• Share
  • Email
  • Embed
  • Like
  • Save
  • Private Content
Suhas Desai - Secure your VoIP network with open source - Interop Mumbai
 

Suhas Desai - Secure your VoIP network with open source - Interop Mumbai

on

  • 2,887 views

The purpose of this session is to focus on Open Source tools for VoIP, VoIP/SIP attacks and countermeasures. VoIP deployment has brought with it many security concerns like Non-Repudiation, ...

The purpose of this session is to focus on Open Source tools for VoIP, VoIP/SIP attacks and countermeasures. VoIP deployment has brought with it many security concerns like Non-Repudiation, Authentication, Call Quality, Integrity and Privacy; motivating the need for security solutions. VoIP security is complicated by the requirement of multiple components which are deployed on the current data network.

Statistics

Views

Total Views
2,887
Views on SlideShare
2,847
Embed Views
40

Actions

Likes
2
Downloads
89
Comments
0

5 Embeds 40

http://www.crn.in 25
http://www.slideshare.net 12
http://www.informationweek.in 1
http://newcrn.crn.in 1
http://www.docshut.com 1

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

    Suhas Desai - Secure your VoIP network with open source - Interop Mumbai Suhas Desai - Secure your VoIP network with open source - Interop Mumbai Presentation Transcript

    • Secure your VoIP network with open source Suhas Desai 10/22/2009 Confidential © Tech Mahindra 2008
    • Agenda •VoIP Overview •VoIP Security Threats & Business Impact •Possible mitigation considerations •Commercial Security Tools •Open source and VoIP •Role of Open source to secure VoIP •Case Studies Confidential © Tech Mahindra 2008 2
    • VoIP Overview Introduction to VoIP VoIP is being rapidly embraced across most markets as an alternative to the traditional PSTN. VoIP is a broad term, describing many different types of applications installed on a wide variety of platforms and using a wide variety of both proprietary and open protocols that depends heavily on preexisting data network’s infrastructure and services. The cost savings of VoIP compared to that of circuit switched networks is encouraging companies to move to VoIP. Issues and Concerns VoIP deployment has brought with it many security concerns like Non-Repudiation, Authentication, Call Quality and Integrity and Privacy; motivating the need for security solutions to deal with the many issues. In India, VoIP calls to PSTN are not allowed. For enterprise networks, VoIP are the effective solutions in India. Confidential © Tech Mahindra 2008 3
    • Agenda •VoIP Overview •VoIP Security Threats & Business Impact •Possible mitigation considerations •Commercial Security Tools •Open source and VoIP •Role of Open source to secure VoIP •Case Studies Confidential © Tech Mahindra 2008 4
    • VoIP Security Threats & Business Impact VoIP Security Threats Business Impact Confidentiality, Integrity and authentication Privacy Non-repudiation Social Threats QoS Confidential © Tech Mahindra 2008 5
    • Agenda •VoIP Overview •VoIP Security Threats & Business Impact •Possible mitigation considerations •Commercial Security Tools •Open source and VoIP •Role of Open source to secure VoIP •Case Studies Confidential © Tech Mahindra 2008 6
    • Possible mitigation considerations [1] Deploy VoIP traffic monitors Monitor the connections for log activities and fraud detection. [2] Employ encryption techniques Strong encryption techniques allow privacy and confidentiality over the network. [3] Use voice firewalls Control inbound and outbound connections by filtering the traffic. [4] Use adequate security infrastructure such as secure gateways, gatekeepers & proxy servers. [5] Use IPsec tunneling IPsec provides the secure communication over network by providing authentication and encryption [6] Conduct regular security audits Audit VoIP network regularly for security vulnerabilities . [7] Use VoIP platforms with adequate security features Prefer VoIP platform with built in security features for development and deployment of VoIP applications. Confidential © Tech Mahindra 2008 7
    • Agenda •VoIP Overview •VoIP Security Threats & Business Impact •Possible mitigation considerations •Commercial Security Tools •Open source and VoIP •Role of Open source to secure VoIP •Case Studies Confidential © Tech Mahindra 2008 8
    • Commercial Security Tools Need to perform security assessment of VoIP network with below tools! Commercial Security Testing Tools Confidential © Tech Mahindra 2008 9
    • Agenda •VoIP Overview •VoIP Security Threats & Business Impact •Possible mitigation considerations •Commercial Security Tools •Open source and VoIP •Role of Open source to secure VoIP •Case Studies Confidential © Tech Mahindra 2008 10
    • Open Source and VoIP Why Open Source? [1] Source code available , Easy to customize , Code reuse and redistribute. [2] Cost Savings. [3] Higher level of security. Open Source Tools SIP Proxies SIP Clients Mini-SIP-Proxy, MjServer, MySIPSwitch, Cockatoo,Ekiga,FreeSWITCH,JPhone,Kphone, NethidPro3.0.6, Net-SIP, JAIN-SIP Linphone, minisip,MjUA,OpenSIPStack,OpenZoep, Proxy,OpenSBC,OpenSER, PJSUA, QuteCom ex-Open Wengo, SFLphone, OpenSIPS,partysip,SaRP,sipd,SIPExpress Router, Shtoom,SipToSis,sipXezPhone,sipXphone,Twinkle, Siproxd,SIPVicious,sipX,Vocal,Yxa. YATE, YeaPhone. SIP Tools Callflow, Open Source Asterisk AMI, H.323 Clients pjsip-perf,miTester for SIP,PROTOS Test Suite, SFTF, SIP CallerID, SIPbomber, Sipp, Sipper, SIP FGnomeMeeting, ohphoneX,OpenPhone. Proxy,Sipsak,SIP Soft client, SIPVicious tool suite,SMAP,Vovida.org load balancer. H.323 Gatekeeper RTP Proxies GNU Gatekeeper AG Projects,Maxim Sobolev's RTPproxy,MediaProxy. Confidential © Tech Mahindra 2008 11
    • Contd… PBX Platforms Security Testing Tools Asterisk,CallWeaver,OpenPBX,PBX4Linux, VoIP Sniffing Tools SIPexchange PBX Pingtel's SIP PBX , AuthTool, Cain & Abel, Oreka , PSIPDump , rtpBreak , SIPomatic , SIPv6 Analyzer, UCSniff , VoiPong, sipwitch,sipX. VoIPong ISO Bootable , VOMIT , WIST. VoIP Scanning and Enumeration Tools: IVR Platforms enumIAX, iaxscan, iWar, SCTPScan, Bayonne,CT Server,OpenVXI,SEMS,sipX PBX, SIP Forum Test Framework (SFTF), SIP-Scan, VoiceXML. SIPcrack, Sipflanker , SIPSCAN , SiVuS, SMAP. VoiceMail Servers VoIP Packet Flooding Tools: IAXFlooder , INVITE Flooder, kphone-ddos , Lintad,OpenUMS,SEMS,VOCP. RTP Flooder , Scapy , SIPBomber, SIPsak, SIPp . VoIP Fuzzing Tools: Fax Servers Asteroid, PROTOS H.323 Fuzzer, PROTOS SIP Fuzzer Asterisk Fax Email Gateway, Lintad,Hylafax. VoIP Signaling Manipulation Tools: Development Platforms BYE Teardown, SipRogue, VoIPHopper H323plus,OpenBloX,Ooh323c,++Skype. Confidential © Tech Mahindra 2008 12
    • Agenda •VoIP Overview •VoIP Security Threats & Business Impact •Possible mitigation considerations •Commercial Security Tools •Open source and VoIP •Role of Open source to secure VoIP •Case Studies Confidential © Tech Mahindra 2008 13
    • Role of Open source to Secure VoIP Best Practices for Securing VoIP with Open Source tools [1] Monitor VoIP traffic Continuously monitor VoIP traffic to identify VoIP attacks. Use tools - SIP-Scan, SiVuS , SMAP etc. [2] Use encryption Apply encryption for end points communication. Use SRTP (Secure Real Time Protocol). [3] Use Firewalls Put VoIP network beyond open source firewalls. Use firewalls - iptables. [4] Conduct security audits Audit VoIP network regularly for security vulnerabilities and configuration flaws. Use - VoIP Security Audit Program (VSAP). [5] Secure gateways, gatekeepers. Control the number of concurrent connections for proper utilize bandwidth. [6] Secure proxy servers Authenticate authorized access control. Use Asterisk. [7] Use IPsec tunneling Ipsec provides secure communication over the public networks. [8] Secure VoIP platforms Prefer VoIP platform with built in security features for development and deployment of VoIP applications Confidential © Tech Mahindra 2008 14
    • Contd… Open source products/tools provides options for : Secure configuration of servers Secure configuration of clients Securing gateways Securing Firewalls VOIP/SIP Security Assessment with Open Source before deployment :
    • Agenda •VoIP Overview •VoIP Security Threats & Business Impact •Possible mitigation considerations •Commercial Security Tools •Open source and VoIP •Role of Open source to secure VoIP •Case Studies Confidential © Tech Mahindra 2008 16
    • Case Studies Case Study 1- Security assessment with SiVuS tool SiVuS SiVuS is the vulnerability scanner for VoIP networks that use the SIP protocol. The scanner provides several powerful features to verify the robustness and secure implementation of a SIP component. SiVuS is used to verify the robustness and security of their SIP implementations by generating the attacks that are included in the SiVuS database or by crafting their own SIP messages using the SIP Message generator. 1. SIP Component Discovery 2. Message Generator Confidential © Tech Mahindra 2008 17
    • Contd… 3. Security Findings Report Confidential © Tech Mahindra 2008 18
    • Contd… Case Study 2- Security assessment with SIP Bomber SIP Bomber: SIP Bomber is used to test SIP-protocol implementation. SIPBomber is complied on Linux machines with asterisk server for testing of SIP server implementation. 1. Message Generator 2. Password Validation Confidential © Tech Mahindra 2008 19
    • Summary • Building VoIP network with open source is cost effective and reliable. • VoIP network can be secured with open source tools, its configurations and settings. • SiVuS and SIP Bomber tools can be used to assess your VoIP security. Confidential © Tech Mahindra 2008 20
    • References [A].Web [1]. http://www.voipsa.org [2]. http://www.voip-info.org [B]. Books 1. Patrick Park;”Voice over IP Security” ; Ciscopress. 2. Thomas Porter, Jan Kanclirz Jr;”Practical VoIP Security”; Syngress Publishing, Inc. 3. James Ransome and John Rittinghouse;”Voice over Internet Protocol Security”; Elsevier 4. Alan B. Johnston, David M. Piscitello;”Understanding Voice over IP Security”;Artech House Confidential © Tech Mahindra 2008 21
    • Thank You !!