Home > Unified Communications Tips > Unified Communications Tech Tip > VoIP security -- Free IP telephony fuzzing tools
Unified Communications Tips:
EMAIL THIS
 TIPS & NEWSLETTERS TOPICS 

UNIFIED COMMUNICATIONS TECH TIP

VoIP security -- Free IP telephony fuzzing tools


Gary Audin
05.07.2007
Rating: -4.00- (out of 5)


VoIP news and advice channel
Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google


This is the second of three tips that present tools for attacking VoIP security. The previous tip focused on tools for sniffing and manipulating the packet stream. This tip covers the attack technology called "fuzzing."

Fuzzing is a form of stress testing using malformed packets. Fuzzing is also known as functional protocol testing or robustness testing. It is usually used to automate vulnerability discovery. It finds bugs and vulnerabilities by producing different packet types that target a protocol. The fuzzing attack pushes the protocol's design specifications to the breaking point. It is often used by developers and vendor internal QA groups to test their protocol implementations.

It is dangerous to assume that the protocol implementations produced by a vendor are all identical. The protocol software can vary by software release and version. Chapter 11 of "Hacking VoIP Exposed," www.hackingvoip.com, provides a more in-depth discussion of the technique.

The electrical engineering department at Finland's University of Oulu has been working on VoIP security issues and has a good site to access, http://www.ee.oulu.fi/research. This site deals with specific signaling protocol attacks. Another resource is a long presentation by Hendrik Scholz, "SIP Stack Fingerprinting and Stack Difference Attacks," http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Scholz.pdf, which was given at the 2006 Black Hat conference. This security conference now


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google


RELATED CONTENT
VoIP QoS and VoIP Security
VoIP implementation study guide
How will VoIP impact the quality of phone calls on our network?
How does one cope with echo in a VoIP-enabled network? What's the best way to use an echo canceller?
Does implementing VoIP security affect the QoS? How would one handle it, if it does?
IBM, Avaya deals signal IP telephony quality control's coming of age
Ensuring voice and video quality about more than watching packet flows
Security concerns for enterprise Skype
VoIP service selection: MPLS, VPLS or Metro Ethernet?
Microsoft's Real-Time Codec (RTC) for VoIP optimization
Disaster and recovery in the VoIP/IPT RFP

Unified Communications Tech Tip
The significance of Avaya's Aura
UC buyers should look for SaaS-based UC offerings in 2009
Using the iPhone in the enterprise?
Social networking and discussion forums for the enterprise
Streaming Cisco's IP Communicator to an HP thin client
Demystifying unified communications deployment strategies
Presence management and security
Presence: SIMPLE versus XMPP
Four factors driving videoconferencing
Consider IBM Lotus SameTime for UC, not just Microsoft OCS

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
vishing  (SearchUnifiedCommunications.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary


has a separate track discussing VoIP security.

Any tools that attack an enterprise's security will of course cause damage to the operation of VoIP if they are used improperly. The links listed below usually have instructions covering the proper use of the tool, but even following the instructions may not eliminate damage.

This list contains free and commercial tools. There are many other free and commercial tools that are used by developers that can also be used to attack VoIP components. This tool list is not exhaustive; other free and commercial tools are available. The primary source for the tool list is www.voipsa.org from the VoIP Security Alliance. The tools in this tip deal only with fuzzing attacks.

The following is the list of free and commercial fuzzing tools:

The third tip in this series will focus on packet creation and signaling manipulation. Another set of resources and tutorials will also be included in the next tip.

About the author:
Gary Audin has more than 40 years of computer, communications and security experience. He has planned, designed, specified, implemented and operated data, LAN and telephone networks. These have included local area, national and international networks, as well as VoIP and IP convergent networks, in the U.S., Canada, Europe, Australia and Asia.

MOTT How to use fuzzing to deter VoIP protocol attacks http://searchvoip.techtarget.com/tip/0,289483,sid66_gci1163561,00.html

Rate this Tip
To rate tips, you must be a member of SearchUnifiedCommunications.com.
Register now to start rating these tips. Log in if you are already a member.




DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.



Communications Solutions for Business: Collaboration, Cell Phone Access, and IP Telephony
About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
SEARCH 
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2008 - 2009, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts