How to use fuzzing to deter VoIP protocol attacks

To demonstrate the effectiveness of this methodology, the University of Oulu's PROTOS project (http://www.ee.oulu.fi/research/ouspg/protos/index.html) developed functional test suites for several Internet protocols, including HTTP, LDAP, SNMP, SIP and H.225. The PROTOS Test-Suite: c07-sip exercises SIP proxy and user agent INVITE handling, using more than 4,500 test messages. The PROTOS Test-Suite: c07-h2250v4 tests devices that handle H.225.0/Q.931 Setup-PDU messages, including H.323 endpoint terminals and gateways, VoIP-aware firewalls and multi-point control units.

When these test suit

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT VoIP QoS and VoIP Security VoIP implementation study guide How will VoIP impact the quality of phone calls on our network? How does one cope with echo in a VoIP-enabled network? What's the best way to use an echo canceller? Does implementing VoIP security affect the QoS? How would one handle it, if it does? IBM, Avaya deals signal IP telephony quality control's coming of age Ensuring voice and video quality about more than watching packet flows Security concerns for enterprise Skype VoIP service selection: MPLS, VPLS or Metro Ethernet? Microsoft's Real-Time Codec (RTC) for VoIP optimization Disaster and recovery in the VoIP/IPT RFP VoIP Protocols SIP trunks a no-brainer for VoIP rollouts Digium's Asterisk PBX does God's work at Midwest church Microsoft's Real-Time Codec (RTC) for VoIP optimization Is there a difference between VoIP and IP telephony? VoIP for the globe-trotting frequent traveler SIP tutorial Springer Handbook of Speech Processing Top 10 VoIP tips for 2007 Push-to-talk implementation using SIP protocol IP PBX eases VoIP transition for gas company Unified Communications Tech Tip The significance of Avaya's Aura UC buyers should look for SaaS-based UC offerings in 2009 Using the iPhone in the enterprise? Social networking and discussion forums for the enterprise Streaming Cisco's IP Communicator to an HP thin client Demystifying unified communications deployment strategies Presence management and security Presence: SIMPLE versus XMPP Four factors driving videoconferencing Consider IBM Lotus SameTime for UC, not just Microsoft OCS

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary vishing  (SearchUnifiedCommunications.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

es ran against several representative SIP and H.323 implementations, product failure rates were alarming. Fortunately, many of these vendors used test results to correct identified vulnerabilities. Test case definitions and Java code for sending these test messages are available for downloading on the PROTOS project Web site, at no charge.

The PROTOS SIP and H.323 test suites clearly demonstrated the value of functional protocol testing, but they only scratched the surface of each protocol. Further testing of other VoIP protocol messages may uncover more vulnerabilities. Nonetheless, enterprises rolling out VoIP would be wise to take one of these PROTOS suites out for a test drive. Running functional tests against VoIP products under consideration or already installed in your company's network can identify vulnerabilities before attackers compromise them. The following are some key tactics for successfully testing products: Testing alone cannot defeat all attacks against VoIP. How you choose to deploy, configure and use your VoIP products is equally important. However, tests like these can help you reduce the inherent risk posed by SIP and H.323 protocols.

[IMAGE] This tip originally appeared as part of SearchSecurity.com's VoIP protocols: A technical guide

[TABLE]

Rate this Tip To rate tips, you must be a member of SearchUnifiedCommunications.com. Register now to start rating these tips. Log in if you are already a member. DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.