During Back Hat in Las Vegas at the beginning of the month, there was a complete security track on Voice Services. This track covered five major topic areas; Voice over Internet Protocols (VoIP) Protocols, Voice Encryption, Security Methodology, Inherent weaknesses of VoIP and vulnerabilities in WiFI dual mode phones. What is significant is that this is only the second time there is a complete track dedicated to this topic during BlackHat. Additionally each of these topic areas highlighted vulnerabilities in Voice Services and the need to increase Information Security (InfoSec) on this application and network implementation. [read]

Looking through the rear view mirror:
Special applications of encrypted Voice Services were rare in the 80’s and 90’s. Typically, these applications were one to one or one to a small group of encryption devices made by specialized manufactures. Users of these encryption devices encompassed the banking and the financial industry, also Government agencies or defense department related industries with a more sensitive information nature. The prevailing wisdom was the voice network was secure. In fact, this was a myth; to listen into a conversation all you needed was access to twisted pairs and a $95.00 Buttset, which anybody who can clip two alligator clips could use. The security risk was, predominantly, physical access to the wires or wiring room. [read]

Looking through the rear view mirror:
As the Data and Voice environments converge, becoming more prevalent in our corporate and personal life we need to look at security in a multi-dimension and multi-discipline manner. Barrie Dempster stated: “Convergence of Voice and Data networks goes against current network best practices, with firewalls, VPNs, VLANs focused on separation of data, with voice traffic on the data network now open to attacks using tools and techniques that have in the past been on data networks only”  [read]

Looking through the rear view mirror:
As enterprises across the world focused on VoIP as a cost reduction method to reduce the cost of inter-company long distance calls H.323 was introduced. This protocol was widely implemented to connect multiple Private Automatic Branch Exchanges (PABXs) in large and medium sized businesses across the globe. The attraction of this protocol was it allowed the connection between PABXs to share the same facilities as Data Networks and reduce facilities costs. [read]

Online fraud is evolving. Phishing and pharming represent one of the most sophisticated, organized and innovative technological crime waves faced by online businesses. Fraudsters have new tools at their disposal; and are able to adapt more rapidly than ever. [read]

Looking through the rear view mirror:
As more and more mobile devices are introduced to the network, a number of interesting new attack vectors appear. The classes of devices discussed focus on a dual mode environment that encompasses both cellular technologies and WiFI derivatives of 802.11. The cellular technologies typically include GSM and CDMA with the co-habitation of both radio and protocols with on 802.11 and its derivatives. [read]