft's VoIP products, and these will be announced next month. Under VoIPshield's disclosure policy, vendors may request extra time to create and test patches for their applications.

To date, VoIPshield Labs has performed extensive security research and testing on the following VoIP products:

Avaya - Communication Manager, Message Storage Server, SIP Enablement Server, IP hard-phones, and IP soft-phones.
Nortel - Business Communication Manager, Communication Server 1000, Media Communication Server Applications, IP hard-phones, and IP soft-phones.
Cisco - Call Manager, Unified Communication Manager, Unity Unified Communication, IP hard-phones, and IP soft-phones.
Microsoft - Office Communications Server and Office Communicator.

Vulnerabilities are categorized into four exploit types based on their most likely malicious intent: remote code execution; unauthorized access; denial of service; and information gathering. Each vulnerability is assigned a severity rating of Critical, High, Medium or Low based on an industry-standard measurement system modified for VoIP.

Effective immediately, customers of VoIPshield's VoIPaudit and VoIPguard products, and customers with subscriptions to VoIPshield UpdateTM, can download the new plug-ins and signatures.

The VoIP vulnerabilities discovered by VoIPshield Labs, if successfully exploited, could result in losses to the corporation in the form of lost revenues, brand reputation, mitigation expenses, productivity loss and eventually compliance penalties.

In April, VoIPshield was named one of five "Cool Vendors in Infrastructure Protection for 2008" by Gartner. In September, VoIPshield was named one of Canada's "Top 50 companies" by Red Herring.