VoIP Security

As the popularity of telephony via the Internet, or VoIP grows, there are growing concerns about communication security. In this sense, as VoIP is a technology that is necessarily supported by many protocols and equipment of data networks, it inherits certain security problems that they present, with some threats being most important to VoIP classic security problems affecting the world of data networks.

When an attack occurs on a VoIP communication system, it is usually aimed at stealing confidential information, degrading the quality of service, or even shutting it down completely.

An attacker can target not only the content of a conversation (which can become highly confidential) but also the information and data of the call itself, which, used in a malicious way, will allow to access logs of incoming or outgoing conversations, set up and redirect calls, record data, play back conversations, carry out identity theft, and even make free calls from almost anywhere in the world. 

In a traditional telephone system based on circuit switching, there are different attacks that can be carried out: fraud, denial of service, call masking or wiretapping. 

In the case of voice environments based on IP networks, traditional telephony attacks are compounded by others belonging to the elements that integrate data networks. Therefore, their attack surface is higher and more difficult to manage, which may affect confidentiality, availability and integrity of information, through the use of malware, DoS attacks, MITM, among others possible, something not exclusive to voice elements.

VoIP Threats 

Many of the threats to IP telephony are inherent in data network technologies that support VoIP. In this sense, there are:

Listening, hijacking and modification of calls 

With these types of threats, an unauthorized malicious user can intercept calls, listen to them, modify both signaling and multimedia data, and even delete or change their purpose. 

Due to the lack of encryption and techniques that would allow an attacker with a computer to hear or capture related traffic, it can be possible to guess passwords, alter call recipients or even redirect them. At the same time, listening to and copying calls of any kind also imply a significant lack of privacy and can be used to compromise or extort callers. 

The most advanced attacks of this type would allow to tamper calls with noise and even get to impersonate a person for malicious purposes.

There are mechanisms to mitigate them, such as the use of encrypted protocols, however they are too rarely implemented. The risk posed by the breach affects confidentiality, integrity and availability of the service.

Denial of Service

This threat involves the possibility of causing user’s inability or difficulty to access a particular service. Its associated risk can even increase if a call is related to emergencies or medical services, for example.

Attacks associated with this type of threat can result in quality of service degradation, as is generally the case with network protocols. In this sense, additional services of the VoIP infrastructure such as DNS or DHCP can, after suffering an attack, imply a general deterioration of the voice service. 

The implementation of security elements such as firewalls and high availability systems, increase protection against this type of threats. A correct security policy must include options for recovery and continuity to mitigate this type of threat. 

Fraud and Abuse of Service

This type of threat involves inappropriate use of services where abuse or fraudulent use may occur. This type of threats known as toll fraud or telephone fraud, can involve phishing attacks or affect the billing of calls. 

This attack implies generating as many calls as possible. The attackers search on Internet routers and compromised IP-PBX systems to generate the calls, usually international and anonymous, that are charged to affected customers by their telecommunications provider. 

Physical Access or Deterioration of Equipment

This threat involves the intentional possibility that someone could gain unauthorized physical access to VoIP equipment, which can be theft of storage devices, access to unexposed network items, possibility of discontinuation or termination of different services. This risk violates the principle of availability of VoIP services.

Using Human Factor

The human factor is utilized for VoIP infrastructure manipulation. Failures in system or program configurations, unsafe or ineffective design, poor implementation or protocol design, or errors in software programming are themselves a group of threats to which any modern voice system is exposed.

In addition, there is always the possibility that people using VoIP systems are a gateway for scam or deception due to use of social engineering. These threats include phishing attacks, spam or theft of services or contacts. 

Secure VoIP Infrastructure

Any of the parts of a VoIP system is susceptible to attacks, so a safe configuration must be considered in general, without leaving aside any element, since either of them, usually the weakest one, can be used as a gateway to the system. 

The analysis of the most frequent threats and attacks to the VoIP infrastructure, has generated a set of elements and considerations that should be taken into account for the configuration of any secure voice over IP environment. In this sense the following can be highlighted: 

• Keeping systems updated and patched, which is essential, not only for IP telephony. It is essential that VoIP rests on a secure network infrastructure, protected by well-configured firewalls, and supported with up-to-date antivirus systems.
• Deploying intrusion detection systems (IDS) or prevention systems (IPS) in strategic points of the network to avoid incidents on protocols, services, port scans etc.
• Using encryption protocols, especially for mobile end devices or devices connected outside the internal network, usually from the Internet.
• Ensuring user authentication.
• Preventing multiple and consecutive incorrect authentication attempts.
• Using strong and unrepeated passwords, as well as implementing mandatory change of passwords preset by default.
• Using encryption on any of the additional elements, such as RADIUS or LDAP, for remote authentication, directory access in the network environment etc.
• Preferable use of a virtual private network (VPN) to encrypt the sending of data of any kind.
• Segmenting the network to separate voice from data using VLAN, in order to prioritize and protect VoIP traffic.
• Implementing access control lists (ACLs) for device management.
• Avoiding lags in time configuration of devices to prevent confusion in their usage logs.
• Monitoring abnormal use of the network, particularly those associated with VoIP, to avoid denial or degradation of service.
• Using secure protocols (HTTPS) in the management and configuration of end devices, as well as disabling unsecured protocols.
• Configuring permissions to make calls to different numbers from the VoIP infrastructure, as well as considering the possibility of blocking IP, as well as notification.
• Protecting and limiting access to the VoIP network as much as possible, especially from outside.
• Configuring the services correctly so that they do not show more information than necessary.

Overall, the increasing migration from traditional voice environments to VoIP systems brings many benefits for organizations, but this shift also creates increased exposure to cyber attacks. 

The main challenge for organizations is to take advantage of the benefits of IP telephony, preventing vulnerabilities associated with this technology.

The solutions by Protelion for network protection and high security VPN creation, with robust end-to-end encryption, are an option to ensure secure communications. In addition, to ensure secure conversations and the sending of messages and files, with independent encryption keys control, Protelion Messenger it's possible to use and create a corporate communications infrastructure protected by access from computers, smartphones or mobile devices.. For more information click here.