VoIp Security Services Technical Description Cyber51
Upcoming SlideShare
Loading in...5
×
 

VoIp Security Services Technical Description Cyber51

on

  • 332 views

Penetration Testing Services and Vulnerability Assessment Services.

Penetration Testing Services and Vulnerability Assessment Services.

Statistics

Views

Total Views
332
Views on SlideShare
332
Embed Views
0

Actions

Likes
0
Downloads
2
Comments
0

0 Embeds 0

No embeds

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

VoIp Security Services Technical Description Cyber51 VoIp Security Services Technical Description Cyber51 Document Transcript

  • VoIP Security Services Description
  • Table of ContentsVOIP PENETRATION TEST .......................................................................................... 3 INTRODUCTION ............................................................................................................. 3 METHODOLOGY ........................................................................................................... 3 Reconnaissance .............................................................................................. 3 Footprinting...................................................................................................................................... 3 Scanning .......................................................................................................................................... 4 Enumerating .................................................................................................................................... 4 Vulnerability Analysis ....................................................................................... 4 Exploiting .......................................................................................................... 4 Reporting ......................................................................................................... 5 Copyright © 2010 - 2012 Cyber 51 Ltd. All Rights Reserved. Web: http://www.cyber51.co.uk Email: info@cyber51.co.uk
  • VoIP Penetration TestIntroductionVoice over IP (VoIP) is being rapidly embraced across most markets asan alternative to the traditional public-switched telephone network.VoIP is a broad term, describing many different types of applicationsand using a wide variety of both proprietary and open protocols thatdepend heavily on your preexisting data networks infrastructure andservices.Because VoIP packetizes phone calls through the same routes used bytraditional enterprise data networks today, it is consequently prone tothe very same cyber threats that plague those same networks. Theseinclude denial-of service attacks, worms, viruses, and general hackerexploitation.For instance, if your enterprise is under attack from a distributed denialof service (DDoS) attack, internal users web browsing might be slowerthan normal, but a DDoS attack on a VoIP-enabled network cancompletely cripple your VoIP applications, at least to the point whereconversations are unintelligible.Our VoIP penetration test service points to follow same activities as amalicious hacker in order to verify and find weaknesses in your VoIPdeployments, reporting every vulnerability indicating associated risksand helping you to elaborate a detailed remediation plan.MethodologyReconnaissanceThe first phase of our services will focus in demonstrating how anattacker would first scan the whole network and then pick up specifictargets and enumerate them with great precision in order to proceedwith further advanced attacks through or from the hacked VoIPdevices. In order to do that, we are going to follow the below steps: FootprintingIn this stage, we will elaborate a profile about the target organizationby performing passive reconnaissance using tools such as Google, DNS,and WHOIS records, as well as the targets own website. Copyright © 2010 - 2012 Cyber 51 Ltd. All Rights Reserved. Web: http://www.cyber51.co.uk Email: info@cyber51.co.uk
  • ScanningIn this stage, we are going to use different remote scanning techniquesin order to identify potentially active VoIP devices on the network. Wecover the traditional UDP, TCP, SNMP, and ICMP scanning techniquesas applied to VoIP devices. EnumeratingIn this stage, we will be preforming various active methods ofenumeration over the different detected VoIP devices, fromsoftphones, hard phones, proxies, and other general SIP-enableddevices.Vulnerability AnalysisAfter successfully identifying the target systems and gathering therequired details from the above phases, a penetration tester will try tofind any possible vulnerabilities existing in each target system.During this phase a penetration tester will use automated tools to scanthe target systems for known vulnerabilities. These tools have their owndatabases consisting of latest vulnerabilities and their details.ExploitingIn this phase, once we have all the recollected information gatheredon previous phases of the service, we are going to perform differentexploitation tasks targeting the network infrastructure on which yourVoIP applications depend.Most of the techniques are originated from the traditional data securityworld, but applied here against VoIP devices and supporting networkservices.Also, for this specific stage, we have many open source andcommercial tools in place that help us in the different exploitation tasks(for example, CANVAS and a VoIP exploitation pack)Some techniques and tests:  VoIP Network Infrastructure Denial of Service (DoS)  VoIP Network Eavesdropping  VoIP Interception and Modification  VoIP Session and Application Hacking  Fuzzing VoIP  Flood-Based Disruption of Service  Signaling and Media Manipulation Copyright © 2010 - 2012 Cyber 51 Ltd. All Rights Reserved. Web: http://www.cyber51.co.uk Email: info@cyber51.co.uk
  • Note 1: DoS and DDoS only are tested if they have been accepted ansolicited at Project’s scope definition.Note 2: Eavesdropping and Interception techniques are only used inonsite testings.ReportingThe last phase in the entire activity is the reporting phase. This phasecan occur in parallel to the other three stages or at the end of theAttack stage.The final report will be prepared keeping in mind both Management aswell as Technical aspects, detailing all the findings with proper graphs,figures, etc. so as to convey a proper presentation of the vulnerabilitiesand it’s impact to the business of the target organization.An executive summary, describing in brief, the activities performed,findings, and high-level recommendations will be provided.Also detailed technical descriptions of the vulnerabilities and therecommendations to mitigate them will be documented in this report.All the security holes found and exploited will be accompanied withproper Proof‐of‐Concept by means of screenshots of the successfulexploits, or any other such methods.This report will consist in an Executive report containing, without to belimited to: conclusions, recommendations, statistics, and hackingmethodology brief, and a Technical Report containing without to belimited to: Information Gathering, Network Information, Analysis andAttack results of accomplished tasks. Copyright © 2010 - 2012 Cyber 51 Ltd. All Rights Reserved. Web: http://www.cyber51.co.uk Email: info@cyber51.co.uk