[VOIPSEC] Actual Attacks

[Christopher A. Martin]

Exactly. 

For one thing, competing businesses sharing the same provider would never
ever attempt corporate espionage against their competitor...would they?  :)

How about call diversion or splitting of media to listen to the
conversation? It is a valid feature of SIP to add more endpoints to the
media session (such as conferencing). If a security mechanism is not in
place to prevent the unauthorized form of this it is another valid (maybe
not existing, but there are many bright minds out there) risk.

Or theft of service from the telco... VoIP PSTN gateways for instance do not
require authentication today...unless the carrier implements concurrent call
limiting they could attempt to deploy more VoIP services bypassing the
carrier...Tom wrote some good examples of this.

Christopher A. Martin
P.O. Box 1264
Cedar Hill, Texas 75106
Chris at InfraVAST.com

> -----Original Message-----
> From: Voipsec-bounces at voipsa.org [mailto:Voipsec-bounces at voipsa.org] On
> Behalf Of Geoff Devine
> Sent: Friday, February 25, 2005 3:08 PM
> To: Voipsec at voipsa.org
> Subject: Re: [VOIPSEC] Actual Attacks
> 
> Tom Howe wrote:
> > 4) I've seen customers reverse engineer IP addresses from far end
> > gateways to establish business relationships outside of the
> > intermediary that orginally brought them together.
> >
> > 5) I've seen many, many, many, (many, many) grey market carriers
> > work at putting more traffic through routes than they had
> > persmission to, mask origination points to avoid billing, etc.
> 
> And, in another email:
> 
> > Therefore, because the money is there, and that's where the real
> > hackers go, SBC and service provider firewalls are the places we
> > need to concentrate.
> 
> This aligns with my view of the universe that a profit-making company
> acting as a service provider needs to assume that their customers are
> going to lie, cheat, steal, and do whatever they can to hack the service
> provider network to take it down.  To harden the service, you have to
> use VPN technology the way 3GPP does or you need some flavor of
> SBC/Firewall technology.  You can't trust endpoints.  You can only
> authenticate them and even then, you need to have the appropriate degree
> of paranoia.
> 
> Geoff
> 
> _______________________________________________
> Voipsec mailing list
> Voipsec at voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org