SIP Threat Management device which is released by ALLO.COM is installed in front of any SIP based PBX system or VOIP gateway and offers extra layers of security against numerous types of attacks that are targeted towards IP telephony infrastructure. The features offered by the STM complement those of a traditional firewall or UTM, and it can be installed in conjunction with a UTM. Instead of losing thousands of dollars due to the victim of VOIP attacks, invest on 300$ worth of ALLO STM, which is plug & play. Investing in an STM to protect your communications network is a must.

1. Secure your IPPBX against
VOIP attacks

2. What constitutes VoIP fraud?
 What constitutes VoIP fraud?
 The most vulnerable targets remain small-medium size businesses that are new
to managing their own VOIP. They either don’t have the IT experience and staff
to properly secure and maintain the network, or they’re unaware of the risks
altogether having recently switched from a landline system. Whatever the
reason, many networks are consistently left unprotected. By the time most
companies realize that something is wrong with their phone expenses, it’s too
late—the network security has been compromised.
 Every year the number of PBX fraud victims increases dramatically. More and
more companies are targeted by individuals who are looking to bring down or
exploit the communications system. Some do it for fun and others for illicit profit,
but the end result is always the same… It results in the telephone bill of average
5,000$ USD to 80,000$ per attack to your carrier!

3. How big of a problem is VoIP fraud?
 Hackers targeted the phone system at Bob Foreman’s architecture firm in
Georgia, making $166,000 in calls in a weekend
 In 2009 when Michael Smith, a small business owner in Massachusetts,
found that someone had hacked into his private branch exchange (PBX)
to make $900,000 worth of calls to Somalia.
 A recent study from Pindrop Security found that nine out of the top ten
banks, and 34 of the top 50 banks had been victims of call fraud.

4. How big of a problem is VoIP fraud?
CFCA Global Fraud Key
Findings
 The Communications Fraud Control
Association (CFCA) release their 2013
global fraud report. They state that there
is $4.3 billion of global fraud, up 15% from
2011. It is a great report and resource
 Source: http://www.cfca.org/fraudlosssurvey/index.htm

5. The most common VOIP attacks on IP
Phone Systems
 DoS/DDoS attacks: These are designed to flood your PBX with an
exaggerated numbers of packets. Their goal is to bring down your
communication system and render it unusable.
 PHREAKERs: These guys take advantage of your negligence and steal from
you without really hacking anything… They just check the most
common/default user names and passwords used and if they get lucky,
it’s a bad day for the victim.
 Buffer overflow: Some VoIP fraud relies on methods typically used for
computer fraud. In this case, fraudsters use buffer overflow errors in
handling INVITE or session initiation protocol (SIP) packets. The flaw might
be used to crash applications or run arbitrary code.

6. The most common VOIP attacks on IP
Phone Systems
 SIP Device Fingerprinting: The hacker will try to identify which PBX software
is running or which hardware you are using. Once he gets this info, he will
look for their weaknesses and attack accordingly.
 Cross Site Scripting attacks: These are amongst the most complex and
hard to achieve. A script is injected in your PBX by the hacker and can
program it to do all kind of malicious actions such as having all your
extensions ring at once
 Toll Fraud Attacks : Hackers hijack your phone system to repeatedly call
long distance toll numbers that charge by the minute. The owner of the
long distance number - usually the hacker or an affiliate - charges your
company for using the toll line.

7. Tips to secure your VOIP infrastructure
 The STM – SIP Threat Management device which is released by ALLO.COM
is installed in front of any SIP based PBX system or VOIP gateway and offers
extra layers of security against numerous types of attacks that are
targeted towards IP telephony infrastructure. The features offered by the
STM complement those of a traditional firewall or UTM, and it can be
installed in conjunction with a UTM.
 Block specific IPs or countries, protect your PBX against hackers trying user
names and passwords, someone is trying to flood your PBX with a DDos
attacks? No problem!

8. Typical STM Installation Diagram
STM Functionality Video Link: http://www.youtube.com/watch?v=iEwfH5j9ZfE

9. ALLO SIP Threat Manager
 Uses the SNORT based Real Time Deep packet inspection engine, our STM
analyzes each SIP packet going to your phone system, identifies the
malicious and abnormal ones blocking the originating IP
 The appliance has been made to seamlessly integrate with the existing
network infrastructure and reduces the complexity of deployment.

10. ALLO SIP Threat Manager
 Instead of losing thousands of dollars due to the victim of VOIP attacks,
invest on 300$ worth of ALLO STM, which is plug & play.
 Investing in an STM to protect your communications network is a must.
 For more info, visit: http://allo.com/stm.html

11. Test Case scenario(Basic)
 Call blocker Rules:
 If you want to block the specific Caller numbers or Telephone numbers from specific
geographic region you can set the appropriate Call blocker rules in STM ( Security Settings Call
Blocker Rules)
 Is STM really blocks the unwanted Caller ID
Configure the Call blocker rule , select the
appropriate Call Blocker type from the list
and input the number need to block.
 Is the CBR rules working for you?

12. Test Case Scenario(Basic)
 Geo IP Filtering
 If your PBX getting SIP packets traffic from specific country IP address which unrelated for you.
Navigate (Security Settings Geo IP Filtering) and black list that Country
 To test this out and see whether STM performs this functionality, check your SIP trunk provider IP
address & hosting country. For Example if the SIP trunk server IP address associated to South
Africa block that country in Geo IP Filter.
 Is this working for you?

13. Test Case Scenario (Advanced)
 SIPVicious:
 SIPVicious is the python based tool suite that can be used to discover SIP based
Deployments and User Information from the unprotected setup.
 The tool suite bundled with set of tools which will enable the SIP Devices scanning,
User Extensions Discovery, Password Cracking Attempts.
 You can download the SIPVicious tool suite from
https://code.google.com/p/sipvicious/
 The svmap tool included the tool suite will enable the scanning of SIP devices
available in your network
 However the tool provides lot of options where the hacker can specify the template
for user enumeration/password guess, etc.

14. Test Case Scenario (Advanced)
 SIPp:
 SIPp is the open source based SIP traffic generator. It can be used to send
the various types of SIP requests to SIP Gateways/Servers with customizable
options as well as initiate the multiple concurrent SIP requests with specific
SIP headers.
 The tool can be downloaded from http://sipp.sourceforge.net/
 The tool also provides the advanced options like substituting the SIP
parameters in the XML template with the inputs from external CSV file
during the run time.

15. References
 References:
 https://resources.enablesecurity.com/resources/22_29_storming_sip.pdf
 http://www.ijcce.org/papers/263-OC0024.pdf
 http://www.backtrack-linux.org/wiki/index.php/Pentesting_VOIP
 https://code.google.com/p/sipvicious/
 http://sipp.sourceforge.net/
 http://www.blackhat.com/presentations/win-usa-02/arkin-winsec02.ppt
 http://startrinity.com/VoIP/SipTester/SipTester.aspx
 http://www.backtrack-linux.org/

16. THANK YOU