What is VoIP security all about? After close to ten years of hacking and bashing VoIP, Ari Takanen will finally reveal the secrets and discuss the hype around VoIP security. The discussions in this blog will draw from his book "Securing VoIP Networks: Threats, Vulnerabilities, and Countermeasures" co-authored by Peter Thermos, and published by Addison-Wesley.
As the CTO of Codenomicon, the main focus of Ari's work is with security testing of various next generation communication technologies such as VoIP, WiMAX and IPTV. His latest book is focused on this topic, and is titled "Fuzzing for Software Security Testing and Quality Assurance". You can win a free copy of The Fuzzing Book from the Codenomicon web site.
Ari will answer any questions and comments you might have regarding penetration testing and fuzzing of next generation communication networks such as IP telephony.
Check out the sample chapter of the VoIP book here!
(Is There) Motivation for VoIP Fuzzing
What have we learned during these six or so years of proactive security work with VoIP fuzzing? Here is my top ten discoveries.
VoIP Still Not Ready For Carrier-Grade Networks
After a quick tour of some Really Talented Groups dedicated to fuzzing research, I noticed three things: 1) Most teams are focused on fuzzing VoIP 2) Most if not all VoIP devices still break with fuzzing 3) Most VoIP vendors still do not get it. The tour continues...
Reason Behind Vulnerabilities
Now something completely unrelated to VoIP: Reason behind all vulnerabilities in software! I read an article that explained how vulnerabilities are basically created by the fact that people tend to drift from good development principles into practices that are just simply Fun. The engineers among us know that software development can be enormously interesting, something you would happily even do in your leisure time. But can fun be converted into reliable software?
Good VoIP Deployment Guidelines (Do Not Exist?)
I get questions regarding VoIP deployment all the time. Sometimes it is someone looking for simple and cheap Enterprise VoIP, who are unsure if VoIP can be deployed securely with those two parameters in the equation. More often it is the security aware people who are willing to invest almost anything to make it work, but cannot. As always, there is no silver bullet solution for either. If you look at my past opinions, I keep changing my mind between cheap that works, and secure that doesn't. What do you think? Which way should we go in VoIP?
