VoIP security

1
PacSec.JP/core04
Voice over IP (VoIP) security
Nicolas FISCHBACH Senior Manager, IP
Engineering/Security - COLT Telecom
nico_at_securite.org - http//www.securite.org/nico/
version 1.0
2
Introduction

• Voice over IP and IP telephony
• Network convergence
• Telephone and IT
• PoE (Power over Ethernet)
• Mobility and Roaming
• Telco
• Switched -gt Packet (IP)
• Closed world -gt Open world
• Vendors and Time to Market
• Security and privacy
• IPhreakers
• VoIP vs 3G

3
Architecture protocols

• Signaling
• User location
• Session
• Setup
• Negotiation
• Modification
• Closing
• Transport
• Encoding, transport, etc.

4
Architecture protocols

• SIP
• IETF - 5060/5061 (TLS) - HTTP-like, all in one
• Proprietary extensions
• Protocol becoming an architecture
• End-to-end (between IP PBX)
• Inter-AS MPLS VPNs
• Transitive trust
• IM extensions (SIMPLE)
• H.323
• Protocol family
• H.235 (security), Q.931H.245 (management), RTP,
  CODECs, etc.
• ASN.1

5
Architecture protocols

• RTP (Real Time Protocol)
• 5004/udp
• RTCP
• No QoS/bandwidth management
• Packet reordering
• CODECs
• old G.711 (PSTN/POTS - 64Kb/s)
• current G.729 (8Kb/s)

6
Architecture network

• LAN
• Ethernet (routers and switches)
• xDSL/cable/WiFi
• VLANs (data/voicesignaling)
• WAN
• Internet
• VPN
• Leased line
• MPLS

7
Architecture network

• QoS (Quality of service)
• Bandwidth
• Latency (150-400ms) and Jitter (ltlt150ms)
• Packet loss (1-3)

8
Architecture systems

• Systems
• SIP Proxy
• Call Manager/IP PBX
• User management and reporting (HTTP, etc)
• Off-path with IP
• H.323 GK (GateKeeper)
• Authentication server (Radius)
• Billing servers (CDR/billing)
• DNS, TFTP, DHCP servers

9
Architecture systems

• Voice Gateway (IP-PSTN)
• Gateway Control Protocols
• Signaling SS7 interface
• Media Gateway Controller
• Controls the MG (Megaco/H.248)
• SIP interface
• Signaling Gateway
• Interface between MGC and SS7
• MxUA, SCTP - ISUP, Q.931
• Transport
• Media Gateway audio conversion

10
Architecture firewall/VPN

• Firewall
• Non-stateful filtering
• Stateful filtering
• Application layer filtering (ALGs)
• NAT / firewall piercing
• (H.323 2xTCP, 4x dynamic UDP - 1719,1720)
• (SIP 5060/udp)
• Encrypted VPN
• SSL/TLS
• IPsec
• Where to encrypt (LAN-LAN, phone-phone, etc) ?
• Impact on QoS
• What is IPv6 going to change ?

11
Architecture phones

• IP phones
• Softphone or Hardphone ?
• Toaster
• Updates/patches
• Intelligence
• Intelligence removed from the network and put on
  the end device
• Flows between the phone and other systems
• SIP
• RTP
• (T)FTP
• CRL
• etc.

12
Architecture example
PSTN
POTS
LAN
SIP
IP PBX
IP VPN (MPLS)
IP PBX
POTS
internet
GSM
VGW
SIP
voice
SIP
signaling
SIP
13
Other phone networks

• POTS/PSTN TDM
• Wireless/DECT phone
• GSM
• Satellite
• Signaling (SS7)

14
Attacks

• IPhreakers
• IP knowledge
• Known weaknesses
• Evolution 2600Hz -gt voicemail/intl GWs -gt IP
  telephony
• Internal or external threat ?
• Targets home user, enterprise, government, etc ?
• Protocol implementations
• PROTOS
• The human element

15
Attacks denial of service

• Denial of service
• Network
• Protocol (SIP INVITE)
• Systems / Applications
• Phone
• Availability (BC/DR)
• Requires power
• Alternatives (Business Continuity/Disaster
  Recovery) ?
• E911 (laws and technical aspect)
• GSM
• PSTN-to-GSM

16
Attacks fraud

• Call-ID spoofing
• User rights takeover
• Fake authentication server
• Effects
• Access to voicemail
• Value added numbers
• Social engineering
• Replay

17
Attacks interception

• Interception
• Discussion
• Who talks with who
• Network sniffing
• Servers (SIP, CDR, etc)
• LAN
• Physical access to the LAN
• ARP attacks
• Unauthenticated devices (phones and servers)
• Different layers (MAC address, user, physical
  port, etc)

18
Attack interception

• Where to intercept ?
• Where is the user located ?
• Networks crossed ?
• Lawful Intercept
• CALEA
• ETSI standard
• Architecture and risks

19
Attacks systems

• Systems
• Mostly none is hardened by default
• Worms, exploits, Trojan horses

20
Attacks phone

• (S)IP phone
• Startup
• DHCP, TFTP, etc.
• Physical access
• Hidden configuration tabs
• TCP/IP stacks
• Firmware/configuration
• Trojan horse/rootkit

21
Defense

• Signaling SIP
• Secure SIP vs SS7 (physical security)
• Transport Secure RTP (with MiKEY)
• Network QoS LLQ (and rate-limit)
• Firewall application level filtering
• Phone signed firmware
• Identification TLS
• Clients by the server
• Servers by the client
• 3P project, security processes and policies

22
Conclusion

• Conclusion
• Other presentations
• Backbone and Infrastructure Security
• http//www.securite.org/presentations/secip/
• (Distributed) Denial of Service
• http//www.securite.org/presentations/ddos/
• QA

Image www.shawnsclipart.com/funkycomputercrowd.ht
ml