[VOIPSEC] Actual Attacks

Mon Feb 21 16:02:37 CST 2005

I should clarify my comment below, regarding "centralizing the net"...by the
way I am not referring to the old mainframe world with terminals and
centralized resources, although this is similar, I was merely playing devils
advocate with the statement to stir more comments... :)

What I was attempting to convey was, that if we use PKI, a web of trust
(e.g., PGP), etc., we are centralizing the authentication methods used on
the net to a trust mechanism. I use all of these terms loosely in the
following for the sake of conversation and to draw additional comments.

The only way to provide non-repudiation is to centralize the trust mechanism
and insure that a means has been provided to prove the identity of the
subscriber. 

The trust mechanism may not necessarily be based on the commercial services,
such as Verisign, or other trusted CA's, or PGP, but may be groups of
organizations that have defined and agreed on their trust model and on the
trusted mechanisms of that model, for instance a common CA implemented by
the group of businesses, carriers, or even a network of independent users. 

In this case for VoIP, for instance, if you want to unify carriers and
independent users, there needs to be a common basis for trust. 

If this exists for this group of users and providers then it is a form of
centralized authentication that has implemented an authentication collection
mechanism to prove identity, trust mechanisms, etc.

But even if you do implement these types of mechanisms it does not create
security. For example, if the host running VoIP is compromised, the amount
of non-repudiation implemented can be rendered ineffective by a single
successfully exploited vulnerability. 

Once the host is compromised, even if the hosts has been implemented with
the best authentication mechanism we have to offer, by a virus, worm, remote
attacker, etc., at the point of exploitation, unless authentication is
implemented with the requirement of additional robust pass phrase which must
be successfully entered when necessary (which most Voice users don't want to
deal with), even the best authentication mechanism in the world can be used
to wage an attack against the VoIP system due to saved or cached pass
phrases (Bypassed for instance a checkbox at sign up that says "click here
to save pass phrase").

I didn't even mention something you have, which may be useful as well

Whew! Sorry for the long sentence...

The point is, security depends on layers of defense... in this case if a
host were compromised the host should have been running good antivirus,
spyware blocker, personal firewall, etc., in combination with a strong
authentication mechanism.

:)
________________________________

Christopher A. Martin
P.O. Box 1264
Cedar Hill, Texas 75106

Domains.SIP1.com
http://domains.sip1.com 
Low cost domain name registration & other Internet services.

Sign up for your PayPal merchant account today and start selling your
products on line today!
https://www.paypal.com/us/mrb/pal=Q622ZEE3CUWM8

> -----Original Message-----
> From: Voipsec-bounces at voipsa.org [mailto:Voipsec-bounces at voipsa.org] On
> Behalf Of Christopher A. Martin
> Sent: Sunday, February 20, 2005 10:37 PM
> To: 'Russell Howe'; Voipsec at voipsa.org
> Subject: RE: [VOIPSEC] Actual Attacks
> 
> That is the full risk of these types of clients. Once you create the all
> in
> one "universal adapter" all traditional security is blown away. VoIP in
> itself is a bypass of security measures, since the goal is to interoperate
> in any environment.
> 
> As much as we decentralize (peer-to-peer), if you truly want to secure the
> net, you have to devolve back into a centralized model...I like Ammar's
> suggestions regarding IPS, etc...
> 
> Just food for thought...
> ________________________________
> 
> Christopher A. Martin
> P.O. Box 1264
> Cedar Hill, Texas 75106
> 
> Domains.SIP1.com
> http://domains.sip1.com
> Low cost domain name registration & other Internet services.
> 
> Sign up for your PayPal merchant account today and start selling your
> products on line today!
> https://www.paypal.com/us/mrb/pal=Q622ZEE3CUWM8
> 
> 
> > -----Original Message-----
> > From: Voipsec-bounces at voipsa.org [mailto:Voipsec-bounces at voipsa.org] On
> > Behalf Of Russell Howe
> > Sent: Sunday, February 20, 2005 4:52 AM
> > To: Voipsec at voipsa.org
> > Subject: Re: [VOIPSEC] Actual Attacks
> >
> > On Sat, Feb 19, 2005 at 09:46:56PM -0600, Christopher A. Martin wrote:
> > > Endpoints will have to become robust enough to not only support VLAN
> > tagging
> > > but also association of specific applications to VLAN
> >
> > Then what happens when a device which does VLAN tagging gets
> > compromised? Nothing to stop the malicious code from chatting on
> > whichever VLAN it wishes, surely?
> >
> > If you move to making user devices VLAN aware, I don't see how you can
> > use VLANs as an effective security mechanism. They may well add an
> > element of obscurity, but security by obscurity isn't something to rely
> > on.
> >
> > --
> > Russell Howe       | Why be just another cog in the machine,
> > rhowe at siksai.co.uk | when you can be the spanner in the works?
> >
> > _______________________________________________
> > Voipsec mailing list
> > Voipsec at voipsa.org
> > http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
> 
> 
> _______________________________________________
> Voipsec mailing list
> Voipsec at voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org