[VOIPSEC] Re: Voipsec Digest, Vol 2, Issue 33

[Brian Rosen]

I think we can all agree that if you have access to the switch management
system, you can eavesdrop.  If you have physical access to the switch, you
can eavesdrop.  In general, these are characteristics of all networks.
The former can be improved by following good practice on control of
passwords.  ACL use, in particular, if deployed, can avoid the "all
network admins know the common management password" problem.
Of course, this doesn't have anything specifically to do with VoIP,
but as many of us know, it's one of the most common internal security
issues.

Brian

> -----Original Message-----
> From: Voipsec-bounces at voipsa.org [mailto:Voipsec-bounces at voipsa.org] On
> Behalf Of Gerald Maguire
> Sent: Saturday, February 26, 2005 9:57 AM
> To: Voipsec at voipsa.org
> Subject: [VOIPSEC] Re: Voipsec Digest, Vol 2, Issue 33
> 
> Regarding
>     Date: Fri, 25 Feb 2005 17:31:51 -0500
>     From: "Brian Rosen" <br at brianrosen.net>
>     Subject: RE: [VOIPSEC] Actual Attacks
>     To: "'Mark Teicher'" <mht3 at earthlink.net>,	<voipsec at voipsa.org>
>     Message-ID: <mailman.2.1109398021.4428.voipsec_voipsa.org at voipsa.org>
>     Content-Type: text/plain;	charset="us-ascii"
> 
>     Are you aware of this actually happening, or is this all theoretic?
> 
>     I've never heard of actual incidents of any of this.
> 
>     The latter (eavesdropping) is actually the reverse; when we do
> testing, we
>     have to go through all kinds of grief to allow the sniffers to get at
> the
>     packets.  Someone has to actually bring a hub (not a switch) so we can
> sniff
>     the packets.  You can, of course, run Etherreal on some of the actual
>     devices.  It's amazingly hard to sniff packets in a typical switched
>     architecture.  When we implement CALEA (legal wiretap), it takes a
> special
>     box that we force all the traffic to go through so we can copy the
> packets
>     to the LEA.
> 
>     WiFi and your neighbor's cable modem excepted, of course.
> 
>     Brian
> 
> Many switches support the ability to replicate all the traffic to
> another port, see for example "port mirroring" for HP, Cisco, Foundry
> Networks, ... switches.
> 
> Regards,
> G. Q. Maguire Jr.
> 
> _______________________________________________
> Voipsec mailing list
> Voipsec at voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
>